Update on Windows 11 minimum system requirements

Dru2 · Aug 6, 2021

barman58 said:
I look at it slightly differently the hardware is Insured for replacement in kind and as new, the data, which is the important thing, is kept backed up off the computer. My data relating to finance and related is kept at the Bank so my data is valuable to me but not likely to others. We see a lot of post discussing Hacking of user information, but to be the victim of this type of theft the user has to have something worth the hacker stealing, not a lot of private users have enough to make it worthwhile compared to businesses

In saying all this my home is locked alarmed and monitored by cameras 24/7/365 anyway

To each his own, but I can tell you from experience if a thief wants in they'll get in. As one who's been burglarized, it's not a good feeling. And yes, stuff can be replaced, but having your sensitive data out in the wild is far more costly than replacing any PC :scream:

At the end of the day we use the tools that best suits our needs or comforts. I'm simply stating my experience with BitLocker and how it relates to clearing/resetting the BIOS or moving a drive.

YMMV :)

johnlgalt · Aug 6, 2021

My point is that the backups allow me to get the old data on a new machine.

But lack of encryption allows anyone with the machine to also get access to my data. That's where I draw the line.

johnlgalt · Aug 6, 2021

Anibor_11 said:
I have never seen a reason to encrypt the OS. I keep the data separated from the OS, and only part of the data is "sensitive" information. This I keep encrypted in VeraCrypt containers, of which I keep several backups. As for passwords, I use a password manager, I only remember three or four passwords. After doing this for years, I have found no problems.
No TPMs, no papers, no "BIOS" passwords. And I con mount the VeraCrypt containers in any computer.

That's a good point. Not everything needs encrypting, and I move my \Users tree to a separate physical drive anyway.

As for PW mgrs, I've used a couple - started with Moon Software's PWAgent over 20 years ago, then graduated to KeePass v2, and most recently upgraded from KPv2 to KeePassXC. It's where my keys live - software installation keys as well as encryption keys. And copies of public keys, license installers, 2FA authetication keys and TOTP keys for TOTP generator ... basically anything I need to start fresh on a new system.

Great points that you made.

barman58 · Aug 6, 2021

I suppose you can never have two much security ...

Here's my Last line of defence

Winuser · Aug 6, 2021

Dru2 said:
I know you didn't mention BitLocker, but...

When you say you had reason to clear the BIOS, which also cleared the on chip and discrete TPM, did that include BitLocker?

I ask because it's been my experience as a BitLocker user that clearing the BIOS results in my having to re-input my BitLocker key to access my BitLockered drive. That even moving the drive to another machine will still require a BL key to unlock it. This says there is also coding on the drive.

Point is, for a BitLocker (encrypted) drive per my experience does auto decrypt an encrypted drive during a BIOS reset or even clearing the CMOS (also includes BIOS updates).

Unfortunately, one of my experiences was the fact that I lost a BitLocker key for one of my drives; resetting/clearing the BIOS, and even moving the drive to another machine did NOT allow me to unlock the drive without a key. In the end I had to reformat the drive, thus loosing all the data on it in order to use the drive again. And be aware Microsoft will be of no help in thwarting their security measures for someone who lost a key

I know very little about TPM. The only time I had any personal experience with TPMs is when my Acer laptop wouldn't always recognize my pin number to sign in to Windows and I would have to use my password. A reset in the BIOS fixed it. If I don't use Bitlocker is the TPM doing anything extra to protect my computers other than allowing me to use a pin number?

Winuser · Aug 6, 2021

Josey Wales said:
I rode a Kawasaki 550 LTD for 5 years in Arizona, I would have gotten a Harley but they were owned by AMF at the time. Never had a Problem with the 550.

My first street legal bike and the one that I used to get my license was a 1976 Suzuki GT 250. It was a 2 stroke motor and for its size would kick butt with me and my girlfriend (now my wife) riding together on it. My second street legal bike was a 1980 Kawasaki KZ 440. IMHO, Starting with AMF taking ownership the Harley has never been the same. They have been up and down with the quality. I did still want one though. I have also read that they can't truly say they are a American bike anymore. They are only assembled in the USA. A lot of their parts come from Japan and other places. If this is true a Harley lover can't laugh and call our bikes Rice Burners because they are using shall we say parts made from rice.

. I know this is off topic so any more motorcycle talk will be in the chillout Room.

Dru2 · Aug 6, 2021

johnlgalt said:
My point is that the backups allow me to get the old data on a new machine.

But lack of encryption allows anyone with the machine to also get access to my data. That's where I draw the line.

Honestly all but the fool hearted don't know about backups. Yes, I have backups, but I hardly see what that has to do with drive encryption. I can have 10,000 backups, but if the data isn't secured a vulnerability still exists. Two different animals.

But, again, I was simply explaining how things work with regards to BitLocker and BIOS updates/resets.... not trying to convince some they need BitLocker. That's a personal choice.

Anyway, I think some are just being contrarians and confusing backups with drive encryption. And yes, NOT everything needs encrypting. Out of the 5 drives in my system only two are encrypted. There's also a small performance hit so that's something else to be aware of.

Peace

Dru2 · Aug 6, 2021

Winuser said:
I know very little about TPM. The only time I had any personal experience with TPMs is when my Acer laptop wouldn't always recognize my pin number to sign in to Windows and I would have to use my password. A reset in the BIOS fixed it. If I don't use Bitlocker is the TPM doing anything extra to protect my computers other than allowing me to use a pin number?

