Why Does Windows 11 Need TPM 2.0?
Windows 11 requires a PC with TPM 2.0. TPM stands for Trusted Platform Module. Its a technology that provides security-related functions at the hardware level. It generates and stores encryption keys and performs functions in a tamper-resistant manner. It provides additional protection against malware and other types of attacks. In a blog post, Microsoft explains that Windows 11 systems will all have a hardware root-of-trust. The TPM is a tamper-resistant element at the core of the computer that can be used for security features like disk encryption and secure biometric sign-ins with Windows Hello. TPM attestation can be used to remotely authenticate hardware and software. The TPM has a unique endorsement key (EK) burned into the hardware. Organizations can remotely check and verify that a device is what it says it is and that the hardware and software havent been tampered with. For example, this might be particularly useful for a company managing a fleet of work laptops. The TPM includes a hardware random number generator that the system can depend on, too. Heres one example: BitLocker encryption can store encryption keys in the TPM to protect your files. When your computer boots, the key stored in the TPM is used to unlock your drive. If an attacker yanks your system drive and inserts it into another computer, the attacker cant decrypt it and access your files without the keys stored in the TPM. The TPM is tamper-resistant, so an attacker cant just plug it into another computer or easily extract the decryption key from it. Advertisement    Even on Windows 10, BitLocker normally wont work without a TPM. If all Windows 11 PCs have a TPM, then all Windows 11 PCs can natively support Device Encryption. Thats a lot better than the situation with some Windows 10 PCs coming with disk encryption while others dont include encryption. A TPM will give each Windows 11 system a baseline of hardware security for Microsoft to build on top of. Windows 11 can always assume that it has this baseline of hardware security. Microsoft wont have to build software-based hacks on top of Windows 11 or leave important functionality like disk encryption disabled on many PCs. Microsofts messaging was all over the place in the days after Windows 11s announcement. Initially, Microsofts Windows 11 compatibility page said that some systems with TPM 1.2 would be able to upgrade. Later, Microsoft edited that page and said that TPM 2.0 would be required. A Microsoft web page dating to 2018 points out a variety of security advantages that TPM 2.0 has over TPM 1.2, including support for more modern cryptographic algorithms. Since TPM 2.0 has these advantages and has been common for several years now, Microsoft clearly feels that it makes sense to require TPM 2.0. Microsoft Has Required a TPM on Some New PCs Since 2016  Microsoft has required TPM 2.0 on Windows 10 PCs for several yearskind of. Since July 28, 2016, all new Windows PCs being manufactured have required TPM 2.0 to be enabled by default. If youre buying a laptop, desktop, 2-in-1, or any other device that comes with Windows 10 preinstalled, Microsoft requires that the manufacturer include TPM 2.0 and have it enabled. Advertisement    However, this is a requirement for the computer manufacturer to license and ship Windows on a PC. If you were building your own computer, you could have purchased a motherboard without TPM hardware and installed Windows 10 on it. Or, your motherboard manufacturer might have shipped the hardware with the TPM disabled. Windows 10 would have functioned happily without a TPM, whereas Windows 11 will refuse to install on such a system. If youve purchased a PC that came with Windows 10 in 2016 or later, theres a good chance that it has TPM 2.0 already enabledunless that model was originally made before the cutoff date. If your PC is older than that, it might or might not have the TPM that Windows 11 requires. Many PCs have updated from Windows 7 to Windows 10, and those PCs will likely be left behind by this requirement. However, people who built their own PCsa crowd that includes a lot of PC gamersmight be in a strange situation. If you built your own PC (or purchased it from a company that built it for you), your PC might or might not have TPM 2.0. Even if Windows says that TPM 2.0 isnt present, it could just be disabled by default, and you might need to enable it in your computers BIOS. To find out, you might need to visit your computers BIOS (technically, now a UEFI firmware settings screen on modern computers, but often still called the BIOS) and look for an option named TPM, or something similar that enables this feature. Advertisement    Some computers have a firmware-based TPM. Intel calls this feature iPPT (Intel Platform Protection Technology), while AMD calls it fTPM (Firmware Trusted Platform Module). You might need to find an option called something like this in your BIOS/UEFI settings screen. It could be called something else, tooconsult your motherboards manual for more information. Theres a good chance that many people with newer PCs will be able to enable TPM 2.0 in the BIOS without purchasing a separate TPM hardware modulea component that scalpers are already buying up. However, some gaming motherboards havent included this feature and it might not be available. Prior to Microsofts announcement, this would be required for Windows 11, but this wasnt necessarily considered a must-have feature for people building their own PCs. Microsoft Made the Situation a Confusing Mess  The requirement to have TPM 2.0 as a hardware security baseline that Microsoft can design around makes sense. Remember that Microsoft will continue supporting Windows 10 until October 14, 2025, so you can keep using your current computer and operating system for years to come. The real problem, once again, is Microsofts poor communication. For example, if Microsoft had warned people that a TPM 2.0 would one day be required, motherboard manufacturers likely wouldnt have skimped on adding it to gaming boards. PC enthusiasts would have ensured that their builds had a TPM. Hardware manufacturers could have enabled it by default rather than disabling it by default. Microsoft might say that it sent this signal to its hardware partners, but many motherboard manufacturers clearly didnt get the message. Windows 11s announcement was also a mess: Microsoft initially said that TPM 1.2 would be partially supported and then changed its mind. Microsoft didnt even bother trying to explain why TPM was required at first. After Microsoft tried to build hype for the upgrade, the official PC Health Check tool mysteriously failed without telling people why their PC wasnt supported. Microsoft could also have explained the situation and provided information on enabling TPM 2.0 in your computers BIOSbut the company didnt do any of that.