Amd Cpu Upgrade. Security Processor Attestation Not Supported

I replaced the Amd Ryzen 5 5600g processor with Amd Ryzen 5 5600. In the tpm section, storage is ready. Attestation not supported. Motherboard msi b550m pro vdh wifi. The motherboard has been updated to its latest bios. Again, when I installed the 5600g processor later, I can see that this problem is gone. I bought an Msi b550 Gaming Plus motherboard, it has the same problem. I tried clearing the tpm from both windows and bios.

Hello @delurmi and welcome to ElevenForum.


Do you by any chance have the game: Valorant installed. The Vanguard anti-cheat in Valorant has been known to cause this issue.

Otherwise, you'll probably need to wait for a new motherboard BIOS.
Apparently AMD is aware of the problem, and rolling out BIOS fixes.

Ghot said:

Hello @delurmi and welcome to ElevenForum.


Do you by any chance have the game: Valorant installed. The Vanguard anti-cheat in Valorant has been known to cause this issue.

Otherwise, you'll probably need to wait for a new motherboard BIOS.
Apparently AMD is aware of the problem, and rolling out BIOS fixes.

Click to expand...

I'm honored. Thank you. I've never installed Valorant before. Motherboard bios version was published 20 days ago. When the 5600g is installed this folder is full, when the 5600 is installed it is empty. Regedit HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\Endorsement\EKCertStore\Certificates

I'm on a 3700X and I see this...

Ghot said:

I'm on a 3700X and I see this...

View attachment 76829

View attachment 76830

Click to expand...

This is what happens to me when I install the 5600g CPU. as it's supposed to be. But the problem persists when I install a 5600 CPU.

you are here:
-https://www.reddit.com/r/MSI_Gaming/comments/17mw7s1/msi_have_a_bug_with_ryzen_5xxx_series_cpu_tpm_and/

The thread there created by me.

boombastik said:

Buradasınız:
-https://www.reddit.com/r/MSI_Gaming/comments/17mw7s1/msi_have_a_bug_with_ryzen_5xxx_series_cpu_tpm_and/

Oradaki lastik tarafı benim tarafımdan oluşturuldu.

Click to expand...

I don't understand how they still haven't resolved it. My friend also uses 5600. He doesn't have this problem. But its motherboard is Asus brand. Msi is trying to force us to buy the TPM module.

Contact msi support. I contacted them and they say that they cant recreate it.

MSI is notoriously slow for getting the latest AGESA bits into their firmware.

This reddit post is for the release of AGESA 1.2.0.8 from last year:


It links to this AMD security bulletin:


Scroll down to the section that says

Client APUs and CPUs​

and you'll see this:

CVE	AMD Ryzen™ 2000 Series Desktop Processors “Raven Ridge” AM4	AMD Ryzen™ 2000 Series Desktop Processors “Pinnacle Ridge”	AMD Ryzen™ 3000 Series Desktop Processors “Matisse” AM4	AMD Ryzen™ 5000 Series Desktop Processors “Vermeer” AM4	AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics “Cezanne” AM4
Minimum version to mitigate all listed CVEs	Raven-FP5-AM4 1.1.0.F PinnaclePI-AM4 1.0.0.D ComboAM4PI 1.0.0.9 ComboAM4v2 PI 1.2.0.8 (2022-07-27)	N/A	ComboAM4PI 1.0.0.9 ComboAM4 V2 PI 1.2.0.8 (2022-07-27)	ComboAM4 V2 PI 1.2.0.8 (2022-07-27)	ComboAM4v2 PI 1.2.0.6 (2022-02-18)

Click to expand...

And yet, for my MEG X570 GODLIKE board, this is the most recent release:



Verify the latest UEFI fw update you installed shows AGESA 1.2.0.8.

Then, you'll probably have to reset the TPM - because you're using the on CPU fTPM, and not a dedicated TPM chip, like I am, so you changed the CPU, and it is correctly reporting that it can no longer attest to the validity of the fTPM - because the information is in the old one on the old CPU, not in the new on on the new CPU.

Even if you clear the tpm in windows or in uefi it says attestation is not supported.
The tpm attestation failed with error code 0x80070490.

