If you are going shopping for a TPM 2.0 module, here are some things to know

johnlgalt · Feb 8, 2022

I paid about twice that - but certainly not the $34 USD (!) that MSI was asking lol.

Dru2 · Feb 8, 2022

johnlgalt said:
FWIW: My motherboard (MSI) tends to have rather frequent updates for the UEFI firmware. It shouldn't matter, but it does - because every time I've updated the fw the TPM info gets bogged stupid, and my logins have to be reset - which is great and all for home accounts.

Nevertheless, I've got the hardware module in there now.

To each his own, but I only had one BIOS update on my main system that caused "pin issues". And I'm not so sure it was entirely the update's fault. My laptop gets updates direct from Lenovo and that has never messed with my log in credentials. Currently using fingerprint & pin & on laptop; facial & Pin on desktop.

At anyway, we do whatever comforts our fears and/or doubts :)

johnlgalt · Feb 8, 2022

And we also do what we need to to fix our issues. If you are unable to log in because "Your PIN is no longer valid" I'm pretty sure that that is not a fear, not a doubt. That is a cold hard fact.

I've had this system since July 2020, and it happened on every single UEFI fw update since I started testing Win11 back in June of 2021. Until this latest fw update literally a month ago, 5 Jan 2022.

Dru2 · Feb 8, 2022

johnlgalt said:
If you are unable to log in because "Your PIN is no longer valid" I'm pretty sure that that is not a fear, not a doubt. That is a cold hard fact.

I've had this system since July 2020, and it happened on every single UEFI fw update since I started testing Win11 back in June of 2021. Until this latest fw update literally a month ago, 5 Jan 2022.

As I opinioned in my thread post, I'm not sure my issue was specifically attributed to updating my BIOS. I think "my" issue was more to do with my school's Office 365 account (but yes, the BIOS update may have also "contributed").

Anyway, I did buy a Gigabyte TPM module back in 2017, but no longer use it as I found it unnecessary and also found it impacted my system performance. Since than it's been sitting in a box collecting dust :wink:

But even in agreeing this may be an issue, since I don't update my BIOS every day, even if I'm required to reset a pin, it's a simple less than a second job. And you don't even have to change it, just re-register the same one. Been there, done that :)

BTW, this is the thread on my Pin issue experience - Windows Hello pin issue?

Regardless, I'm just pointing out there are other choices, and neither guarantees an issue free experience (for everyone).

Comport Colin · Feb 11, 2022

This thread is long and no, I haven't read all comments... still it needs to be acknowledged:
ALL COMPUTERS that come with a Win11-compatible CPU will have an fTPM in their UEFI firmware.
I know just one excepton: some Intel NUC models, which are so bare-bones, they lack an fTPM (but have a compatible CPU and a TPM-header on the board). Normal boards: all have fTPM, so these worries are moot in my opinion.

I administer bitlocker in our company for 15 years, so I know a thing or 2 about TPMs, believe me. We run a lot of different mainboards and any of them, built 2015 or newer (as in "compatible and designed for Win10") have an fTPM - all of them, ASUS, ASROCK,...

hsehestedt · Feb 11, 2022

Comport Colin said:
This thread is long and no, I haven't read all comments... still it needs to be acknowledged:
ALL COMPUTERS that come with a Win11-compatible CPU will have an fTPM in their UEFI firmware.
I know just one excepton: some Intel NUC models, which are so bare-bones, they lack an fTPM (but have a compatible CPU and a TPM-header on the board). Normal boards: all have fTPM, so these worries are moot in my opinion.

I administer bitlocker in our company for 15 years, so I know a thing or 2 about TPMs, believe me. We run a lot of different mainboards and any of them, built 2015 or newer (as in "compatible and designed for Win10") have an fTPM - all of them, ASUS, ASROCK,...

Some people simply prefer a physical hardware TPM rather than the firmware implementation.

Comport Colin · Feb 11, 2022

hsehestedt said:
Some people simply prefer a physical hardware TPM rather than the firmware implementation.

Yes, because they read somewhere that the physical one can be trusted while, who knows, the one on that mainboard with its dubios intel management engine and stuff like that, who knows... No, I don't see a reason to prefer a physical module unless you have deep knowledge of the subject.

hsehestedt · Feb 11, 2022

There are a lot of people on this forum who do have deep knowledge of this topic

.

