Update on Windows 11 minimum system requirements

Bree · Jul 10, 2021

tinmar49 said:
My laptop has the TPM embedded in the motherboard, but only has a gen 6 Intel processor,should I try updating to W11? The pc which I use daily is AMD which seems to have left out of this discussion

For Intel, the processor requirement is 8th gen or newer, having said that the current Insider ISO will accept two of my machines with 6th or 4th gen processors for an in-place upgrade, but they do meet the secure boot/TPM requirements. But that may change come the official release, they may no longer qualify.

There are similar requirement for AMD processors, the list is here:

Windows processor requirements Windows 11 supported AMD processors

This specification details the AMD processors that can be used with Windows 11 customer systems that include Windows products, including custom images.

docs.microsoft.com

tinmar49 · Jul 11, 2021

Thanks, Bree, my lowly Athlon 3000G is on the supported list, so the only thing missing from my most used pc is the TPM module and getting a 17 pin Asrock one will take some time.

Quexos · Jul 11, 2021

tinmar49 said:
...the only thing missing from my most used pc is the TPM module and getting a 17 pin Asrock one will take some time.

Not sure what mainboard you have, but wouldn't you most likely have TPM already via a BIOS setting? My Asrock B450 based board (with Ryzen5 2600) does. It's called fTPM in the BIOS and once enabled and rebooted, a "Security Device" toggle becomes available under "Trusted Computing" section. Both must be enabled. Definitely check that before getting gouged/scalped on a discrete TPM module!

tinmar49 · Jul 11, 2021

The motherboard is an Asrock A320M-HDV rev4, there is a socket for one of their 17 pin TPM2-S V2.0 modules, its getting hold of a module that is difficult, if not impossible at the moment. Because of this Microsoft is taking it off the slow lane and moving it to the release preview channel.

Ghot · Jul 11, 2021

tinmar49 said:
The motherboard is an Asrock A320M-HDV rev4, there is a socket for one of their 17 pin TPM2-S V2.0 modules, its getting hold of a module that is difficult, if not impossible at the moment. Because of this Microsoft is taking it off the slow lane and moving it to the release preview channel.

On the Advanced tab > CPU Configuration, you have fTPM (firmware TPM).
All you have to do is enable it. :)

You don't NEED to buy a TPM module.

Now this is for the TPM Module. You don't need both.

Ghot · Jul 11, 2021

See... this is my BIOS. My motherboard doesn't even have a TPM connector...

And, as you can see, I passed the requirement...

So all you have to do is enable AMD CPU fTPM in your BIOS and then run this tool to see if you're all set...

GitHub Tool...

Lots more info, here: How to pass the Windows 11 Compatibility Checks

tinmar49 · Jul 11, 2021

I have found and enabled the fTPM and will see if Microsoft change their mind about my getting W11 with the slow lane. There seem to be conflicting reports about the suitability of the Athlon 3000G for W11.

bobkn · Jul 11, 2021

tinmar49 said:
I have found and enabled the fTPM and will see if Microsoft change their mind about my getting W11 with the slow lane. There seem to be conflicting reports about the suitability of the Athlon 3000G for W11.

It's on the supported CPU list. AMD CPUs. This is an official Microsoft link.

jen1 · Jul 12, 2021

If anyone with 6th gen CPU can share his/her speculation control settings, I just wanna check something please.

Here is mine for the 7th gen CPU.

Code:

For more information about the output below, please refer to https://support.microsoft.com/help/4074629

Speculation control settings for CVE-2017-5715 [branch target injection]

Hardware support for branch target injection mitigation is present: True
Windows OS support for branch target injection mitigation is present: True
Windows OS support for branch target injection mitigation is enabled: True

Speculation control settings for CVE-2017-5754 [rogue data cache load]

Hardware requires kernel VA shadowing: True
Windows OS support for kernel VA shadow is present: True
Windows OS support for kernel VA shadow is enabled: True
Windows OS support for PCID performance optimization is enabled: True [not required for security]

Speculation control settings for CVE-2018-3639 [speculative store bypass]

Hardware is vulnerable to speculative store bypass: True
Hardware support for speculative store bypass disable is present: True
Windows OS support for speculative store bypass disable is present: True
Windows OS support for speculative store bypass disable is enabled system-wide: True

Speculation control settings for CVE-2018-3620 [L1 terminal fault]

Hardware is vulnerable to L1 terminal fault: True
Windows OS support for L1 terminal fault mitigation is present: True
Windows OS support for L1 terminal fault mitigation is enabled: True

