Windows security

Device security tells me....no action needed, clicking on it tells me 'There is no TPM available. Your device may be vulnerable'. Can I fix this, if so how?

TPM is hardware device, (not a software problem), if your laptop doesn't have it there is not much you can do except buying a TPM and installing it, but it's not really needed.

See link below for more info, you might have it but lacking drivers or you might have software based TPM:

If your motherboard is fairly new, then it will most likely have a TPM module built-in.

Check the User Manual for your motherboard/laptop to verify it has a TPM module and then check your BIOS to make sure the TPM is enabled.

If your motherboard/laptop does not have a TPM or a connector to fit one, then you are out of luck, your only option would be to update your motherboard/laptop.

ludlowboy said:

'There is no TPM available. Your device may be vulnerable'. Can I fix this, if so how?

Click to expand...

How did you get Windows 11 on your PC? TPM 2.0 is a Windows 11 minimum requirement, the Setup checks for this at install or upgrade time and refuses to allow Windows 11 to install without TPM being present.

Having said that, 11 will run fine on a machine without TPM once it has been installed, there are known workarounds to bypass the install checks.

You may have firmware TPM available on your machine, but disabled in the bios. Look for 'fTPM' in the bios of a machine with an AMD processor, or PTT for Intel processors. Both are firmware implementations of TPM 2.0.

Thankyou for all your replies, it is an HP Prodesk 600 (I got it secondhand), I guess it is new enough to have the hardware, but I do not have enough smarts to mess with the bios, will things be ok if I do nothing?

You may start receiving more and more messages complaining about the lack of TPM so you would be well advised to go into the BIOS and turn it on.

If you need help finding the correct setting in BIOS, then I would suggest you contact HP and ask them to help you find it and enable it or simply read through the help manual for your BIOS.

If you can turn your PC on/off then you should be capable of turning a setting in BIOS on/off, it's not rocket science.

ludlowboy said:

it is an HP Prodesk 600 (I got it secondhand), I guess it is new enough to have the hardware

Click to expand...

Which prodesk 600? There are many over the years.

These videos should help you find and enable the TPM setting:

For newer models:

For older models:

ludlowboy said:

...will things be ok if I do nothing?

Click to expand...

Yes...

trumpy81 said:

You may start receiving more and more messages complaining about the lack of TPM....

Click to expand...

No, you won't - not in my experience. For an unsupported device (no TPM or only TPM 1.2, unsupported older cpu, etc.) you'll see a complaint from Setup when first installing or upgrading to Windows 11. Those would have needed a workaround to get past and complete the install.

Then you may see Device Security telling you there's no TPM, but it will have a 'Dismiss' button, so you should never see that one again. Beyond that I can't recall seeing anything further after that.

My unsupported System Four (see below in My Computers, Other Info) currently multi-boots four different builds of Windows 11, the retail 23H2 and the Insider Beta, Dev and Canary builds. None of them ever have any problem with it not having any TPM.

Bree said:

No, you won't - not in my experience. For an unsupported device (no TPM or only TPM 1.2, unsupported older cpu, etc.) you'll see a complaint from Setup when first installing or upgrading to Windows 11.

Click to expand...

Of course, but this is NOT the scenario we are talking about here. Read the OP's post again.

Bree said:

Then you may see Device Security telling you there's no TPM, but it will have a 'Dismiss' button, so you should never see that one again.

Click to expand...

You want to put money on that?

Bree said:

My unsupported System Four (see below in My Computers, Other Info) currently multi-boots four different builds of Windows 11, the retail 23H2 and the Insider Beta, Dev and Canary builds. None of them ever have any problem with it not having any TPM.

Click to expand...

This is because you had to bypass the requirements to install the OS in the first place, so of course they're not going to complain.

ludlowboy said:

it is an HP Prodesk 600 (I got it secondhand)

Click to expand...

That doesn't really narrow it down much. The first Prodesk 600 G1 came out in 2014, the Prodesk 600 G6 range was launched in 2020 Q3. The first model under the 'Prodesk 600' name that seems to meet all the Windows 11 hardware requirements was the Prodesk 600 G4 range with its choice of 8th gen Intel processors and TPM 2.0 in the form of an Infineon SLB9670.

If it's a used machine, did it come with Windows 11 already installed?
Which Prodesk 600 was it? The G3 or earlier are all unsupported devices.

trumpy81 said:

This is because you had to bypass the requirements to install the OS in the first place, so of course they're not going to complain.

Click to expand...

No it isn't. The only thing to 'bypass' was Setup's insistence that you must meet all the W11 hardware requirement before it would let you continue with an install. Once you got past that, what actually gets installed is the full and complete Windows 11 - nothing added, modified, or taken away.

Bree said:

The only thing to 'bypass' was Setup's insistence that you must meet all the W11 hardware requirement before it would let you continue with an install

Click to expand...

And what did you do to bypass that?

trumpy81 said:

And what did you do to bypass that?

Click to expand...

Have you ever clean installed Window 11? Before the install starts copying any files to the PC it checks that the PC meets all the hardware requirements. There's one specific .dll that Setup.exe will call to do the actual check. If it tells Setup that the PC passes all the requirements then Setup will begin installing Windows, if it doesn't meet the specs Setup will refuse to install.

Replace this file with an empty dummy file with the same name. When Setup calls it nothing happens. As far as Setup is concerned it has asked for the hardware to be tested and, not having had any failures reported back to it, assumes all specs have met and gets on with the install, exactly the same install it would do on any supported device.

And you don't think Microsoft could trace your actions and show exactly what you did?

You don't think Microsoft record the null response from that .dll?

If you tried to sue Microsoft for allowing malware/virus on your machine, your case would be thrown out before it ever got started, because Microsoft could easily show that you bypassed their requirements.

And since you accepted responsibility by bypassing their requirements, that information is recorded and Microsoft wont bother you about it any further. That is why you don't see any messages about TPM, you have already accepted the liability.

Thanks for all the replies, it is 600 G2, I will live with it without messing! To be honest I was happier with win 7, but things move on.
Thanks again.

Still no kb890830 available ...........!!
Is this security-update not updated anymore ??

ludlowboy said:

Thanks for all the replies, it is 600 G2, I will live with it without messing! To be honest I was happier with win 7, but things move on.

Click to expand...

The HP Prodesk 600 G2 came in three form factors, a Desktop Mini, a Microtower, and a Small Form Factor PC. All offered a choice of processors from Intel's 6th generation. Windows 11 minimum hardware requirement for an Intel processor is 8th gen or higher, so this is an unsupported device. The supplier you bought it from would have used one of the known workarounds to install Windows 11.

HP ProDesk 600 G2 Small Form Factor - Maintenance and Service Guide (pdf, 9.62 MB)

Don't worry though, Windows 11 should run well. System Two in my specs below has been running Windows 11 on its 1st gen i5 since 21H2 build 22000 was first released. An unsupported device will get all the same cumulative updates through Windows Update as any other W11 machine.

The one thing Windows Update won't offer to an unsupported device is the Feature Update to the next version of W11 when it is released. For the 22H2 Feature Update (22621) I needed to do a manual upgrade using the ISO and a workaround. The Feature Update from 22H2 to 23H2 (22631) was by means on a small Enablement Package, which can be installed manually without any need for a workaround. The next Feature Update is expected to be 24H2 in late 2024, that too is likely to be done by an Enablement Package.

Bree, thankyou for all your help and the pdf download