TPM 2.0 (Trusted Platform Module)

Windows 11 refuses to install, and the error mentions a chip you have never heard of. The good news: on many recent PCs it is already there, just switched off.

The short answer

TPM 2.0 is a Trusted Platform Module: a secure crypto-processor that generates and stores cryptographic keys, limits their use and records measurements of the boot process [1]. The Trusted Computing Group (TCG) publishes the specification; the current TPM 2.0 Library is Version 185 from March 2026 [7], and TPM 2.0 is also published as the international standard ISO/IEC 11889 [2]. Windows 11 lists TPM 2.0 as a minimum hardware requirement [3]. Our assessment: on a desktop from the last few years, check the firmware settings before you conclude the board has no TPM.

How it works

1. Keys that stay inside. A TPM can create keys that are not available outside the TPM, so they cannot be copied and used elsewhere [1]. If too many wrong authorization values are tried, its dictionary attack logic blocks further guesses [1].
2. Measuring the start. During boot, the code that loads, including firmware and operating system components, can be measured and recorded in the TPM. Windows uses these measurements as evidence of how the system started and to make sure a TPM-based key is only used when the correct software booted [1]. Measured Boot needs a TPM and UEFI Secure Boot [2].
3. Three forms. TPM 2.0 exists as a discrete chip (dTPM) in its own package, as an integrated component next to other logic, and as a firmware TPM (fTPM) that runs in a trusted execution environment on the main processor [2]. Windows uses any compatible TPM in the same way, and Microsoft takes no position on which form is better [2].
4. Why 2.0 and not 1.2. TPM 1.2 only allows RSA and SHA-1. TPM 2.0 supports newer algorithms, and Windows configures its lockout policy, which gives the same dictionary attack protection on every device [2].
5. UEFI only. TPM 2.0 is not supported in Legacy or CSM BIOS modes; the firmware must run in native UEFI mode [2].
6. Who uses it. Windows Hello and BitLocker use the TPM, and Device Encryption requires TPM 2.0 [2][4]. A Windows 11 virtual machine needs a virtual TPM [3].

A practical example

Before you upgrade a Windows 10 PC, press Windows+R and run tpm.msc. "Compatible TPM cannot be found" means the TPM may be disabled. If it reports that the TPM is ready, check that the Specification Version reads 2.0 [4]. PowerShell, started as administrator, shows the same status as an object [6]:

Get-Tpm

TpmPresent and TpmReady should both read True [6]. If no TPM appears, open the UEFI firmware settings and look for an option called Security Device, TPM State, AMD fTPM switch, AMD PSP fTPM, Intel PTT or Intel Platform Trust Technology [4]. This is a generic walk-through, not a report from our own hardware.

Checklist

• Check the Specification Version in tpm.msc or under Windows Security, Device security [4].
• Enable fTPM or Intel PTT in the firmware if no TPM shows up [4].
• Switch the firmware to UEFI before you rely on TPM 2.0, and prepare an MBR system disk with MBR2GPT first, otherwise Windows stops booting [2].
• Save your BitLocker recovery key before you change TPM settings. Microsoft notes that toggling between TPMs sends BitLocker into recovery mode [5].
• Clear the TPM only from within Windows, never directly in UEFI, and only on a device you own: clearing deletes every key and the data it protects [5].
• Give a Windows 11 VM a virtual TPM instead of hunting for workarounds [3].