Attestation not supported Windows 11 Pro Ryzen 7 3700X

Hi Everyone,

Motherboard: MSI B550-A PRO
CPU: AMD Ryzen 7 3700X

My PC runs on Windows 11 Pro, but under 'Security processor details,' it states: "Attestation: Not supported."

I tried the following to resolve this issue, but without success:
- Installing the latest Windows updates and drivers, including the most recent version of the BIOS (version 7C56vAJ1) and chipset (AMD Chipset Driver 6.10.22.027) from MSI's website.
- In the BIOS: enabling and disabling secure boot, clearing the TPM, enabling and disabling TPM, and rebooting in between.
- Clearing the TPM via 'TPM.msc.'
- Reinstalling Windows after performing all the above steps.

I did not buy a TPM module.

After extensive online research, I discovered that one (or more) certificates related to the TPM are missing, likely the "EK cert" or similar. I read that this might be related to the fTPM of my processor.

Please see below for more information

Comand Windows Powershell: Get-TPMEndorsementKeyInfo
IsPresent : True
PublicKey : System.Security.Cryptography.AsnEncodedData
PublicKeyHash :
ManufacturerCertificates : {}
AdditionalCertificates : {}


tpmdiagnostics.exe getdeviceinformation:
-TPM Present: Yes
-TPM Version: 2.0
-TPM Manufacturer ID: AMD
-TPM Manufacturer Full Name: AMD
-TPM Manufacturer Version: 3.92.0.5
-TPM Vendor Id: AMD
-PPI Version: 1.3
-Is Initialized: True
-Ready For Storage: True
-Ready For Attestation: False
-Information Flags: 0x00000002
-Is Capable For Attestation: False
-Clear Needed To Recover: False
-Clear Possible: True
-TPM Has Vulnerable FW: False
-PCR7 Binding State: Binding Not Possible
-Maintenance Task Complete: True
-TPM Spec Version: 1.38
-TPM Errata Date: Friday, March 02, 2018
-PC Client Version: 1.05
-Is Locked Out: False

Hello @voornaamenachte and welcome to ElevenForum.

I gave you ten points for filling out your computer specs (sort of)...



It's not the AMD 3700X that's stopping you...

This shows on my comp, and I'm running a 3700X...





One of the least finished sections of Settings is the following... core isolation, attestation and memory integrity.
Personally I disabled all of that stuff.


From what little I remember, you need to enable virtualization in the BIOS, and in "Turn Windows features on an off".
But like I said...
I've been running Windows since the time of the dinosaurs, and managed to get by without any of that voodoo.

The same for TPM and Secure Boot, but I did enable those.



I just opened "Security Processor Details" again, and EVERY time I open it... it gives me different answers. LOL
This time I have no TPM and I'm "not" ready for Attestation.
I opened it again, and TPM is back and I'm once again ready for Attestation.
In other words... it's just more half baked MS voodoo. :/



You want to know how to protect your computer?

1. Be careful where you surf the web, and be careful of what you click on.
2. Use 3rd party backup software religiously.





Here's some other things that you may find useful...

I did not buy a TPM module.

Click to expand...

Normally one doesn't have to do that, usually part of the motherboard or an add-in 'chip' in a socket on the board especially if the computer came with Win11. I have a month-old Lenovo Ideapad Notebook with the Ryzen 5 CPU that came with TPM 2.0.

I have ordered a TPM module for the church's custom-built Desktop with a Gigabyte motherboard from late 2020 so as to get upgraded from Win10 to Win11 rather than replace the computer.

My Notebook: WinKey + R, type tpm.msc

I think the key here is that Virtualization might not be enabled in BIOS/UEFI. Please enable AMD-V in your BIOS and see if that solves your issue.

I have a 2 generations older AMD mobile CPU and attestation works fine for me too. I also have AMD-V enabled.

@voornaamenachte


Be advised... 24H2 has LOTS of bugs at this time.
MS needs some time to get everything working on 24H2.

SlicEnDicE said:

I think the key here is that Virtualization might not be enabled in BIOS/UEFI. Please enable AMD-V in your BIOS and see if that solves your issue.

I have a 2 generations older AMD mobile CPU and attestation works fine for me too. I also have AMD-V enabled.

Click to expand...

SVM mode has been enabled in the BIOS since I received this mainboard. It does not solve the problem.

Seems like this is an MSI issue on older boards...There was a bug in AGESA and AMD fixed this, but looks like MSI has been very slow at adapting to this fix. The issue is however on newer CPUs, but your issue may be related.

SlicEnDicE said:

Seems like this is an MSI issue on older boards...There was a bug in AGESA and AMD fixed this, but looks like MSI has been very slow at adapting to this fix. The issue is however on newer CPUs, but your issue may be related.

Click to expand...

MSI already released a BIOS update for that issue. My issue however remains.

voornaamenachte said:

MSI already released a BIOS update for that issue. My issue however remains.

Click to expand...

Not according to other threads I've read. Not all motherboards were treated equal and MSI support seems to be ignorant.

..but I digress, since this was about an issue with x3D CPU models...yours is different.

This thread got my attention because I also have an AMD Ryzen 7 3700X.

Motherboard: ASUS Prime X370-Pro
Original CPU: AMD Ryzen 7 1700X (02/23/2017)
Current CPU : AMD Ryzen 7 3700X (10/12/2021)

Last year I upgraded my computer from Windows 10 Pro to Windows 11 Pro.
I know I had enabled TPM 2.0 years ago and verified it by the following



But then I looked at the same screen as the OP:



I then went into the BIOS and changed Erase fTPM NV for factory reset from Enabled to Disabled.



Now when I booted into Windows I see that TPM seems normal now. Should I leave that TPM setting disabled in the BIOS?


L

It takes a while for the two values to turn into ready state after a boot. Took quite a while on my laptop. I doubt that setting you charged in BIOS affected the states in any way.