What Is the TPM in Windows? — An Illustrated Guide to the "Safe That Never Lets Keys Out" and Measured Boot

“We have PCs that can’t run Windows 11. They tell us there’s no TPM.” — over the past few years, this line has come up in every consultation about corporate PC refreshes. People know it is “some kind of security chip”, but few can explain what it actually does and why it is mandatory, let alone why merely updating the BIOS gets you asked for the BitLocker recovery key.

The TPM is not a “chip that makes encryption fast”, nor is it a “chip that blocks viruses”. Put bluntly, it does only two things.

1. It lets you use a private key without that key ever leaving the chip.
2. It records what was loaded at boot, and releases keys only when that record is what you expected.

Once those two things are clear, it becomes easy to explain both why Windows security features such as BitLocker, Windows Hello, Credential Guard, and device health attestation all sit on the same foundation, and why the problems you hit in the field happen at all.

This article covers the mechanics of the TPM with diagrams, then where Windows uses it, how to check the state of your own PC, how to handle field problems such as the recovery key prompt and clearing the TPM, and finally how a developer uses the TPM from their own application — all backed by the official documentation.

1. The Bottom Line First

The TPM (Trusted Platform Module) is a security-dedicated processor responsible for generating, storing, and using cryptographic keys.¹ What it does boils down to the two points above.

• It lets a private key be used without leaving the chip (the safe). The private portion of a key marked non-exportable is never exposed to any other software, process, or user.²
• It records what was loaded at boot (the ledger). The firmware and boot loader record the hash of the code they are about to execute into an area called the PCRs before handing over control. A key can be “sealed” so that it is only released when that record is as expected, and BitLocker is the canonical example.³²

From these two facts, several practically useful conclusions follow. Details come in the relevant sections.

• The reason a four-digit Windows Hello PIN is safe is that the anti-hammering protection (lockout after 32 failed authentications) lives in hardware (Section 2).²
• The Windows 11 minimum requirements are firmware that is “UEFI, Secure Boot capable” plus TPM 2.0. However, Windows 11 IoT Enterprise has relaxed requirements for dedicated devices, and there are configurations in which the TPM is optional (Section 6).⁴⁵
• There are three TPM implementations (dedicated chip / integrated / firmware), but Windows uses all of them identically (Section 5).⁶
• Windows 10/11 automatically initialise and take ownership of the TPM, so you normally have no reason to touch settings in tpm.msc (Section 8).¹
• Clearing the TPM leads to data loss. Verifying backups and recovery paths is mandatory before you do it (Section 9).⁷
• Developers should use CNG’s “Microsoft Platform Crypto Provider” rather than hitting the TPM directly (Section 10).⁸

2. What a TPM Is — A Safe That Never Lets Keys Out

Start by imagining a world without a TPM. If you try to protect a private key in software alone, at some point the key ends up as plaintext in memory, because the CPU has to read the key’s value in order to compute a signature or a decryption. In other words, it fundamentally cannot be hidden from malware that has reached the kernel, or from an attacker who can physically read memory. The official documentation says as much: software-based key protection is “subject to reverse-engineering attacks, in which the attacker analyses how the key is stored in memory and copied while in use”.³

The TPM inverts that premise. Keys are generated inside the TPM and stay inside the TPM. Applications and the OS do not receive the key — they ask the TPM to do a job and receive only the result.

flowchart TB
    subgraph SW["A. Protecting keys in software alone"]
        A1["App / OS"] -->|"loads the key and computes"| A2["Private key in memory<br/>exists in plaintext at some moment"]
        A2 -.->|"can be read out"| A3["Malware that reached the kernel<br/>memory analysis, physical attack"]
    end
    subgraph HW["B. Entrusting the key to the TPM"]
        B1["App / OS"] -->|"sends only the request:<br/>sign this / decrypt this"| B2["TPM"]
        B2 --> B3["Computes with the private key inside<br/>the key never leaves the chip"]
        B3 -->|"returns only the result"| B4["App / OS receives only<br/>the signature or decrypted data"]
        B5["Malware that reached the kernel<br/>memory analysis, physical attack"] -.->|"cannot extract the key itself"| B2
    end
    SW ~~~ HW

Figure 1: Protecting keys in software alone versus entrusting them to the TPM

The important point here is that the TPM is passive. It does not monitor anything of its own accord, and it does not stop viruses. It is a component that receives commands and returns responses, nothing more.⁶ Precisely because of that, extracting value from the TPM requires the OEM (the PC manufacturer) to integrate hardware and firmware carefully, and Windows builds its features on that assumption.

The other pillar is anti-hammering. A key protected by the TPM can have an authorisation value such as a PIN attached to it. When guesses at that value fail a certain number of times, the TPM refuses further attempts and locks out. For TPM 2.0, Windows configures this behaviour: specifically, lockout after 32 failed authentications, with one failure forgotten every 10 minutes. After 320 minutes with no failures at all, the remembered failure count returns to zero.²

The fact that the attempt limit lives in hardware is what makes this work. If you count failures in software, an attacker can defeat it by rebooting, by rolling back the system clock, or by restoring the file that holds the count. With a TPM they cannot.³ This is precisely the basis for saying that a four-digit Windows Hello PIN is safer than a password.

3. Inside the TPM — EK, SRK, PCR, and NVRAM

The TPM contains several elements with different roles. The names are similar and easy to confuse, so let’s fix their relative positions with a diagram.

flowchart TB
    TPM["TPM 2.0"]
    TPM --> EK["EK / Endorsement Key<br/>derived from a seed set at manufacture<br/>ships with a vendor certificate"]
    TPM --> SRK["SRK / Storage Root Key<br/>the parent key that wraps other keys"]
    TPM --> PCR["PCR 0-23<br/>accumulates boot measurements"]
    TPM --> NV["NVRAM<br/>small area that survives power off"]
    EK --> AIK["AIK / attestation key<br/>the ID presented outside instead of the EK"]
    SRK --> K1["BitLocker key"]
    SRK --> K2["Windows Hello key"]
    SRK --> K3["Certificate private key"]
    PCR -.->|"bound so it can only be<br/>released at these values"| K1

Figure 2: The main components of the TPM and the parent-child relationships between keys

The EK (Endorsement Key) is an asymmetric key pair unique to that TPM. The private half is held inside the TPM and is never exposed externally, nor accessible from outside.² It comes with an EK certificate signed by the manufacturer, which attests that “this key really is inside a TPM we manufactured”. That is what lets you distinguish a genuine TPM from malware pretending to be one.³

Note that Microsoft’s documentation describes the EK as an RSA key pair,² but that wording dates from the TPM 1.2 era. The immutable secret written into a TPM 2.0 chip at manufacture is, strictly speaking, a seed called the endorsement primary seed, and the EK is derived from that seed through a fixed procedure (a template). Deriving from the same seed always yields the same key, so even though the EK can be recreated it remains, in effect, a key unique to that TPM. Both RSA and ECC EKs can be derived, and it is not unusual for a real machine to have both available.

