If you are going shopping for a TPM 2.0 module, here are some things to know

Jgr9 said:

But you didn't damage your Motherboard, did you? Did you ever get a TPM 2.0 Module working and Windows 11? Did you have the wipe the system (like for Secure Boot maybe or maybe because MS wouldn't give you an upgrade path with an older CPU without a clean install)? And how about performance?

Click to expand...

No, the motherboard was undamaged. I could not find a TPM 2.0 module for that motherboard (it's a very old MB for a 4th gen Intel CPU). I already had a version 1.2 module for it, so that is what I continue to use.

However, I do have Windows 11 running on it beautifully now. I know that it doesn't meet several Windows 11 requirements (TPM and CPU), but it's still a very capable machine. While not a 2.0 module, I do at least have a TPM 1.2 module, it has 32GB RAM, and that CPU still runs quite nicely for most tasks.

Ironically, I built a brand new machine just a couple of months before the first leaks of Windows 11 came out, so I was fully prepared for 11 just by pure dumb luck. If I had to run Windows 10 on this older machine it wouldn't bother me all that much, but for now, I'm very happy with how 11 is running on it. In fact, as far as performance goes, it seems to me like 11 runs even better on it than 10 did. I have no hard proof of that, but that is my perception.

You inquired about upgrading to windows 11. I did not even consider an upgrade. It's just my personal preference, but any time a new version of Windows comes out, I just prefer to do a clean install. I have my process so automated and so streamlined that I think I can pretty much do a clean install including installation of all drivers and apps faster than an upgrade install anyway .

Even with the Windows 10 feature updates, I was doing installs of new versions every 6 months. I had one machine that I would upgrade rather than clean install purely for testing purposes so that I stayed familiar with the upgrade process.

Is it still giving you Windows 11 Updates on the older machine?

Yes. In fact, I have machines MUCH older than that that also run great and continue to receive updates.

There have been some long discussions on the topic, and I won't rehash that here, but in my personal opinion, I HIGHLY doubt that older machines will stop receiving updates. There may come a time where a major feature update stops working on older machines, but that's a whole different story.

After plugging in a TPM 2.0 module, will Intel's Platform Trust Technology (PTT) be needed to be switched off?

I didn't think they would actually block most critical updates from older systems either, but a lot of people just reply with what MS said.

Welcome to windows Eleven Jgr9
:)

I'm not there yet. Don't know when I will be.

Stigg said:

After plugging in a TPM 2.0 module, will Intel's Platform Trust Technology (PTT) be needed to be switched off?

Click to expand...

Yes, you would use one or the other - either the physical TPM or the PTT firmware based TPM.

I'll have to check to be sure, but on my 11th gen Intel system I believe it automatically disabled PTT when I enabled the physical TPM module.

Many of you are chasing stuff you don't need. If you PC has Intel PTT, you DO NOT need to buy a TPM module as PTT is more than sufficient to meet Windows 11's TPM requirements.

None of my desktops have a discrete TPM module installed, and 11 still shows TPM utilized because PTT is enabled

Dru2 said:

Many of you are chasing stuff you don't need. If you PC has Intel PTT, you DO NOT need to buy a TPM module as PTT is more than sufficient to meet Windows 11's TPM requirements.

None of my desktops have a discrete TPM module installed, and 11 still shows TPM utilized because PTT is enabled

Click to expand...

I am pretty sure many who bought one already know that, but I got one from eBay for my motherboard for about $25.00 USD with free delivery, so considering that my motherboard is fairly new, I thought I would install one. In my opinion, the factory TPM module should already be part of the motherboard instead of an empty header. Maybe in future motherboard releases that will happen.

Stigg said:

I am pretty sure many who bought one already know that, but I got one from eBay for my motherboard for about $25.00 USD with free delivery, so considering that my motherboard is fairly new, I thought I would install one.

Click to expand...

Yeah. But you still "paid" for something you don't need. But I understand it's your money so....

Stigg said:

In my opinion, the factory TPM module should already be part of the motherboard instead of an empty header. Maybe in future motherboard releases that will happen.

Click to expand...

They've had empty TPM slots on motherboards forever, and they've yet to stick anything there

Dru2 said:

Yeah. But you still "paid" for something you don't need. But I understand it's your money so....


They've had empty TPM slots on motherboards forever, and they've yet to stick anything there

Click to expand...

Yes, but the arrival of TPM requirements with Windows 11 may prompt motherboard manufacturers to consider implementing it.
A recent BIOS update for my motherboard directly addressed Windows 11 TPM requirements by enabling PTT as the default setting.

It's just me speculating that future motherboards may have a hardware TPM module implemented now that there is more usage for it.

Stigg said:

Yes, but the arrival of TPM requirements with Windows 11 may prompt motherboard manufacturers to consider implementing it.

Click to expand...

You keep missing the point.... It is already implemented via PTT (aka firmware TPM via UEFI integration).

In other words, if you have a newish board (circa 2017) you don't need to buy a TPM module as it's already implemented via UEFI.

I'll echo what Dru2 says: The fact that a firmware implementation already exists makes it far less likely that a manufacturer will add the hardware. The MB makers literally go to great lengths to shave 2 or 3 dollars off the price of a MB.