Dru2 · Feb 11, 2022

Comport Colin said:
Yes, because they read somewhere that the physical one can be trusted while, who knows, the one on that mainboard with its dubios intel management engine and stuff like that, who knows... No, I don't see a reason to prefer a physical module unless you have deep knowledge of the subject.

While physical (discrete) TPM chips are more secure than firmware TPM, not everyone needs (requires) for Windows 11's requirements.

If you understand TPM and why a discrete option would be better for you, that's one thing. If you're simply trying to satisfy Windows 11, that's another. If this is your first foray into TPM, and you have no other needs other than 11, firmware is just as good as discrete.

As far as "dubious" Intel Management Engine and TPM is concerned, a bit of reading and research will reveal to you one has nothing to do with the other :wink:

But yes, there's no reason to buy a discrete TPM module to satisfy Windows 11's requirement if you already have fTPM :)

Comport Colin · Feb 12, 2022

Dru2 said:
As far as "dubious" Intel Management Engine and TPM is concerned, a bit of reading and research will reveal to you one has nothing to do with the other

Don't really understand why you say so. Intel PTT (Intel's ftpm implementation) runs on Intel ME. So him who distrusts ME will very likely distrust Intel's ftpm, too. But anyway, I was adding my comments only to make sure readers understand they don't have to buy a discrete TPM since they already have one in firmware if they run a win11-supported CPU.

ThrashZone · Feb 12, 2022

Hi,
I wouldn't trust either one frankly besides it's my hardware not microsoft's

Besides this is unnecessary unless you use encryption or silly enough to use a ms account so just use a flash drive for encryption like people have been doing for years in the past.

johnlgalt · Feb 12, 2022

Dru2 said:
As I opinioned in my thread post, I'm not sure my issue was specifically attributed to updating my BIOS. I think "my" issue was more to do with my school's Office 365 account (but yes, the BIOS update may have also "contributed").

Anyway, I did buy a Gigabyte TPM module back in 2017, but no longer use it as I found it unnecessary and also found it impacted my system performance. Since than it's been sitting in a box collecting dust

View attachment 21224

But even in agreeing this may be an issue, since I don't update my BIOS every day, even if I'm required to reset a pin, it's a simple less than a second job. And you don't even have to change it, just re-register the same one. Been there, done that :)

BTW, this is the thread on my Pin issue experience - Windows Hello pin issue?

Regardless, I'm just pointing out there are other choices, and neither guarantees an issue free experience (for everyone).

For that matter, not much of anything guarantees an issue.

But stating that "we do whatever comforts our fears and/or doubts" is something you can keep to yourself. I've been troubleshooting hardware for long enough that I know that I don't just rule something out without proper testing.

I also very specifically said All of the following in my previous post:

johnlgalt said:
FWIW: My motherboard (MSI) tends to have rather frequent updates for the UEFI firmware. It shouldn't matter, but it does - because every time I've updated the fw the TPM info gets bogged stupid, and my logins have to be reset - which is great and all for home accounts.

I acknowledged that colloquial wisdom said it should not matter - and yet it happened to me. Every. Single. Time.

johnlgalt said:
But when you have a work account also on there, it takes some serious finagling to get it to work correctly - I typically have to remove all my accounts, then 'change' my PIN (setting it up as the same PIN again) and then re-add all my accounts. Even tried just removing the work account, but nope, it gets stupid quick.

And I've got to keep my machine running - so that means not spending an part of a day fixing it when it goes stupid on me. Buty I also need these BIOS updates because of the devices that I'm working with for my company. Rock and a hard place.

johnlgalt said:
So I found the appropriate TPM module for my mobo from MSI, bought it, and have survived 1 full UEFI fw update intact. While not necessary for most people, the majority of my fw updates include an update to a newer AMD Combo PI V1 v1.2.0.5, and more than once have been fixes for the onboard RAID I'm using too, so I kinda needed them. Granted, a lot of those were also βeta updates, but the last one I updated also specifically mentions "Support Windows 11", so it may have simply been a case of the previous fw not having supported it fully, and thus were my issues.

Nevertheless, I've got the hardware module in there now.

I specifically say 1) While not necessary for most, and 2) I also specifically point out that the last UEFI fw update has Windows 11 support mentioned, while none of the previous ones did.

So, in the end, it's me testing out what I want to to figure out the best option for me. At no point anywhere in this there did I say you should do it, you need to do it, or anything like that - and I never do. neither do I make snide remarks about fear and doubts - I just get in there and test and figure out what works.