Exposing the EK directly, however, would uniquely identify the PC and create a privacy problem. Real scenarios therefore use an AIK (Attestation Identity Key). A certificate authority uses the EK and its certificate to prove that “this AIK exists inside a genuine TPM” and issues an AIK certificate. Because you can use a different AIK per relying party, multiple verifiers cannot collude to track the same device.³

The SRK (Storage Root Key) is the parent key used to wrap other keys. The TPM can encrypt a key it created and emit it externally, and that key can only be decrypted by that same TPM. This process is called “wrapping” or “binding”.² In other words, even though the storage inside the TPM is small, you can effectively hold any number of keys by storing them encrypted on external storage.

The PCRs (Platform Configuration Registers) are special registers that accumulate boot-time measurements. There are 24 of them, numbered 0 to 23, each with a defined purpose.⁹ Their crucial property is that you cannot write an arbitrary value directly; the value can only be advanced with an Extend operation. Extend is a one-way operation that concatenates the current value with the new measurement, hashes the result, and makes that the new value — so it is fundamentally impossible to “erase just the inconvenient records along the way”. The values are reset on reboot.³

Note that TPM 2.0 also has PCRs with a resettable attribute (for DRTM and application use). But the PCRs BitLocker uses for sealing (0, 2, 4, 7, and 11) are static measured-boot PCRs and cannot be reset until reboot. The explanations in this article assume those.

NVRAM is a small non-volatile area used to hold things such as certificates. TPM 2.0 improves on TPM 1.2 in algorithms, cryptography, hierarchies, root keys, authorisation, and NVRAM.⁶

4. Measured Boot and PCRs — Why “a Changed Boot Won’t Open”

The other pillar of the TPM is Measured Boot. This is the key to understanding how BitLocker behaves.

4.1. What “Measurement” Actually Means

Before going further, let’s make the word “measurement” concrete. Measurement here does not mean measuring a physical quantity like weight or temperature. It means computing a hash over the entire byte sequence of the program or configuration data that is about to be executed. A hash is a fixed-length value that acts like a “fingerprint of the content”, with the following properties.

• The same content always yields the same value, whoever computes it and whenever.
• If the content differs by even one byte, the value is completely different.
• Recovering the original content from the value is effectively impossible.

For example, hashed with SHA-256, abc becomes

ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

and abd, which differs only in the last character, becomes

a52d159f262b2c6ddb724a61840befc36eb30c88877a4030b65cbe86298449c9

A one-character difference changes the value entirely, and comparing the two values leaves not even a hint that the contents were similar. You can compute the SHA-256 of any file with PowerShell’s Get-FileHash, so you can get a feel for this “fingerprint” yourself.

In short, “boot measurements” are the hashes of each piece of firmware, boot loader, and configuration executed during the boot process. If every measurement matches the previous boot, you can assert that “the software and configuration involved in booting were exactly the same as last time”. Conversely, if the boot loader has been tampered with, or the machine was booted from a different OS, the corresponding measurement will necessarily change. That is the foundation of Measured Boot.

4.2. The Chain of Measurement — Measure What You Load, Before You Run It

The mechanism is simple. Inside the system firmware there is an unconditionally trusted starting point called the CRTM (Core Root of Trust for Measurement). The CRTM unconditionally hashes the next software component to be executed and records that measurement into the TPM. Every subsequent component does the same — you measure what you load, before you run it. Because the measurement is sent before execution, a component cannot erase its own measurement from the TPM.³

sequenceDiagram
    autonumber
    participant FW as UEFI firmware CRTM
    participant BM as Windows Boot Manager
    participant OS as Windows kernel
    participant T as TPM

    FW->>T: Extend the hash of the code to run next
    Note over T: PCR 0 / 2 / 4 / 7 are updated
    FW->>BM: Hand over control
    BM->>T: Request release of the sealed BitLocker key
    alt PCRs match the values at sealing time
        T-->>BM: Return the key
        BM->>BM: Decrypt the OS volume
        BM->>T: Extend kernel, ELAM, boot drivers
        Note over BM,T: Measure before executing, then hand over
        BM->>OS: Hand over control and start Windows
    else PCRs differ
        T-->>BM: Do not return the key
        BM->>BM: Go to the recovery key prompt
    end

Figure 3: Measured Boot and the release of the BitLocker key

The reason the diagram shows “measure the kernel after decrypting” in that order is that, following the principle of Measured Boot, whatever is loaded is measured before it runs. The Windows boot loader verifies the kernel’s digital signature before loading it, and the kernel in turn verifies the boot drivers, startup files, and ELAM — a chain.¹⁰ Measuring yourself only after the kernel has started would let the measurement be skipped, which would be pointless.