Speculation control settings for MDS [microarchitectural data sampling]

Windows OS support for MDS mitigation is present: True
Hardware is vulnerable to MDS: True
Windows OS support for MDS mitigation is enabled: True


BTIHardwarePresent                  : True
BTIWindowsSupportPresent            : True
BTIWindowsSupportEnabled            : True
BTIDisabledBySystemPolicy           : False
BTIDisabledByNoHardwareSupport      : False
BTIKernelRetpolineEnabled           : False
BTIKernelImportOptimizationEnabled  : True
KVAShadowRequired                   : True
KVAShadowWindowsSupportPresent      : True
KVAShadowWindowsSupportEnabled      : True
KVAShadowPcidEnabled                : True
SSBDWindowsSupportPresent           : True
SSBDHardwareVulnerable              : True
SSBDHardwarePresent                 : True
SSBDWindowsSupportEnabledSystemWide : True
L1TFHardwareVulnerable              : True
L1TFWindowsSupportPresent           : True
L1TFWindowsSupportEnabled           : True
L1TFInvalidPteBit                   : 45
L1DFlushSupported                   : True
MDSWindowsSupportPresent            : True
MDSHardwareVulnerable               : True
MDSWindowsSupportEnabled            : True

jimbo45 · Jul 12, 2021

Hi there
I've posted this before with ZERO answers so far.

Can any Windows GURU tell me what exactly is the TPM module doing currently and what do you as a user have to do if you are installing W11 and enable secure boot -- what keys are generated - what goes into the BIOS etc etc.

I've generated a TPM key as an experiment but I can't find any info on what to do next.

While I can understand Ms have relaxed the requirements (albeit possibly temporarily) to relax the requirements -- surely some of us that have the full hardware should be able to test exactly what Ms wants to do with the TPM / Secure boot thing --otherwise its just vapourware and panacking a load of people into unnecessary expense.

Cheers
jimbo

CountMike · Jul 12, 2021

jimbo45 said:
Hi there
I've posted this before with ZERO answers so far.

Can any Windows GURU tell me what exactly is the TPM module doing currently and what do you as a user have to do if you are installing W11 and enable secure boot -- what keys are generated - what goes into the BIOS etc etc.

I've generated a TPM key as an experiment but I can't find any info on what to do next.

While I can understand Ms have relaxed the requirements (albeit possibly temporarily) to relax the requirements -- surely some of us that have the full hardware should be able to test exactly what Ms wants to do with the TPM / Secure boot thing --otherwise its just vapourware and panacking a load of people into unnecessary expense.

Cheers
jimbo

Now you can encrypt disk.

badrobot · Jul 12, 2021

TPM implementation is probably purely for Microsoft's benefit in terms of enforcement of licenses and digital rights management.
But it can also benefit the users through BIOS level control of operation that no one else can perform if you have no physical control of the hardware. But regular users don't even care about it. Haha...

jimbo45 · Jul 12, 2021

badrobot said:
TPM implementation is probably purely for Microsoft's benefit in terms of enforcement of licenses and digital rights management.
But it can also benefit the users through BIOS level control of operation that no one else can perform if you have no physical control of the hardware. But regular users don't even care about it. Haha...

Hi there
I think we all can understand this and I can read "Ad Nauseam" the idea behind TPM etc -- BUT WHAT CAN WE DO TO TEST IT !!!! Nobody has answered my basic question -- we all can read the Ms Spiel of "Enhanced Security" etc etc - and I have no reason to disbelieve them but what do I actually do to test this -- as I assume a lot will be installing W11 on their own systems - not everybody buys or will buy a "pre-installed W11 system on a new PC".

Cheers
jimbo

f14tomcat · Jul 12, 2021

Just a thought.....

The TPM and Secure Boot, and enhanced security (I'm assuming that includes the higher level CPUs for the instruction sets), may from MS's point of view be a growing concern and impending requirement on their part to qualify for GSA certification on contracts, and be compliant with the increasingly stringent requirements of the general corporate environment. Utilities, State and local Governments, and many other corporate users will be demanding security unheard of 6 years ago with Win 10's birth.

Perhaps all the reasons have not come out yet and some may not.

badrobot · Jul 12, 2021

jimbo45 said:
Hi there
I think we all can understand this and I can read "Ad Nauseam" the idea behind TPM etc -- BUT WHAT CAN WE DO TO TEST IT !!!! Nobody has answered my basic question -- we all can read the Ms Spiel of "Enhanced Security" etc etc - and I have no reason to disbelieve them but what do I actually do to test this -- as I assume a lot will be installing W11 on their own systems - not everybody buys or will buy a "pre-installed W11 system on a new PC".

