Solved Why do new motherboards have TPM headers?

barman58 · Jul 27, 2021

The way that I look at it it makes sense to cater for future updates, with TPM finally making it as a requirement for Windows, it's quite likely that the developers will be working on TPM 2.1 or 2.5 or whatever,

the MB header allows the user or system builder to update the security without replacing the board

Superfly · Jul 27, 2021

I have come to appreciate TPM, but the problem I have with bitlocker is this..
Bitlocker Ransomware: Using BitLocker for Nefarious Reasons - Black Hills Information Security

If we can prevent ransomware purely with TPM I'm all for it.

johnlgalt · Jul 27, 2021

Yeah, about that.....Prolly not in our lifetimes.....

wordsworth · Jul 28, 2021

geneo said:
Not quite. The CPU doesn't support the use of it any more than any other device. It is just another device. In the case of Intel PTT it is a device that is part of the Intel Management Engine in the Chipset firmware that the OS discovers like other devices.

From Intel MEInfo tool:

View attachment 2488

"...it is a device that is part of the Intel Management Engine in the Chipset firmware...

Perhaps that is my clue. I just built a new system on an Asus ROG Strix A Gaming Wifi motherboard and the Enable/Disable for TPM in the BIOS will not remain on Enabled. Every reboot it is back at disabled and Windows shows the message that this machine does not have TPM. I downloaded the Intel ME stuff from the Asus site and upon trying to install it get a message that "this platform is not supported." I believed an install from the Asus CD took care of it as I no longer have any yellow flags in Device Manager. But perhaps I do not have Intel ME installed after all. Is there a way to check? In Device Manager I see a lot of Intel devices but not anything for MEI. I've tried other things people have written about such as enabling Virtualization but no change in the Enable/Disable TPM option.

A tech at Microcenter told me that this board does not have TPM and I needed a module, although he admitted he has not looked into this TPM stuff much as of yet. I told him I did not think so but maybe Asus will bring out an update on the BIOS to resolve this. In some videos showing how to enable TPM at Youtube I've seen less than a handful of people with Asus boards with the same Enable/Disable TPM BIOS problem.

Anyway, I have an Asus TPM module on the way (Amazon, $23) because I'm not going to trust Asus for a BIOS update if that is what would be needed. A Z590 board released this year should have this enabled already.

bobkn · Jul 28, 2021

wordsworth said:
(snip)

A tech at Microcenter told me that this board does not have TPM and I needed a module, although he admitted he has not looked into this TPM stuff much as of yet. I told him I did not think so but maybe Asus will bring out an update on the BIOS to resolve this. In some videos showing how to enable TPM at Youtube I've seen less than a handful of people with Asus boards with the same Enable/Disable TPM BIOS problem.

(snip)

The manual for the Strix Z590-A Gaming Wifi is very weak on BIOS settings, but I'd place a small wager ($1, a lot for me) that the board includes PTT (Intel's firmware TPM). While there's a lack of direct information, Asus claims that the board meets Win 11 requirements. Asus mainboards that support 11 There is no asterisk requiring a discrete TPM.

Also, motherboards that are certified for Windows 10 have been required to have a TPM for about 5 years.

The TP module you've purchased is probably redundant, but if it works, and only cost $23, no great loss. Some believe the discrete modules are superior to the "firmware" implementations, but I haven't been able to discover yet whether it's true or just compulsive behavior.

wordsworth · Jul 28, 2021

bobkn said:
The manual for the Strix Z590-A Gaming Wifi is very weak on BIOS settings, but I'd place a small wager ($1, a lot for me) that the board includes PTT (Intel's firmware TPM). While there's a lack of direct information, Asus claims that the board meets Win 11 requirements. Asus mainboards that support 11 There is no asterisk requiring a discrete TPM.

Also, motherboards that are certified for Windows 10 have been required to have a TPM for about 5 years.

The TP module you've purchased is probably redundant, but if it works, and only cost $23, no great loss. Some believe the discrete modules are superior to the "firmware" implementations, but I haven't been able to discover yet whether it's true or just compulsive behavior.

I agree with all you say, especially the manual being weak on BIOS settings; this was not the case many years ago. From something Geneo said, I believe that if I can get the Intel MEI installed that this situation will change and I'll find that this board has Intel's firmware TPM and yes the module would then be superfluous. Why Asus offers an Intel MEI package at the software site for this board that says, "This platform is not supported" upon trying to install it is the problem I deal with right now.

wordsworth · Jul 29, 2021

I replaced a defective motherboard in this system tonight for another reason and without doing anything else....after checking Device Manager I now have Intel MEI as well without my installing it.

HRPuffnstuff · Mar 24, 2022

On my gigabyte x570 board with 5950x bios updates alter the ftpm settings and on one occasion my machine would not boot until I went into the settings and forced custom settings. Therefore I have installed the header module because enough is enough. Now AMD admits their ftpm is causing system stuttering and promises a fix in AGESA 1.2.0.6x sometime in May.

imanlien2020 · Mar 24, 2022

unifex said:
Asus does sell TPM modules

Accessories｜Motherboards｜ASUS Global

ASUS offers different kinds of motherboard accessories including Thunderboltâ¢ expansion cards, M.2 add-on cards, and fan extension cards give DIY PC users better choices when it comes to building their perfect workstation or gaming rig.

www.asus.com

TPM-SPI｜Motherboards｜ASUS Global

ASUS offers different kinds of motherboard accessories including Thunderboltâ¢ expansion cards, M.2 add-on cards, and fan extension cards give DIY PC users better choices when it comes to building their perfect workstation or gaming rig.

www.asus.com

At the same time, many motherboards (including mine, ASUS Rog Strix Z490-A Gaming) have TPM (in the guise of PTT) inbuilt and do not require the additional module.