BitLocker creates a key inside the TPM that can only be used when those measurements are the expected values. The expected values are computed as of the point at which the Windows Boot Manager runs from the OS volume of the system disk. If the machine is booted with a different OS or the configuration is changed, the measurements inside the TPM change, the TPM does not permit use of the key, and the encrypted OS volume cannot be decrypted.³

So which PCRs are actually watched? Here is the default platform validation profile for a native UEFI configuration.⁹

By default, PCR 0, 2, 4, and 11 are the sealing targets. However, if the Secure Boot state (PCR 7) is supported, sealing uses PCR 7 and PCR 11 instead.⁹ This is an important distinction. PCR 0/2/4 are hashes of the firmware and Boot Manager images themselves, so their values change every time the firmware is updated and you drop into recovery mode. PCR 7, by contrast, measures “whether Secure Boot is enabled and which keys are trusted”, so as long as the signer is the same, the value does not change when the image is updated. Microsoft explains that binding to PCR 7 reduces the likelihood of entering recovery mode after firmware or image updates.⁹

The way PCR 11 is used is a little unusual, and a rather neat trick. The attack it anticipates is one where the attacker leaves the victim’s machine as it is (keeping the hardware and firmware) and swaps only the OS disk for one of their own. The key is sealed to the original TPM, so changing the whole machine would be pointless — the point is to keep using the victim’s TPM. The attacker extracts the sealed BitLocker key blob from the metadata on the victim’s OS partition, boots an OS under their own control, calls the TPM API, and tries to unseal that key blob.

This does not work because when Windows seals the key it seals with PCR 11 set to 0, and the Boot Manager always changes PCR 11 to 1 when it hands control to the next boot loader (legitimate or not). By the time the attacker’s OS is running, the Boot Manager has already relinquished control, and PCR 11 is definitely no longer 0. So even on the same machine with the same TPM, the key cannot be requested from any stage later than the Boot Manager.¹¹

Note that Secure Boot itself is also part of BitLocker’s defences. By default BitLocker uses Secure Boot’s integrity protection through the PCR 7 measurement, preventing unauthorised EFI firmware, EFI boot applications, and boot loaders from starting and obtaining the BitLocker key.¹¹

5. dTPM, fTPM, and Pluton — Differences in Implementation

Because the phrase “TPM chip” has become common, people tend to assume the TPM must be a separate component, but there are three implementations.⁶

flowchart LR
    C1["CPU"] ---|"LPC / SPI bus"| T1["Dedicated TPM chip<br/>= discrete, dTPM"]
    C2["CPU / chipset<br/>package"] --> T2["Dedicated hardware in the same package<br/>logically separated<br/>= integrated"]
    C3["General-purpose CPU"] --> T3["Firmware implementation running on<br/>a trusted execution environment (TEE)<br/>= firmware, fTPM"]
    C4["SoC"] --> T4["Microsoft-designed<br/>security processor<br/>= Pluton"]

Figure 4: The three TPM implementations, and Pluton as their extension

• A discrete TPM (dTPM) is a dedicated chip in its own semiconductor package. It is mounted on the motherboard, with the advantage that the OEM can evaluate and certify it separately from the system itself.⁶
• An integrated TPM is implemented as dedicated hardware that sits in the same package as other components but is logically separated.⁶
• A firmware TPM (fTPM) runs the TPM as firmware inside the trusted execution environment (TEE) of a general-purpose compute unit.⁶ It suits small, low-power devices where a dedicated chip is not practical.

Windows uses any compatible TPM in exactly the same way. Microsoft takes no position on how a TPM should be implemented, saying that a broad ecosystem serves every kind of need.⁶ In other words, an fTPM is not “second class”.

On top of that, Microsoft Pluton takes the integrated form one step further. It is a secure cryptographic processor built into the CPU, designed by Microsoft and manufactured by silicon partners, intended to provide TPM functionality while also offering security features beyond the scope of the TPM 2.0 specification.¹² As of 2026, Pluton is available on Windows 11 machines with the following chipsets.¹²

• AMD: Ryzen 6000 / 7000 / 8000 / 9000 series, Ryzen AI series
• Intel: Core Ultra 200V series, Core Ultra Series 3 and Series 3 processors
• Qualcomm: Snapdragon 8cx Gen 3, Snapdragon X series

Operationally, Pluton’s distinguishing feature is that there are two firmware update paths. Alongside the conventional UEFI capsule update of the firmware in the motherboard’s SPI flash, new Pluton firmware can be loaded dynamically through OS updates. At system boot it initialises from the firmware in SPI flash, and during Windows startup the latest version obtained through Windows Update (if any) is loaded.¹² The prospect of a fix being distributed without waiting for the PC vendor’s BIOS update, when a TPM firmware vulnerability is found, is a welcome property in practice.

6. TPM 1.2 vs 2.0, and the Windows 11 Requirements

If you deal with older PCs you still run into TPM 1.2. The difference between the two is more than “the version went up”.⁶

SHA-1 is the part that bites hardest. NIST required most federal agencies to move to SHA-256 as of 2014, and Microsoft and Google dropped support for SHA-1-based signatures and certificates in 2017. Because the TPM 1.2 specification can only use SHA-1, it cannot follow that trend.⁶

Then there is Windows 11. The minimum requirements are a 64-bit CPU on the compatibility list, 4 GB of memory, 64 GB of storage, graphics compatible with DirectX 12 or later with a WDDM 2.0 driver, a display of 720p or better, larger than 9 inches, with 8 bits per colour channel, system firmware that is “UEFI, Secure Boot capable”, and TPM 2.0.⁴

Read this precisely. What the minimum requirement asks for is being capable of Secure Boot, not having it enabled.⁴ You can still meet the requirement with it disabled, so there is no need to touch UEFI settings purely in order to move to Windows 11. That said, if you do enable Secure Boot and the platform meets the requirements for PCR 7 binding, BitLocker binds to PCR 7 and becomes less likely to drop into recovery mode (Section 4). Enabling it does not automatically make that happen, so check which PCRs you are actually bound to via the PCR validation profile in manage-bde -protectors -get C:. The correct framing is that you enable it for that practical benefit, not because it is a requirement.

Another thing that is easily overlooked is that TPM 2.0 is not supported in legacy or CSM (Compatibility Support Module) BIOS modes. Devices with TPM 2.0 must have their BIOS mode configured as “native UEFI only”, and the legacy/CSM options must be disabled.⁶

This creates an awkward situation in practice, because an OS installed in legacy mode will not boot once you change the BIOS mode to UEFI. Before changing the BIOS mode, you have to use the MBR2GPT tool to bring the OS and disk into a UEFI-capable state.⁶ Machines that “have a TPM but can’t be upgraded to Windows 11” are often in exactly this state. The overall picture for deciding how to migrate from Windows 10 is set out in “A Realistic Answer After Windows 10 End of Support — A Decision Table for ESU, LTSC, and Replacement”.

