As you probably know, a user needs admin rights to change the PIN used together with the TPM (TPM + PIN as the authentication option). Therefore, a standard user isn’t able to change the PIN.
So you have two different options to allow an user to change the PIN:
- Assign the user local admin rights (yeah I know, that’s not what most enterprises wants for their standard users)
- Develop and install a privileged process/service which uses manage-bde.exe –ChangePIN.
Unfortunately, there is no easy and sexy out-of-the-box solution to allow a standard user to change their PIN. 
BTW: you can find more information about possible deployments (samples and documentation) at http://code.msdn.microsoft.com/bdedeploy/Release/ProjectReleases.aspx?ReleaseId=3206.