Dru2 · Feb 12, 2022

johnlgalt said:
But stating that "we do whatever comforts our fears and/or doubts" is something you can keep to yourself. I've been troubleshooting hardware for long enough that I know that I don't just rule something out without proper testing.

@johnlgalt, if I offended you, I apologize. I was simply replying to a post, not make anything personal. In trying not to make anything personal I try to stick with the "generally speaking" tone and often include myself :)

And I also understand there's a lot we agree on and there are various shades of grey :)

Peace

wordsworth · Feb 12, 2022

Comport Colin said:
This thread is long and no, I haven't read all comments... still it needs to be acknowledged:
ALL COMPUTERS that come with a Win11-compatible CPU will have an fTPM in their UEFI firmware.
I know just one excepton: some Intel NUC models, which are so bare-bones, they lack an fTPM (but have a compatible CPU and a TPM-header on the board). Normal boards: all have fTPM, so these worries are moot in my opinion.

I administer bitlocker in our company for 15 years, so I know a thing or 2 about TPMs, believe me. We run a lot of different mainboards and any of them, built 2015 or newer (as in "compatible and designed for Win10") have an fTPM - all of them, ASUS, ASROCK,...

Motherboards that have a Win11 compatible CPU will have fTPM in their UEFI firmware; but not all motherboards "built 2015 or newer (as in "compatible and designed for Win10") have an fTPM "available" in the firmware as there are some exceptions, or at least one Asus exception. My incompatible machine built on an Asus Z-170 Pro (Pro, not Pro Gaming) motherboard released in September of 2015 did not have fTPM "available" (caveat to follow) in firmware. It is one of the motherboards that Asus never updated the firmware which would enable the fTPM, the last firmware being released for this board being in April 2018. The caveat is that upon purchasing and installing a TPM 2.0 module for this machine a new menu option appeared in the BIOS called Trusted Computing and a sub menu of Advanced Trusted Computing to enable it. These had to be present in the BIOS prior but hidden and not available without either installing a hardware module, or if Asus had updated the firmware which they should have done but never have.

Anyway, this is just to say that exceptions exist.

ThrashZone · Feb 12, 2022

Hi,
Firmware tpm is a can or worms as already pointed out flashing bios which so many recommend to fix other issues.
Finding a tpm module is a little easier "If" board manufacture offer one usually they do not even if the board has a port for one.
Some newer boards don't even have a tpm port z490 for one that I've not seen one on my apex.

wordsworth · Feb 12, 2022

I know some have had problems with their TPM PIN after flashing the BIOS but for myself I would rather have updated the BIOS on this machine and then enabled fTPM in the BIOS than go through ordering the module and then installing it, the latter being just a little less convenient not that it was all that difficult.

Steve C · Feb 18, 2022

DLexEdition said:
Scroll down the page, you can get them from Gigabyte on their Amazon pages across the world. They do have the 20 pin TPM 2.0 upgrade module to take the place of the 1.2.

No thanks at the price and UK delivery charge!

ThrashZone · Feb 18, 2022

Stigg said:
My GIGABYTE X299X DESIGNARE 10G requires a GC-TPM2.0_S TPM Module only.
View attachment 21017
A few months ago, I went looking for one and couldn't find one anywhere.
I finally emailed GIGABYTE Support, and they replied that they were no longer available.

Are you saying that they're available now?

Edit: I have just gone looking again, and it appears that they may now be available.

Hi,
Surprised giga responded at all
Since their exploding psu issues they've been pretty silent support wise lol

johnlgalt · Feb 22, 2022

Dru2 said:
@johnlgalt, if I offended you, I apologize. I was simply replying to a post, not make anything personal. In trying not to make anything personal I try to stick with the "generally speaking" tone and often include myself :)

And I also understand there's a lot we agree on and there are various shades of grey :)

Peace

Then I apologize for taking it the wrong way. Truly sorry about that. I should know better.

tinmar49 · Mar 14, 2022

I have 4 pc's running W11 pro and all are set for fTPM, Since checking the availability and prices of TPM modules, I decided to get one for my beta machine which gets 90% of the use online. The motherboard is an Asrock A320M-HDV r4.0 and the pinout is shown in the manual. I have ordered a TPM module for it for £11 which is a fair price. The vendor shows the pinout in the advert which is identical 18-1 and also what the pins are for. Before I fit it, I will turn off the fTPM as advised in this thread and post the results.
My other pc's have a Gigabyte and two MSI boards which, at least for now, will use the firmware TPM