Note also that for device health attestation, what Windows supports is TPM 2.0, and even a device with TPM 2.0 will not work as expected if it runs a legacy BIOS.¹

6.1. The Exception — TPM Is Optional on Windows 11 IoT Enterprise

Everything above about “Windows 11 requires TPM 2.0” applies to the general PC editions. Windows 11 IoT Enterprise has a separately defined, relaxed set of minimum requirements for dedicated devices, and on IoT Enterprise LTSC (and non-LTSC 24H2 and later) both the TPM and Secure Boot are Optional.⁵ In industrial PCs and embedded equipment, knowing this can overturn the conclusion that “this board can’t run Windows 11”.

The official requirements table has two columns: PREFERRED and OPTIONAL (the minimum for dedicated devices).⁵

There are three caveats.

• This is not “LTSC means no TPM needed”. The relaxed requirements are defined for IoT Enterprise; Windows 11 Enterprise LTSC (without IoT) is treated the same as the general PC editions. The names are similar and get confused, but the conclusion changes depending on which licence you are procuring.
• Non-LTSC IoT Enterprise differs by version. In the OPTIONAL requirements for 21H2 through 23H2, TPM 2.0 is still required (only Secure Boot is optional); the TPM becomes optional from 24H2 onwards.⁵
• Processor requirements are separate. Even with the TPM and Secure Boot optional, the list of supported processors is defined separately, so be sure to check it.⁵

Microsoft itself adds a caution about what choosing the relaxed requirements means: you should think carefully before lowering requirements on a device where end users can add software later, since not providing a TPM can affect the software those end users need.⁵ Without a TPM, BitLocker cannot seal keys to the boot state, and Windows Hello keys fall back to software protection. Switch your framing from “fit it to meet the requirement” to “fit it to obtain the protection this device needs”.

The overall picture of choosing between IoT Enterprise and LTSC and procuring licences is set out in “Which Windows Should Go on an Industrial PC? — A Practical Guide to Windows IoT Enterprise / LTSC”.

7. Where Windows Actually Uses the TPM

Being told “a TPM is required” is hard to accept when you cannot see which day-to-day features depend on it. Here is a map.

flowchart LR
    TPM["TPM 2.0"]
    TPM --> BL["BitLocker / device encryption<br/>seals keys to the boot state"]
    TPM --> WH["Windows Hello<br/>protects keys tied to a PIN or biometrics<br/>anti-hammering keeps short PINs safe"]
    TPM --> CG["Credential Guard<br/>protects isolated-environment keys by measurement"]
    TPM --> MB["Measured Boot / remote attestation<br/>issues a signed quote of the boot state"]
    TPM --> HA["Device health attestation<br/>input for MDM conditional access"]
    TPM --> PCP["Platform Crypto Provider<br/>makes certificate private keys non-exportable"]

Figure 5: The main Windows security features built on the TPM

BitLocker / device encryption. As covered in Section 4. There are four unlock methods — TPM only, TPM + PIN, TPM + startup key, and TPM + PIN + startup key — and TPM only is described as the most convenient but less secure than the methods that require an additional authentication factor.¹¹

Note that the prerequisites for device encryption (the mechanism that enables BitLocker automatically) have changed over the past few years. It used to require meeting the Modern Standby or HSTI requirements and having no DMA-capable external ports, but from Windows 11 version 24H2 those prerequisites were removed and far more machines are now covered.¹³ The claim in older write-ups that “it only works on Modern Standby machines” does not apply from 24H2 onwards. You can check whether a given machine qualifies under “Device Encryption Support” in msinfo32.exe (System Information).¹³

Windows Hello / Windows Hello for Business. Authentication combines a key provisioned per device with a PIN or biometrics. If there is a TPM, the TPM protects the key; if not, it is protected in software. Biometric data is used on that device only to access the provisioned key, and is not shared between devices.³ On a device with a TPM the key cannot be copied elsewhere, which gives you the property that leaked credentials cannot be used on another device.

Credential Guard. This feature performs credential hashing in an isolated memory region inaccessible from the kernel. That isolated region is initialised and protected during the boot process, and Credential Guard uses the TPM to protect its keys by measurement. The keys are only accessible at the boot stage where the isolated region is initialised, and are not available from the normal kernel.³

Measured Boot and remote attestation. Using an AIK, the TPM can generate a statement (a quote) cryptographically signed over the current measurement state. Sending that to a remote party proves “with which software and configuration the machine booted and initialised the OS”.³ Measurement stops at the initial state of Windows, so it contains no privacy-sensitive information such as which applications you use.³

Device health attestation. Microsoft’s health attestation service issues AIK certificates for TPMs from multiple manufacturers, parses the Measured Boot information, and turns it into simple assertions such as “is BitLocker on”, “is Secure Boot on”, and “is DEP enabled”. MDM systems (such as Intune) can then use those assertions to quarantine a device or block access to cloud services, without having to parse the complex quote themselves.¹³

Platform Crypto Provider. This protects certificate private keys with the TPM. A certificate template can specify “use the TPM’s Platform Crypto Provider”, and a certificate private key configured as non-exportable cannot be taken out of the TPM. If the certificate requires a PIN, the TPM’s anti-hammering applies automatically.³ This is the developer-facing entry point covered in Section 10.

Virtual smart cards. This feature makes the TPM behave as “a smart card that is always inserted”, removing the cost of buying and distributing physical cards and readers.³ However, Microsoft now recommends that users of virtual smart cards move to Windows Hello for Business or FIDO2 security keys.² It remains as an existing asset, but it is not the direction to choose for a new design.