However, there are still reasons to have a hardware TPM as it does offer some advantages over the firmware implementation. That's why I insisted on adding one to my MB even though my CPU and MB support PTT.

If you're one who has higher security requirements "requiring" a discrete TPM solution, then get one; for those that have never heard of TPM outside of Windows 11 (and never had a module before), fTMP (PTT) is sufficient for Windows 11.

If you have to ask what requires a "discrete TPM module" you probably don't need it. Again, PTT is sufficient for 11's requirements.

Jgr9 said:

Did you do a clean install or upgrade? I know you can probably just do it if it's clean, but I would think it wouldn't let you if tried to upgrade because it wants newer CPUs, too.

I'm on a MSI Z68A with a 2600K with 14-1 pin connection. Every once in a while I try looking into that older MSI 14-1 pin TPM 2.0 Module - which only says it supports Intel 300 series which is much newer. Unfortunately trying to contact MSI support gave me what felt like a bogus answer saying only that they don't have TPM 1.2(?) modules even though I didn't ask that? I just asked if that TPM 2.0 module would be compatible with my motherboard. Like it wasn't even a response really. It was like a checkbox of an item they don't have (a TPM 1.2 module, or 1.4 i don't remember). Just a copy-pasted bs response? But I still can't be sure.

I thought I've also read that there's a chance you might need to wipe your system to enable Secure Boot? And someone else maybe here, idk, said they fried their TPM chip because turns out it was incompatible (even with the correct pins for theirs?) But they never actually elaborated, which is frustrating.

Click to expand...

You can edit the registry before you download it, so you can shut off certain features. Honestly, I don't see a difference, I have a 10980XE x299 system, too. The only difference is speed but then again, that's the way the new systems are, fast. Besides, I needed the TPM 2.0 for something else on this computer. I use it in Mint Linux with a hardened kernel.

Is Windows 11 really all that good... Eh? Well.. If you want Microsoft to spy on you even more, then yes, go right ahead and install it. The interface is starting to look a bit more like Docker or Mac OS 12.2 or whatever they're on right now.

DLexEdition said:

Is Windows 11 really all that good... Eh? Well.. If you want Microsoft to spy on you even more, then yes, go right ahead and install it.

Click to expand...

In other words, tin-hatters need not apply.

If one has to buy a TPM module, I certainly concur with hsehestedt on what to look for. That said....

hsehestedt said:

If anyone has any more info people should be aware of, please add on to this thread.

Click to expand...

Pretty much every desktop motherboard (all mine do) has a TPM header thus giving you the option to use a discrete dedicated module, or use of FTPM (if available). Its also compatible with Windows 11 (and 10).

Discrete, Integrated, or Firmware TPM?

There are three implementation options for TPMs:

• Discrete TPM chip as a separate component in its own semiconductor package
• Integrated TPM solution, using dedicated hardware integrated into one or more semiconductor packages alongside, but logically separate from, other components
• Firmware TPM solution, running the TPM in firmware in a Trusted Execution mode of a general purpose computation unit

Windows uses any compatible TPM in the same way. Microsoft does not take a position on which way a TPM should be implemented and there is a wide ecosystem of available TPM solutions, which should suit all needs.

Click to expand...

Source: TPM recommendations (Windows) - Windows security

This might also be helpful to others - You shouldn’t buy a TPM for Windows 11. Here’s why. I also posted this awhile back with a video - What is TPM/Firmware TPM (fTPM) and do I have it?

At the end of the day, pretty much any motherboard manufactured after 2017 (2016) should have a firmware TPM (PTT for Intel) setting in the UEFI BIOS. Your owner's manual should tell you how to enable it. BIOS updates may turn it on by default (usually off by default).

Also, unless you have higher security needs where a "discrete" module is required (you would know this already), firmware TPM works just fine for Windows 11, and doesn't require the headache of searching for and buying a "compatible" module for the board.

In short, firmware TPM is cheap, easy, and compatible with 11

My two cents

FWIW: My motherboard (MSI) tends to have rather frequent updates for the UEFI firmware. It shouldn't matter, but it does - because every time I've updated the fw the TPM info gets bogged stupid, and my logins have to be reset - which is great and all for home accounts.

But when you have a work account also on there, it takes some serious finagling to get it to work correctly - I typically have to remove all my accounts, then 'change' my PIN (setting it up as the same PIN again) and then re-add all my accounts. Even tried just removing the work account, but nope, it gets stupid quick.

So I found the appropriate TPM module for my mobo from MSI, bought it, and have survived 1 full UEFI fw update intact. While not necessary for most people, the majority of my fw updates include an update to a newer AMD Combo PI V1 v1.2.0.5, and more than once have been fixes for the onboard RAID I'm using too, so I kinda needed them. Granted, a lot of those were also βeta updates, but the last one I updated also specifically mentions "Support Windows 11", so it may have simply been a case of the previous fw not having supported it fully, and thus were my issues.

Nevertheless, I've got the hardware module in there now.

John, I've seen others comment about the same exact thing that you experienced. That's exactly why I opted for a hardware TPM as well. I got lucky and got mine before the first leaked builds of Win 11 so at the time they were cheap. I think I paid $9 for mine :)