Which motherboards are you looking at?

Me too. It built in to mine also.

PerpetualCycle · Mar 24, 2022

imanlien2020 said:
Me too. It built in to mine also.

It is not the motherbopard, but the chipset (z490, etc) that has the PTT. Anything 8th gen Intel (actually also 7th gen, but 7th not officially supported by Windows 11) and beyond have this capability.

barman58 · Mar 25, 2022

The line between 7th and 8th Gen intel processors, as to which are "compatible" with Windows 11, is not a straight one. The cutoff I understand is due to the architecture update that was triggered by the Spectre attacks - Though not directly linked to spectre or any of it's derivatives.

The redesigned architecture provides access to a variety of new functionality within the processor, and this is what makes the divide as they potentially allow new functionality in future updates to Windows 11

The change of architecture was started with some later 7th generation processors (as an initial Intel response to spectre), and then was designed into all 8th Generation processors, on release.

This has resulted in the jumbled compatibility sets for Windows 11 Processors where all 8th generation processors are acceptable and some 7th Generation also comply. AMD basically made the same or similar architecture upgrades but actually upped the Generation for all the "New" processors

ish4d0w · Mar 25, 2022

barman58 said:
The line between 7th and 8th Gen intel processors, as to which are "compatible" with Windows 11, is not a straight one. The cutoff I understand is due to the architecture update that was triggered by the Spectre attacks - Though not directly linked to spectre or any of it's derivatives.

8th gen is not fully protected against Spectre either. Actually, not at all, and it is not so much newer. The difference, Microsoft claims, is at driver-level, and therefore, could be related to minor architectural differences too. However it is insignificant, no wonder 8th gen is called "Kaby Lake Refresh". I read it somewhere that Microsoft wants to have DCH-quality drivers for all essential hardware for Windows 11 certification. While Windows 11 supports legacy drivers, it is not desirable, and it is true, that 5th and 6th gen wildly uses legacy drivers (this is much evident with the GPU driver which is not the modern one yet). The 8th gen uses the modern GPU driver that is DCH, and in the 7th gen, some of them uses it, some of them don't. Some of them got an update.

Still from Microsoft to almost completely exclude the 7th gen, was a colossal mistake. I'm lucky to have 8th and 10th gen computers but I feel for those who use 7th gen. Microsoft betrayed everyone.

barman58 said:
The redesigned architecture provides access to a variety of new functionality within the processor, and this is what makes the divide as they potentially allow new functionality in future updates to Windows 11

Yes but let's not forget that 8th gen does not necessarily support those "changes" either. Just think of Modern Standby, out-of-the-box device encryption, Core Isolation, Sandbox just to name a few. All of these can really make Windows more secure however to claim that 8th gen is sufficient for this, is a flat out lie from Microsoft.

barman58 said:
The change of architecture was started with some later 7th generation processors (as an initial Intel response to spectre), and then was designed into all 8th Generation processors, on release.

Yes, started, but it was so half-baked that 8th gen still needed software mitigation (therefore performance drop) for Spectre patching, Yes it is not as bad as on earlier gens but still very bad and Intel is lying too.

barman58 said:
This has resulted in the jumbled compatibility sets for Windows 11 Processors where all 8th generation processors are acceptable and some 7th Generation also comply. AMD basically made the same or similar architecture upgrades but actually upped the Generation for all the "New" processors

I just hate them for their decisions on this. Both Microsoft and Intel.

Dirtyflash · Mar 25, 2022

ish4d0w said:
I read it somewhere that Microsoft wants to have DCH-quality drivers for all essential hardware for Windows 11 certification. While Windows 11 supports legacy drivers, it is not desirable, and it is true, that 5th and 6th gen wildly uses legacy drivers (this is much evident with the GPU driver which is not the modern one yet). The 8th gen uses the modern GPU driver that is DCH, and in the 7th gen, some of them uses it, some of them don't. Some of them got an update.

Intel released a GPU DCH driver for 6th gen and higher late last year.

Intel® Graphics – Windows* DCH Drivers

This download installs Intel® Graphics Driver 31.0.101.3790/31.0.101.2114 for Xe Dedicated, 6th-13th Gen Intel® Core™ Processor Graphics, and related Intel Atom®, Pentium®, and Celeron® processors. Driver version varies depending on the Intel Graphics in the system.

www.intel.com

My personal view on the Windows 11 hardware requirements is that they should have used the a cutoff point based on what Microsoft instructed OEM's would be the minimum specifications when they released Windows 10 64bit, ie, TPM 2.0, Secure Boot,etc. Systems having VBS capability being another one I think? Those PC's started getting manufactured in 2016. They could have included most 6th and 7th generation processors if they supported the aforementioned with a caveat stating that those devices may not be capable of supporting certain features, ie, Amazon AppStore,etc.

ish4d0w · Mar 26, 2022

Dirtyflash said:
Intel released a GPU DCH driver for 6th gen and higher late last year

Yes, they released a generic driver. Make sure do not forget that there are many notebooks that are using customized graphics drivers, in which case you might not receive an update. This is how you get legacy (not DCH) drivers on 6th and 7th gen, and probably this is why Microsoft drew the line. They don't want legacy drivers I think.