8. Checking the TPM on Your Own PC

From here on it is hands-on. The first thing to note is that Windows 10/11 automatically initialise and take ownership of the TPM. So there is normally no need to touch settings in the TPM management console (tpm.msc), and Microsoft states that “in most cases, we recommend avoiding configuration via tpm.msc”. The exceptions are situations involving resetting or clean-installing the PC.¹ Incidentally, active development of the TPM management console ended with Windows Server 2019 / Windows 10 version 1809.¹

8.1. Looking at It in the GUI

• Win + R → tpm.msc opens the TPM management console. It tells you whether a TPM is present, its state, specification version, and manufacturer.
• The same information is available under Device security → Security processor details in Windows Security. From that screen you can go to Security processor troubleshooting → Clear TPM (covered in Section 9 — do not press it casually).⁷

8.2. Looking at It in PowerShell

If you are surveying multiple machines, PowerShell is the reliable route. The TrustedPlatformModule module has a full set of cmdlets.¹⁴

# Check the TPM state in one go (run as administrator)
Get-Tpm

The output looks like this.¹⁵

TpmPresent                : True
TpmReady                  : True
TpmEnabled                : True
TpmActivated              : True
TpmOwned                  : True
ManufacturerIdTxt         : INTC
ManufacturerVersion       : 402.1.0.0
ManagedAuthLevel          : Full
OwnerClearDisabled        : False
AutoProvisioning          : Enabled
LockedOut                 : False
LockoutHealTime           : 10 minutes
LockoutCount              : 0
LockoutMax                : 31

Here is how to read it.¹⁵

• TpmPresent: whether a TPM exists. If this is False, the problem is the hardware or the UEFI settings.
• TpmReady: whether Windows can use it. If TpmPresent is True but TpmReady is False, something went wrong during initialisation or taking ownership.
• LockedOut / LockoutCount / LockoutMax / LockoutHealTime: the state of anti-hammering. If LockedOut is True, you are temporarily locked out because of, for example, mistyped PINs.
• OwnerClearDisabled: if True, the OS cannot reset (clear) the TPM using the owner authorisation value.
• AutoProvisioning: whether automatic provisioning by Windows is enabled.

If you want to decide programmatically whether the specification version is 2.0, WMI is the convenient route.

# Retrieve the specification version, manufacturer, and enabled state
Get-CimInstance -Namespace 'root/CIMv2/Security/MicrosoftTpm' -ClassName Win32_Tpm |
    Select-Object SpecVersion, ManufacturerId, ManufacturerVersion,
                  IsEnabled_InitialValue, IsActivated_InitialValue, IsOwned_InitialValue

Watch out for ManufacturerId here. The ManufacturerIdTxt returned by Get-Tpm (a string such as INTC) is a property that only exists on Get-Tpm; it is not on the Win32_Tpm class.¹⁶ If you carelessly write Select-Object ManufacturerIdTxt, that column silently comes back empty.

What Win32_Tpm has is a uint32 ManufacturerId, which becomes a string when each byte is interpreted as an ASCII character (for example 1414548736 → 0x54 0x50 0x4D 0x00 → TPM).¹⁶ If you want the string, either decode it yourself as below or simply use Get-Tpm.

# Convert ManufacturerId (uint32) to an ASCII string and list it
Get-CimInstance -Namespace 'root/CIMv2/Security/MicrosoftTpm' -ClassName Win32_Tpm |
    Select-Object SpecVersion, ManufacturerVersion,
        @{ Name = 'ManufacturerText'; Expression = {
            $bytes = [System.BitConverter]::GetBytes([uint32]$_.ManufacturerId)
            # Read the uint32 from the high-order byte (e.g. 1229870147 -> 0x49 0x4E 0x54 0x43 -> INTC)
            if ([System.BitConverter]::IsLittleEndian) { [array]::Reverse($bytes) }
            -join ($bytes | Where-Object { $_ -ne 0 } | ForEach-Object { [char]$_ })
        } }

SpecVersion comes back in the form “specification version, revision, errata”, such as 2.0, 0, 1.16.¹⁶ Checking whether it starts with 2.0 is enough to decide whether the Windows 11 TPM requirement is met (other requirements such as CPU, memory, and storage need to be checked separately — see Section 11). For running this remotely against many machines, see “Getting Started with PowerShell Remoting (WinRM) — Managing Multiple Windows Machines at Once”.

Beyond that, Get-TpmEndorsementKeyInfo gives you information about the EK and its certificate, and Get-TpmSupportedFeature tells you whether specific features are supported. Unblock-Tpm clears a lockout, and Clear-Tpm resets the TPM.¹⁴

8.3. Looking at It with Command-Line Tools

tpmtool is the standard tool for retrieving TPM information and diagnostics.¹⁷

:: Display basic TPM information
tpmtool getdeviceinformation

:: Collect TPM logs into the current directory
tpmtool gatherlogs

To look at BitLocker state at the same time, use manage-bde -status or Get-BitLockerVolume alongside it. Investigation procedures on the event log side are covered in “Investigating Event Logs Practically with Get-WinEvent — Filtering Speed Determines Investigation Time”.

9. Real-World Trouble — Recovery Key Prompts, Clearing the TPM, and Lockouts

In the field, the TPM usually comes up when something has gone wrong. Here are the three most common cases.

9.1. You’re Asked for the BitLocker Recovery Key

This is the most common enquiry, and narrowing down the cause is in fact simple.

flowchart TD
    S["Recovery key prompt at boot"] --> Q1{"Did anything change<br/>just before?"}
    Q1 -->|"Updated the UEFI/BIOS"| A1["Measurements such as PCR 0 changed<br/>it reseals from the next boot, so<br/>unlock with the recovery key and continue"]
    Q1 -->|"Changed Secure Boot settings<br/>enabled CSM"| A2["The PCR 7 measurement changed<br/>revert the setting or unlock with the key"]
    Q1 -->|"Cleared the TPM<br/>replaced the motherboard"| A3["The sealed key itself is gone<br/>unless BitLocker was suspended first,<br/>the recovery key is the only way"]
    Q1 -->|"Booted another OS from USB<br/>changed the boot order"| A4["Boot configuration measurements changed<br/>revert and reboot"]
    Q1 -->|"No idea"| A5["Investigate, including a possible attack<br/>collect logs, then unlock with the key"]
    A1 --> R["Check where the recovery key is stored<br/>AD DS / Entra ID / Microsoft account"]
    A2 --> R
    A3 --> R
    A4 --> R
    A5 --> R

Figure 6: Narrowing down why you were asked for the BitLocker recovery key

Firmware updates are the classic trigger for recovery mode. Microsoft advises suspending BitLocker before a firmware update if you have configured a profile that includes PCR 0.⁹ Conversely, on machines where Secure Boot is correctly configured and binding is to PCR 7, the frequency of dropping into recovery after firmware updates goes down.⁹ On Modern Standby machines the PCR 7 measurement is a logo requirement, and if the TPM and Secure Boot are correctly configured, binding defaults to PCR 7 and PCR 11.⁹