Cheers
jimbo

Unless maybe if you are a hacker or know anything about hacking through firmware, maybe you can test it. A TPM module will act like a base layer of hardware protection much like what Windows Defender does as a software protection.

CountMike · Jul 13, 2021

To test one of TPM aspects.
Encrypt a disk with BitLocker, turn TPM off and see if you can access it.

jimbo45 · Jul 13, 2021

CountMike said:
To test one of TPM aspects.
Encrypt a disk with BitLocker, turn TPM off and see if you can access it.

Hi there

@CountMike - doesn't Bitlocker work even if you don't have a TPM.

But as a Home user I for one don't want to encrypt my disks --it's far too much hassle especially if these are moved /shared between machines with different OS'es on them -- if I've got really secure data I either won't have it online line or will store it with a reliable Cloud service who will do all the relevant data security required. The only security I really use as far as encryption is concerned is network transmission via sftp so data is transferred encrypted rather than "in the clear" e.g when entering passwords / account numbers for accessing e-commerce sites such as amazon or e-banking.

If people want to use things like Bitlocker -- that's fine but I really am as far as ordinary people are concerned in the K.I.S.S camp - the simpler the better commensurate of course with reasonable protection.

I'm far more worried about "Identity theft" and lack of decent security by some big banks than by any amount of hackers.

I'm sure even the most devoted hacker would get bored reading any of my emails -- even if they could understand the lingo -- not sure if Icelandic would be taught in N.Korea educational institutions !!! - although given the quite large number of "Dark server Farms" in Iceland currently (very cheap energy) they might get a buzz at trying to hack some of that infrastructure !!!

Cheers
jimbo

CountMike · Jul 13, 2021

jimbo45 said:
Hi there
as a Home user I for one don't want to encrypt my disks much too much hassle especially if these are moved between machines with different OS'es on them -- if I've got really secure data I either won't have it oin line or will store it with a reliable Cloud service who will do all the relevant data security required. The only security I really use as far as encryption is concerned is network transmission via sftp so data is transferred encrypted rather than "in the clear"..

If people want to use things like Bitlocker -- that's fine but I really am as far as ordinary people are concerned in the K.I.S.S camp - the simpler the better commensurate of course with reasonable protection.

I'm far more worried about "Identity theft" and lack of decent seciurity by some big banks than by any amount of hackers.

I'm sure even the most devoted hacker would get bored reading any of my emails -- even if they could understand the lingo -- not sure if Icelandic would be taught in N.Korea educational institutions !!! - although given the quite large number of "Dark server Farms" in Iceland currently (very cheap energy) they might get a buzz at trying to hack some of that infrastructure !!!

Cheers
jimbo

It was just a suggestion for testing. As far as the rest, only you can protect yourself by being smart.

jimbo45 · Jul 13, 2021

CountMike said:
It was just a suggestion for testing. As far as the rest, only you can protect yourself by being smart.

Hi there

@CountMike

interesting to try this but I'm sure Bitlocker has been around for "Donkeys years - I remember in a workplace running W7 years ago that all external things like USB sticks were "bit locked / encrypted" so could only be used on work supplied laptops and I'm sure those didn't have TPM in them. Could be wrong of course !!

quote from Ms docs :

Can I use BitLocker on an operating system drive without a TPM?

Yes, you can enable BitLocker on an operating system drive without a TPM version 1.2 or higher, if the BIOS or UEFI firmware has the ability to read from a USB flash drive in the boot environment. This is because BitLocker will not unlock the protected drive until BitLocker's own volume master key is first released by either the computer's TPM or by a USB flash drive containing the BitLocker startup key for that computer. However, computers without TPMs will not be able to use the system integrity verification that BitLocker can also provide. To help determine whether a computer can read from a USB device during the boot process, use the BitLocker system check as part of the BitLocker setup process. This system check performs tests to confirm that the computer can properly read from the USB devices at the appropriate time and that the computer meets other BitLocker requirements.

Cheers
jimbo

sgage · Jul 13, 2021

I installed Win11 on this machine with TPM 2.0 and SB enabled without any problem even though it has only 7th gen intel CPU. Out of idle curiousity, I booted with TPM disabled, and it got as far as asking for the PIN, but said "something happened and we can't find your PIN, click here to fix it". I clicked, there were a few seconds of black screen, and it came back to that message.

Rebooted with TPM enabled, and it all worked fine again. Interestingly, It booted fine with SB disabled.