Windows 10: Trusted Platform Manager TPM

In the light of the eventual availability of Windows11 it will be necessary to know if current computer hardware is compatible with the new system. Previously this verification occurred through the Windows Update system prior to initiating the update to a new Windows operating system, i.e. from Win8.1 to Win10. One way of checking Win11 compatibility for hardware is downloading the Windows Health Check software. However, it would seem this is not going to be immediately available unless you are a registered Microsoft Insider, so if not, then there will be a wait to find out. Meanwhile, from

:)

 

Bitlocker and Trusted Platform Module problems

We appreciate the screenshot you sent.

This issue usually occurs because the Trusted Platform Module (TPM)
uses the manufacturer driver and not the Windows built-in Trusted Platform Module driver.

To resolve this, you can manually uninstall and reinstall Trusted Platform Module. To do so, see the steps below:

• Open Device Manager on the device on which you are experiencing the issue
• Uninstall the Trusted Platform Module driver.

Give us an update after following the troubleshooting steps provided.

 

Verify Trusted Platform Module (TPM) Chip on Windows PC


Something I came across not long ago, is Firmware-based Trusted Platform Modules (fTPM). Whereas before in order to take advantage of a TPM you needed to have a physical TPM chip soldered to the motherboard, that seems to have changed at some point. You can now have either a Discrete TPM (Physical chip) or Firmware-based TPM.

As per THIS article, fTPM is acknowledged by the Trusted Computing Group (TCG) as a perfectly valid form of TPM and seems to perform much the same functions as a physical TPM. For Intel, their fTPM is called Intel Platform Trust Technology (PTT). I don't know what chips/motherboards/BIOS support PTT, however due to it being Firmware based (as the name suggests) and not requiring a separate physical chip, it means for some devices it's possible to retrospectively add a TPM to devices that didn't have one before.

Looking through the Intel NUC list, it's not just 6th gen Skylake NUC's that it's supported on, but also 5th gen Broadwell NUC's and 4th gen Haswell NUC's too. So if you have a NUC and you have the latest BIOS, then the chances are you have a TPM 2.0 module even if you didn't think you did. You just need to enable 'Intel Platform Trust Technology' in BIOS. As previously mentioned, I don't know what other manufacturers support/will support fTPM too.


The Intel Platform Trust Technology (PTT) setting in Intel VisualBIOS:





With Intel PTT on in BIOS, Device Manager and tpm.msc show a TPM 2.0 module installed.

 

Initialisation of the Trusted Platform Module (TPM) failed

I'm not finding any specific issues on Win 10 1909, but ironically, there are a couple of known TPM issues on 2004.

If you do upgrade to 2004, I would suggest installing the currently available Cumulative Update Preview KB457144.

From the list of fixes there are 2 TPM related issues addressed:

1) Addresses an issue that causes communication with the TPM to time out and fail.

2) Addresses an issue that prevents hash signing from working correctly when using the Microsoft Platform Crypto Provider for Trusted Platform Modules (TPM). This issue might also affect networking software, such as virtual private network (VPN) applications.

Resources:

KB4571744 release notes:

https://support.microsoft.com/en-us/...date-kb4571744

You can download the preview release here:

https://www.catalog.update.microsoft...px?q=kb4571744

EDIT: If you prefer, you can also download that preview cumulative update by going into the updates section of settings and choosing the option called "View optional updates".