The operational conclusion is simple. Always suspend BitLocker before a UEFI update, a Secure Boot configuration change, clearing the TPM, or replacing the motherboard. And before that, check where the recovery key is stored (Active Directory Domain Services, Microsoft Entra ID, or for personal machines a Microsoft account). Organisations can configure BitLocker to store recovery keys in AD DS.³

Whether you inserted a suspension makes all the difference to the effort afterwards. Suspending BitLocker leaves a clear key protector on the volume, so even if you clear the TPM or swap in a new one, the machine boots without you entering the recovery key (resuming protection after boot reseals against the new TPM). Figure 6 says “the recovery key is the only way” for the case where you cleared or replaced without suspending. Put another way, a single preparatory step avoids that branch entirely.

9.2. You Want to Clear the TPM / You Already Cleared It

Clearing the TPM causes data loss. The warning in the official documentation is unambiguous: clearing it destroys all keys created in association with the TPM, along with the data protected by those keys (virtual smart cards, sign-in PINs, and so on). For any data protected or encrypted by the TPM, make sure you have backups and a recovery path.⁷

There are three further practical cautions.⁷

• Do not clear the TPM of a device you do not own (a company or school PC) without instructions from an administrator.
• Always clear via the OS feature (tpm.msc or Windows Security), never directly from the UEFI.
• If you only want to stop the TPM temporarily, use “turn off the TPM” rather than clearing it.

After clearing, Windows automatically reinitialises the TPM and takes ownership again.⁷

What deserves emphasis here is that clearing the TPM is not data sanitisation. What is lost when you clear is the keys inside the TPM; not a single byte of the data on the disk is erased. BitLocker recovery keys are normally escrowed to AD DS, Microsoft Entra ID, or a Microsoft account, so anyone who holds one can still decrypt the volume after the TPM has been cleared.

When handing a machine to a third party, the substance of the job is a storage erasure procedure: Windows’ “Reset this PC (remove everything)”, a dedicated erasure tool, cryptographic erasure, or physical destruction. Clearing the TPM is only the finishing touch. The full disposal and transfer procedure is set out in “What to Do Before Disposing of a Windows PC — A Practical Checklist for Data Erasure, Account Unlinking, and Backups”.

There is one more surprisingly little-known trap. Some systems carry multiple TPMs that can be switched in the UEFI, but Windows does not support this configuration. Switching TPMs can leave Windows unable to detect the new one correctly, and BitLocker enters recovery mode. If you do switch, you must switch, clear, and reinstall Windows. Microsoft strongly recommends that on a system with two TPMs you pick one and never change it.⁷

9.3. The TPM Is Locked Out

Repeated mistyped PINs lock the TPM out. In the default Windows configuration, TPM 2.0 locks after 32 failed authentications and forgets one failure every 10 minutes. Even while locked, you can get out of the lockout by leaving the machine powered on for the healing interval.² Ten minutes is only the Windows default, so check the actual interval with LockoutHealTime from Get-Tpm on that machine (Section 8). Leaving it alone is sometimes faster than frantically rebooting over and over.

If you want to clear it immediately, send the lockout reset command. The TPM owner password is easy to misunderstand here. From Windows 10 version 1607 onwards, Windows does not retain the owner password when provisioning the TPM (it sets a random high-entropy value and then discards it).¹⁸ Procedures built on the assumption that “the administrator has the owner password” will stall in the field.

What is used instead is the lockout authorization. The default OSManagedAuthLevel value of 5 means, for TPM 2.0, “retain only the lockout authorization”.¹⁸ In other words, the default state is “the full owner password is gone, but the authorisation needed to clear a lockout remains”, and the lockout time reset in tpm.msc and Unblock-Tpm normally work with that authorisation. There is a setting that does retain the owner password itself (setting OSManagedAuthLevel to 4 in the registry), but Microsoft strongly recommends against it.¹⁸

Note that even without the owner password, there is still a path to management operations such as enabling, disabling, and clearing the TPM through physical presence confirmation in the UEFI.¹⁸ That is not, however, an alternative way to clear a lockout immediately and non-destructively. If the lockout authorization is unavailable, the basic approach is to wait for time-based healing (one failure every 10 minutes); clearing is a last resort that destroys every key (Section 9.2).

Note also that in configurations where you enter the authorisation value explicitly to reset, attempting a reset with the wrong value makes the TPM refuse further reset attempts for 24 hours.² Do not try values at random.

Finally, TPM 2.0 also allows keys created without an authorisation value, and those remain usable while the TPM is locked. BitLocker’s default TPM-only configuration can still boot Windows while the TPM is locked out.²

10. The TPM From a Developer’s Point of View — Platform Crypto Provider and CNG

When a requirement comes up in your own application — “tie the licence key to the device”, “use a device-specific client certificate for the connection to the server”, “make sure the secret values in the config file can only be decrypted on this machine” — the TPM is a strong option.

10.1. Use CNG, Not TBS

Windows has a low-level API called TBS (TPM Base Services). It is a system service that centrally manages TPM access across applications, provided as an RPC-based API, which cooperatively schedules TPM access based on the priority specified by the caller.¹⁹

But the TBS documentation itself says this: “The TPM can also be used for key storage, but developers are encouraged to use the key storage APIs for these scenarios. The key storage APIs provide functionality for creating keys, signing, encrypting, and persisting keys, at a higher level and easier to work with than TBS.”¹⁹ In other words, if you just want to protect a key, there is no reason to touch TBS.

What you should use is the CNG (Cryptography API: Next Generation) key storage provider “Microsoft Platform Crypto Provider”. CNG separates cryptographic providers from key storage providers, and the Platform Crypto Provider is a KSP that uses the TPM to store private keys securely and prevent them from being extracted.⁸

There are two properties the Platform Crypto Provider offers that a software-only CNG provider cannot (or cannot match).³

• Key protection: you can create keys with usage restrictions inside the TPM. The OS can load and use the key inside the TPM without copying it into system memory. It can be configured as non-exportable. A key created by the TPM exists only in that TPM, and that TPM is not a source of copies of the key.
• Anti-hammering: you can require an authorisation value such as a PIN on a key, and if there are too many guesses the TPM refuses for a period of time.

