> TPMs can also be used for some more obscure stuff. One cool example is the Intel Education Theft Deterrent solution, used in school laptops handed out by som

> TPMs can also be used for some more obscure stuff. One cool example is the Intel Education Theft Deterrent solution, used in school laptops handed out by some governments. They added a lock function to the BIOS code which checks the (hardware) TPM for signed data. During normal operation, the computer receives a "boot certificate" through an always-on OS agent application from a server physically located in school grounds and accessible only through their intranet. This signed certificate contains, among other things, a boot count (how many reboots until the PC gets locked) and an expiration date (how much time until it gets locked). The idea is that thiefs will not risk taking the computers because they would be unoperable within a few days/reboots, since the data is stored in the TPM and the lock code is in the BIOS itself. This turned out to be a disaster however, as most technical people just modded the BIOS to strip out the system altogether and made easily available tutorials on how to use an EEPROM flasher to load the patched binary. The end result is that, due to bad IT personnel in schools among other factors, legitimate users got their laptops locked all the time while thiefs easily flashed the patch and got them working in minutes.