Microsoft Considers Tweaking Windows 11 TPM Requirement to Include Zen 1 and 7th Gen Core

[btarunr]

In more reason why Microsoft's requirement for hardware trusted platform modules for its upcoming Windows 11 operating system is arbitrary, the company revealed that it is willing to tweak the hardware TPM system requirements to accommodate platforms from 2017, which include the very first generation of AMD "Zen" (Ryzen 1000 series), and Intel 7th Gen Core "Kaby Lake." In a Windows Insider blog posted dated June 28, Microsoft explained in brief why Windows 11 needs TPM 2.0 hardware, and that the "PC Health Check App," the software tool Microsoft is giving users to check whether their PCs measure up to Windows 11, has been temporarily removed from the website while they work on getting its accuracy right.

"The intention of today's post is to acknowledge and clarify the confusion caused by our PC Health Check tool, share more details as to why we updated the system requirements for Windows 11 and set the path for how we will learn and adjust. Below you will find changes we are making based on that feedback, including ensuring we have the ability for Windows Insiders to install Windows 11 on 7th generation processors to give us more data about performance and security, updating our PC Health check app to provide more clarity, and committing to more technical detail on the principles behind our decisions. With Windows 11, we are focused on increasing security, improving reliability, and ensuring compatibility. This is what drives our decisions.

In the blog, Microsoft explains that a hardware TPM is required for secure credentials storage, to drive features such as device encryption, Windows Hello biometrics, virtualization-based security (VBS), and hypervisor-protected code integrity (HVCI) and Secure Boot. Most modern processors include a TPM 2.0-compliant on-die TPM, some even have features such as VBS and whole-memory encryption.

View at TechPowerUp Main Site

 

[Rais]

Those security option...why do I need them on a desktop PC? Or better, why i cannot upgrade my still good hardware to 11 just because of this?

 

[GeorgeMan]

Those security option...why do I need them on a desktop PC? Or better, why i cannot upgrade my still good hardware to 11 just because of this?

You can, your installation will be unsupported though.

 

[Gmr_Chick]

It only makes absolute sense for Windows 11 to support Intel 7th gen and Ryzen 1000 series. We're only talking 2017 here. It's not like it's Haswell or the FX series.

 

[Camm]

I had a think about Microsoft's security requirements, and they aren't arbitrary.

Secure Boot requires UEFI, that comes in at 5th Gen in a patchy way I'm pretty sure, and was only default by 7th gen, and wasn't available on Piledriver or Bristol.

TPM 2 was only supported from 8th Gen and Zen+ and up.

Makes sense when looked at from a 50 foot view I guess, although time to include TPM 1.2 and anything that supports Secure Boot, which should extend down to some 5th gen parts.

 

[ZoneDymo]

what is the exact reason why "ancient" hardware that can run Windows 10 just fine should not be able to run windows 11?
improved security? really? so my core 2 duo laptop or core 2 quad pc which run windows 10 just fine are super insecure and therefor irresponsible to use for windows 11

I mean this is just begging for hacked windows 11 vids where people show it runs just fine on older hardware....I swear sometimes its like companies work to have techyoutubers have content for their vids....

 

[Prime2515102]

I had a think about Microsoft's security requirements, and they aren't arbitrary.

Secure Boot requires UEFI, that comes in at 5th Gen in a patchy way I'm pretty sure, and was only default by 7th gen, and wasn't available on Piledriver or Bristol.

TPM 2 was only supported from 8th Gen and Zen+ and up.

Makes sense when looked at from a 50 foot view I guess, although time to include TPM 1.2 and anything that supports Secure Boot, which should extend down to some 5th gen parts.

I'm not sure how widespread it was, and I can't remember if it supported secure boot, but my Gigabyte z68-based board (2nd gen Core series) had UEFI support.

 

[Camm]

I'm not sure how widespread it was, and I can't remember if it supported secure boot, but my Gigabyte z68-based board (2nd gen Core series) had UEFI support.

I remember Gigabyte did this big ass BIOS to UEFI update rollout (I had an Assassin2 at the time and remember being impressed by it), I think Gigabyte was one of the exceptions here.