Windows has this report:

TPM attestation isn't working on AMD platforms with ASP fTPM​

TPM attestation for AMD platforms with ASP firmware TPM may fail with error code 0x80070490 on Windows 10 and Windows 11 systems. This issue is resolved on later versions of AMD firmware. Consult with device manufacturers and firmware release notes for which firmware versions contain the update.
-https://learn.microsoft.com/en-us/autopilot/known-issues#tpm-attestation-isnt-working-on-amd-platforms-with-asp-ftpm

I am done with them. I will buy a discrete tpm chip.

Seems to be a bug after all:


Though that is a difference manufacturer.

The discrete one should work fine, but you'll want to clear it after installing. MSI's own prices aren't too bad (a bit more than they used to be before Windows 11 came out, but certainly not wallet-breaking:


That is where I got mine from. Pick the right one using this PDF:


Store link - oops, I'm wrong, it is priced rather higher than it used to be):

johnlgalt said:

MSI is notoriously

This reddit post is for the release of AGESA 1.2.0.8 from last year:

https://www.reddit.com/r/Amd/comments/zyk7zc

It links to this AMD security bulletin:

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-1029.html

Scroll down to the section that says

Client APUs and CPUs​

and you'll see this:



And yet, for my MEG X570 GODLIKE board, this is the most recent release:

View attachment 77165

Verify the latest UEFI fw update you installed shows AGESA 1.2.0.8.

Then, you'll probably have to reset the TPM - because you're using the on CPU fTPM, and not a dedicated TPM chip, like I am, so you changed the CPU, and it is correctly reporting that it can no longer attest to the validity of the fTPM - because the information is in the old one on the old CPU, not in the new on on the new CPU.

Click to expand...

Motherboard has the latest bios version installed. I also tried older versions and the result did not change. I even installed a Ryzen 7 5700x processor today. There was no change.

have you reported this amd cpu problem in the MSI global forum, delurmi?

erpster4 said:

Bu amd işlemci sorununu MSI küresel forumunda bildirdiniz mi , delurmi?

Click to expand...

I'll try to report it there

delurmi said:

I'll try to report it there

Click to expand...

I reported it there. But no one helped. No one has opened a post about this subject there.

delurmi said:

I reported it there. But no one helped. No one has opened a post about this subject there.

Click to expand...

Here's some more information. It seems that you... "don't need to worry about it".

The first response, here...

The answer that he gave is general and has nothing to do with the bug.
Also i bought a TPM 2.0 (MS-4462) and now tpm attestation is work.
If attestation don't work the bit-locker may have a problem and you can lost data.

Well-know bug from Microsoft:

TPM attestation isn't working on AMD platforms with ASP fTPM​

TPM attestation for AMD platforms with ASP firmware TPM may fail with error code 0x80070490 on Windows 10 and Windows 11 systems. This issue is resolved on later versions of AMD firmware. Consult with device manufacturers and firmware release notes for which firmware versions contain the update.
-https://learn.microsoft.com/en-us/autopilot/known-issues#tpm-attestation-isnt-working-on-amd-platforms-with-asp-ftpm

boombastik said:

Also i bought a TPM 2.0 (MS-4462) and now tpm attestation is work.

Click to expand...

Attestation works fine on my AMD CPU with fTPM.

...TPM attestation for AMD platforms with ASP firmware TPM may fail with error code 0x80070490....

May fail, don't fail for everyone.
The bug usually is after you upgrade a a 3xxx ryzen to 5xxx ryzen cpu.
-https://community.amd.com/t5/processors/ryzen-7-5800x3d-tpm-attestation-not-supported/m-p/572089#M50491

Appreciate this is an old thread, but thought I'd post that I have a similar problem, i.e. in the Security Dashboard it reports that Attestation is not supported.

I haven't upgraded my CPU (a Ryzen 9 5900X) and my motherboard (MAG X570 Tomahawk Wifi) has the latest BIOS (1F, AGESA 1.2.0.B) and I'm using fTPM.

I have tried a few things, viz. clear TPM from Windows, from the BIOS, cleared Secure Boot variables, hard reset, CMOS clear and re-flash. But no joy. The last resort thing that I haven't done is a clean install of 11.

The registry folder where the certificates should reside is empty - which is part of the problem of course. I'm about to see if anything can be done with Powershell scripts etc. but I'm not holding my breath, and it does seem that it's not really that much of an issue. Will see what happens and post back.