10.2. Writing It in C#

From .NET, you work with the CNG classes in System.Security.Cryptography.

using System;
using System.Security.Cryptography;

const string KeyName = "KomuraSoft.DeviceKey";

// NTE_EXISTS: "the object already exists" (a key of the same name is already there)
const int NTE_EXISTS = unchecked((int)0x8009000F);

// The key storage provider that uses the TPM
var provider = new CngProvider("Microsoft Platform Crypto Provider");

// Decide whether this is a per-user key or a per-machine key (used from a service or task).
// The creating side and the consuming side must always match — a mismatch here means
// "the key I created can't be found".
const bool UseMachineKey = false;
var openOptions = UseMachineKey ? CngKeyOpenOptions.MachineKey : CngKeyOpenOptions.None;
var creationOptions = UseMachineKey
    ? CngKeyCreationOptions.MachineKey   // creation requires administrator privileges
    : CngKeyCreationOptions.None;

CngKey OpenOrCreateKey()
{
    if (CngKey.Exists(KeyName, provider, openOptions))
    {
        // From the second run onwards, open the existing key (it is persisted in the TPM)
        return CngKey.Open(KeyName, provider, openOptions);
    }

    var creationParameters = new CngKeyCreationParameters
    {
        Provider = provider,
        KeyCreationOptions = creationOptions,
        // Never allow the private key to be taken out — this is the whole point of using the TPM
        ExportPolicy = CngExportPolicies.None,
    };
    creationParameters.Parameters.Add(
        new CngProperty("Length", BitConverter.GetBytes(2048), CngPropertyOptions.None));

    try
    {
        return CngKey.Create(CngAlgorithm.Rsa, KeyName, creationParameters);
    }
    catch (CryptographicException ex) when (ex.HResult == NTE_EXISTS)
    {
        // If another process creates a key of the same name between Exists and Create,
        // Create fails with NTE_EXISTS. Only in that case, reopen the key the winner created.
        // Any other failure (TPM unavailable, insufficient privileges, and so on) is rethrown
        // to the caller as-is.
        return CngKey.Open(KeyName, provider, openOptions);
    }
}

using (var key = OpenOrCreateKey())
using (var rsa = new RSACng(key))
{
    byte[] payload = System.Text.Encoding.UTF8.GetBytes("device-attestation-challenge");
    // The signing happens inside the TPM. The private key never appears in process memory
    byte[] signature = rsa.SignData(payload, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
}

ExportPolicy = CngExportPolicies.None is the crux. Leaving it at the default risks a configuration where the key can be exported even though you went to the trouble of using the TPM. “The key never leaves” is the reason to use a TPM at all, so specify non-exportable explicitly.

The other trap is confusing per-user keys with per-machine keys. The two-argument overloads of CngKey.Exists / CngKey.Open only look for per-user keys. If you change only the creating side to CngKeyCreationOptions.MachineKey and leave the consuming side alone, the existing machine key is not found and you get a failure mode where the code “tries to recreate a key with the same name every time and fails”. As in the code above, make sure the same scope (CngKeyCreationOptions.MachineKey and CngKeyOpenOptions.MachineKey) is used in all three places: creation, existence check, and open.

There is also a reason for factoring OpenOrCreateKey into a function with a try/catch. “Check for existence, then create” is fragile under concurrency. If two processes — for example when the app is launched twice — both see Exists == false and go on to Create, whichever creates it first wins and the loser fails with “a key of that name already exists”. It only happens at first launch, and even then only rarely, so you will almost never hit it in testing. Build in the cleanup from the start: the loser reopens the key the winner created.

However, reopening is only valid when the reason for the failure is “a key of that name already exists” (NTE_EXISTS). If you route other failures — the TPM is unavailable, privileges are insufficient — down the same path, the real cause gets replaced by a different exception from Open saying “key not found”, and the investigation goes astray. That is why the code above narrows on HResult in an exception filter.

10.3. Realities to Build Into Your Design

From what the official documentation says and from the nature of the TPM, there are several things to settle before you start implementing.

• The TPM is not fast. It is a dedicated microcontroller, or a small processor running in a protected mode of the CPU.² Key generation taking several seconds is not unusual. Do not use TPM keys directly to encrypt large volumes of data. Encrypt the data with a symmetric key such as AES, and protect that symmetric key with the TPM key — a two-tier arrangement.
• Do not run key generation or signing on the UI thread. The slowness above shows up directly as a freeze.
• Clearing the TPM destroys the keys. Assume they will be lost through repairs, motherboard replacement, or OS reinstallation, and design in a re-enrolment path (for example, a procedure for re-registering the device on the server side). A design where “if the key is gone, you’re stuck” will cause an incident in the field, guaranteed.
• Decide between per-user and per-machine. Per-user keys are tied to the profile. If you use them from a service or a scheduled task you need per-machine (CngKeyCreationOptions.MachineKey), and creation requires administrator privileges. Do not forget to pass CngKeyOpenOptions.MachineKey on the consuming side too. For thinking about where to put data, “How to Choose Where a Windows App Stores Local Data — A Decision Table for SQLite / JSON / Registry / Access” is also worth reading.
• Making it per-machine alone does not let a service account use the key. MachineKey only determines where the key store lives; who can use it is determined by the ACL (security descriptor) attached to the key. A key created by an administrator and then opened by a non-administrator service account failing with “access is denied” is a classic incident. The fix is either to create the key under the identity that will use it (the service’s account), or to set the service’s SID as allowed in the security descriptor (CNG’s Security Descr property) at creation time. Either way, always verify the behaviour under the actual execution account.
• Decide how to handle environments without a TPM. Do you reject them as a requirement, or fall back to Microsoft Software Key Storage Provider and accept “a lower level of protection”? In mixed environments, a common practice is to prefer the Platform Crypto Provider in the certificate template while also allowing software providers.³
• Think carefully about whether to put a PIN on a key. Anti-hammering is an advantage, but the TPM lockout is global. Managing failure counts per individual key is not technically practical, so too many authentication failures lock the whole TPM.² That means mistyped input in your own application can drag Windows Hello on the same machine down with it.
• Handling the credentials themselves remains a separate problem. Designing so that nothing is stored in plaintext in scripts or configuration files is covered in “Handling Credentials Safely in PowerShell — Banishing Plaintext Passwords From Your Scripts”.