For the record, I think people need to understand you do NOT need TPM to use BitLocker. That's the other thing that confuses the topic of BitLocker - How to Use BitLocker Without a Trusted Platform Module (TPM)

Also stated in Microsoft's FAQ on BitLocker - BitLocker overview and requirements FAQ (Windows 10) - Microsoft 365 Security.

Can I use BitLocker on an operating system drive without a TPM?

Yes, you can enable BitLocker on an operating system drive without a TPM version 1.2 or higher, if the BIOS or UEFI firmware has the ability to read from a USB flash drive in the boot environment. This is because BitLocker will not unlock the protected drive until BitLocker's own volume master key is first released by either the computer's TPM or by a USB flash drive containing the BitLocker startup key for that computer. However, computers without TPMs will not be able to use the system integrity verification that BitLocker can also provide. To help determine whether a computer can read from a USB device during the boot process, use the BitLocker system check as part of the BitLocker setup process. This system check performs tests to confirm that the computer can properly read from the USB devices at the appropriate time and that the computer meets other BitLocker requirements.

badrobot · Aug 7, 2021

Before Windows 11, a lot of us didn't even know what TPM is and what it does. Just pretend this never happened... :)

Dru2 · Aug 7, 2021

badrobot said:
Before Windows 11, a lot of us didn't even know what TPM is and what it does. Just pretend this never happened... :)

Agree... :)

But I heard of TPM some years ago and even bought a module for my Z87 Gigabyte G1 Sniper 5 motherboard...

That said, I no longer use it since learning of firmware TPM (PTT) shortly after. In fact I don't even have it installed in any of my systems. I also found it made my systems sluggish when installed. That's also mentioned as a drawback when compared to firmware TPM (PTT).

PerpetualCycle · Aug 7, 2021

johnlgalt said:
My point is that the backups allow me to get the old data on a new machine.

But lack of encryption allows anyone with the machine to also get access to my data. That's where I draw the line.

All they have to do is crack your login password, right? Coming from a Macbook laptop (I am sure slim Windows ones do this as well), the SSD drive is not removable - its chips are integrated on the board. So they can't take the drive out and access it, which means, in this case, the encryption doesn't buy any protection more protection than your login password.

I encrypt sensitive data in on removable drives on my desktop,

barman58 · Aug 8, 2021

You just got me thinking about the repair / upgrade status of my laptop [Dell XPS17 9700] and it's not like you describe Macbooks but has multiple M2 sockets for drives, replaceable memory modules, a removable Battery and a discrete Graphics card.

Unfortunately I believe a lot of Apples design decisions are driven by a desire to drive sales of new hardware rather than upgrades, which in the computer industry is normally an excellent income stream :wink:

sgage · Aug 8, 2021

Has anyone seen any news as to whether MS is going to lower the CPU requirement for Win11 to Intel Gen 7 (or Ryzen 1)?

Winuser · Aug 8, 2021

badrobot said:
Before Windows 11, a lot of us didn't even know what TPM is and what it does. Just pretend this never happened... :)

I heard of TPM years ago I just never gave it any thought. As I posted my only personal experience with TPM was when my laptop would occasionally not recognize my pin number and I would have to use my password.

galileo · Aug 8, 2021

sgage said:
Has anyone seen any news as to whether MS is going to lower the CPU requirement for Win11 to Intel Gen 7 (or Ryzen 1)?

+1 Same question here...

tinmar49 · Aug 8, 2021

To get the W11 from Microsoft via the insider program, I enabled eTPM in the bios and setup bit locker drive encryption and secure boot. The drive encription key is in my Misrosoft account if I need to retrieve it. I now have to put in 2 passwords before getting to desktop and the pin number. It is not too much of a chore and as W11 starts faster, the total elapsed time it much the same.
I find it hard to believe that my lowly Athlon 3000G is approved while certain other AMD AM4 fitting processors are not.

badrobot · Aug 8, 2021

tinmar49 said:
To get the W11 from Microsoft via the insider program, I enabled eTPM in the bios and setup bit locker drive encryption and secure boot. The drive encription key is in my Misrosoft account if I need to retrieve it. I now have to put in 2 passwords before getting to desktop and the pin number. It is not too much of a chore and as W11 starts faster, the total elapsed time it much the same.
I find it hard to believe that my lowly Athlon 3000G is approved while certain other AMD AM4 fitting processors are not.

you meant fTPM?

tinmar49 · Aug 8, 2021

Right you are, badrobot, I couldn't remember the name in the bios.

badrobot · Aug 8, 2021

tinmar49 said:
Right you are, badrobot, I couldn't remember the name in the bios.

fTPM and PTT are causing enough confusion... we don't need another one... haha... :)

SuperConker · Aug 8, 2021

sgage said:
Has anyone seen any news as to whether MS is going to lower the CPU requirement for Win11 to Intel Gen 7 (or Ryzen 1)?

That is going to be a big fat no... Microsoft don't really care if those CPU's are compatible as you can see here:

Microsoft is ignoring your complaints as its readies Windows 11 - Gamers Grade

Microsoft is sticking to its guns with the minimum requirements. Following the announcement of Windows 11 earlier this summer, which will replace Windows 10 as the flagship operating system from the company this autumn, Microsoft revealed the specifications required to run the new software on...

gamersgrade.com