 

[Solaris17]

I hope they learn to support external 2.0 TPMs it’s my understanding they currently don’t.

As for there new security stance, I’m all
For it. It’s seriously about time someone attempted to fix the low hanging fruit in the PC industry.

AFAIC the people that are against this are literally part of the problem. One small step removed from being responsible for your last ransomware infection.

 

[DeathtoGnomes]

It only makes absolute sense for Windows 11 to support Intel 7th gen and Ryzen 1000 series. We're only talking 2017 here. It's not like it's Haswell or the FX series.

HEY! I like my FX series , ohh maybe I wont have to upgrade to 11!

 

[Mussels]

I could get this for OEM's, but why everyone else?

 

[cyberloner]

remove the tpm requirement ......... my fx8350 still damn strong

 

[Hossein Almet]

My motherboard has a TPM header and it's not a 7th gen, WTF!

 

[birdie]

99% of people out there don't use BitLocker full disk encryption and couldn't care less about TPM.

This whole saga is a fantastic load of crap.

 

[GerKNG]

i just want a proper and detailed explanation why i need a TPM to run windows 11. for what and why is it used?!

 

[Arcdar]

I get it for companies and OEM's .... but for general home-user-public TPM2.0 should not be a fixed requirement....

I mean, there are so many good systems that don't need an upgrade (xeon v1-v3's still have enough power for general usage..... ) that would still work absolutely fine with windows 11..... if it wouldn't be for the TPM requirement


and, that it's not on the list of supported cpus ...... which states 1Ghz minimum .... but Gen8+ .... slight oxymoron .....

 

[Camm]

99% of people out there don't use BitLocker full disk encryption and couldn't care less about TPM.

This whole saga is a fantastic load of crap.

And this is why it is now mandatory because users cant be trusted to do security.

 

[johnpa]

I see no reason why not use TPM if it is present, and not use it if it isn't present.

 

[Marshal_90]

Very interesting.

A few hours ago a Microsoft support agent told me that they're gonna change the hardware requirements!
We also talked about older platforms like AMD FX which has a TPM header and he said that you can install the OS without problem if you get a TPM Module.

We just have to wait and see what happens. it's not finished yet.

 

[Naito]

Aside from TPM, could it be MS doesn't want to support processors that have less hardware mitigation for the spectre and meltdown family of vulnerabilities?

 

[Selaya]

And this is why it is now mandatory because users cant be trusted to do security.

Yeah, a safe with the key glued/soldered to it, brilliant idea.

such secure
much encrypt
very safe
wowe

 

[Raven Rampkin]

I feel kinda entitled rn with my Zen1 but yea this whole situation smells like moar e-waste by the powaah of the e-waste gods

 

[BSim500]

And this is why it is now mandatory because users cant be trusted to do security.

Until the average Joes start to encrypt all their data based on hardware encryption and then change hardware, at which point after searching for "what the hell does repopulate your TPM hex recovery key mean, I can't find mine anywhere and didn't back it up. Also what is a command prompt and have I really just lost all my data?" that they deeply regret using hardware based Bitlocker vs something like VeraCrypt volumes that just use normal passwords / pass-phrases, use far stronger encryption that Bitlocker's default AES-128, have far fewer "issues" when changing hardware / sharing encrypted external drives between different computers and actually work in mixed Win/Lin cross-platform environments...

 

[Tsukiyomi91]

if MS wants to really save face and time, they should have just remove TPM and Secure Boot entirely from W11's requirement and let the end users decide how they want to protect or encrypt their PCs. At the end of the day, all these features that's supposed to "protect your data" is pointless when one allows remote access to bad actors (e.g refund scam call centers), gathering all your sensitive data and potentially lock you out.

 

[Vya Domus]

And this is why it is now mandatory because users cant be trusted to do security.

This has nothing to do with the user side of things though. TPM doesn't mean full system encryption or anything like that, it's just a standard used for some hardware security features inside the processor.

In other words a system may support TPM but still be completely open to any kind of attack.