What Windows calls OwnerAuthFull
is the base64-encoded lockout password (I believe this is terminology inherited from TPM 1.2). You can test it with tpm2_dictionarylockout -c -p file:key.bin
, where key.bin
contains that password after decoding it with base64 -d
.
The TPM2 owner password (owner / storage hierarchy) is unset, you can verify that with this command:
# tpm2_getcap properties-variable | grep AuthSet
ownerAuthSet: 0
endorsementAuthSet: 0
lockoutAuthSet: 1