Windows 10: Device Encryption for Windows 11 doesn't show, even though TPM 2.0 is enabled

Hello,For some reason, that I can not find the answer to, Device Encryption will not show up in the Windows 11 settings. Here is the hardware I am using:Motherboard: MSI MAG Z590 Tomahawk WifiCPU: Intel i7 11700k @3.60GHz, 8 coreSSD: Samsung SSD 970 EVO Plus 1TBSSD: Samsung SSD 970 EVO Plus 500GBWhen I run the `tpm.msc` program, it shows that I do have TPM version 2.0 enabled and that it is ready for user. Yet, when I run the `msinfo32` program System Information and take a look at the Device Encryption support, it is showing this:Reasons for failed automatic device encryption: PCR7 Binding

:)

 

Windows 10 devices now requires hardware encryption/TPM

Stolen from Sweclockers, but it's in swedish.

So from now on devices (OEM built) needs a TPM module. Relevant bit:

Pretty interesting, but there's tons of questions I guess. I don't actually now anything about how TPM works, just that it's hardware, meaning the key is stored in a physical chip and that the decryption has to run through this chip. But I have no idea how let's say biometrics is tied to this. Or what the implications will be, or what exactly is encrypted. The entire storage or just the log in details as such?

 

TPM not usable, cannot install Windows 11

My machine is not able to be upgraded to Windows 11. Here is what my system info says:

• Device Encryption Support Reasons for failed automatic device encryption: TPM is not usable, PCR7 binding is not supported, Hardware Security Test Interface failed and the device is not Modern Standby, Un-allowed DMA-capable bus/device(s) detected, Disabled by policy, TPM is not usable
  
• Motherboard Gigabyte B450M S2H
  
• Processor AMD Ryzen 5 3600 6-core
  

I tried following the instructions at Enable TPM 2.0 on your PC - Microsoft Support

I got into the BIOS and it says that it is enabled, but no device found.

 

Windows 10 devices now requires hardware encryption/TPM

I think pushing TPM requirements is a good thing, this should've been done years ago...why folks wouldn't want to use it is beyond me. For many industries where encryption is required, TPM has been required for years...and supporting 2.0+ standards is the obvious way to go.

We deploy A LOT of devices in the medical industry where TPM and active encryption are required, honestly @Solaris17 has TPM pretty well covered. It really is a good thing to be supportive of when deploying encrypted devices on a professional level and a personal level, how important is your data?

For those that might need a little more understanding for what TPM can provide, take a quick read:

How to Use the TPM: A Guide to Hardware-Based Endpoint Security | Trusted Computing Group

Windows Trusted Platform Module Management Step-by-Step Guide

http://www.howtogeek.com/237232/what-is-a-tpm-and-why-does-windows-need-one-for-disk-encryption/

Not saying software-only solutions are better or worse, but in my experience, TPM works very well, if its there, and you know how to use it right, then why not use it? Some situations where TPM is not available or supported by the provided encryption solution means sure don't use it, and requires another solution like a USB key...something you need not lose. Make your footprint small and make yourself seem like you're not worth the effort of breaking the encryption to access your data. This topic could really expand out into great depth in a hurry...