11. Standard Practice (Decision Table)

12. Summary

• The TPM is a passive security processor that is both “a safe that lets a private key be used without letting it out of the chip” and “a ledger that records what was loaded at boot”.
• The static PCRs used for Measured Boot can only be advanced with Extend, and because measurement happens before execution, no component in the chain can erase its own traces. BitLocker seals its keys to those measurements (TPM 2.0 does have resettable PCRs, but they are not the ones used for sealing).
• By default under native UEFI, sealing uses PCR 0/2/4/11; where Secure Boot is available, PCR 7/11. Binding to PCR 7 makes dropping into recovery after a firmware update less likely.
• There are three implementations — discrete, integrated, and firmware — and Windows treats them all identically. Pluton is the CPU-integrated form, and its operational distinction is that its firmware can also be updated through Windows Update.
• The Windows 11 requirements are TPM 2.0 and “UEFI, Secure Boot capable” firmware. The requirement is capability, not being enabled, but enabling it has the practical benefit of binding BitLocker to PCR 7. A machine with a TPM still fails the requirement in CSM mode, so run MBR2GPT before changing the BIOS mode.
• The exception is Windows 11 IoT Enterprise, where the relaxed requirements for dedicated devices make both the TPM and Secure Boot optional. But that applies to IoT Enterprise LTSC and non-LTSC 24H2 and later; non-LTSC 21H2 through 23H2 require TPM 2.0, and Windows 11 Enterprise LTSC without IoT does not get the relaxation. Choosing to omit a TPM in the first place also means giving up BitLocker and Windows Hello protection.
• Before a firmware update, a Secure Boot configuration change, clearing the TPM, or replacing the motherboard, suspend BitLocker and confirm where the recovery key is — as a pair.
• From your own application, use CNG’s Microsoft Platform Crypto Provider rather than TBS. Specify non-exportable explicitly, and build the TPM’s slowness and the loss of keys on clear into your design.

Related Articles

• A Realistic Answer After Windows 10 End of Support — A Decision Table for ESU, LTSC, and Replacement
• Which Windows Should Go on an Industrial PC? — A Practical Guide to Windows IoT Enterprise / LTSC
• What to Do Before Disposing of a Windows PC — A Practical Checklist for Data Erasure, Account Unlinking, and Backups
• Getting Started with PowerShell Remoting (WinRM) — Managing Multiple Windows Machines at Once
• Investigating Event Logs Practically with Get-WinEvent — Filtering Speed Determines Investigation Time
• Handling Credentials Safely in PowerShell — Banishing Plaintext Passwords From Your Scripts
• How to Choose Where a Windows App Stores Local Data — A Decision Table for SQLite / JSON / Registry / Access

Related Consulting Areas

KomuraSoft LLC handles inventories of hardware requirements for Windows 11 migration, consulting on BitLocker operational design, and contract development of Windows business applications including device-specific key management using the TPM.

• Windows Application Development
• Bug Investigation & Root-Cause Analysis
• Legacy Asset Reuse & Migration Support
• Contact Us

References

Related Articles

Recent articles sharing the same tags. Deepen your understanding with closely related topics.

Related Topics

These topic pages place the article in a broader service and decision context.

Where This Topic Connects

This article connects naturally to the following service pages.

Frequently Asked Questions

Common questions about the topic of this article.

What does the TPM actually do?

In a phrase, it is a small safe that lets you use a private key without ever letting the key out. A private key created inside the TPM can, depending on configuration, never leave the chip at all. Applications and the OS do not receive the key itself; they ask the TPM to "sign this data" or "decrypt with this key" and receive only the result. On top of that, the hashes of the firmware and boot loader that were loaded at startup are accumulated and recorded into an area called the PCRs, and a key can be "sealed" so that it can only be released when those values are what you expected. That mechanism is exactly why BitLocker cannot be unlocked once the innards of the PC have been swapped out.

Why did Windows 11 make TPM 2.0 mandatory?

Because BitLocker, Windows Hello, Credential Guard, and device health attestation are all designed around a hardware-rooted anchor of trust. TPM 1.2 could only use RSA and SHA-1, and its lockout behaviour varied from vendor to vendor, whereas TPM 2.0 supports newer algorithms and Windows configures anti-hammering consistently. Note that TPM 2.0 does not work in legacy BIOS compatibility mode (CSM), so a native UEFI configuration is a prerequisite. The exception is Windows 11 IoT Enterprise: for IoT Enterprise LTSC and for non-LTSC 24H2 and later, both the TPM and Secure Boot are optional (on non-LTSC 21H2 through 23H2, TPM 2.0 is still required; the similarly named Windows 11 Enterprise LTSC, without IoT, does not get the relaxed requirements).

What is the difference between dTPM, fTPM, and Pluton? Which should I choose?

They differ in how they are implemented. A dTPM (discrete TPM) is a dedicated chip on the motherboard; an fTPM (firmware TPM) is a software implementation running in the CPU's trusted execution environment; and Pluton is a Microsoft-designed security processor integrated into the CPU. From Windows' point of view they are all used the same way, and Microsoft explicitly states that it takes no position on which implementation you should choose. The practical differences are that a discrete chip has a bus between it and the CPU which can become a target for physical attack; an fTPM's behaviour depends on CPU firmware updates; and Pluton's firmware can be updated through Windows Update. If you can choose at procurement time, the realistic criteria for business machines are the vendor's support policy and how reliably it ships firmware updates.

I updated the BIOS and was asked for the BitLocker recovery key. Why?

The BitLocker key is sealed to the boot-time measurements (PCRs), so when the things being measured change, the key is not released and you enter recovery. A firmware update is precisely an operation that changes measurements such as PCR 0. Microsoft itself advises suspending BitLocker before a firmware update when the profile includes PCR 0. Once you unlock with the recovery key, the key is resealed against the new measurements, so it will not happen again for the same reason. Operationally, always suspend BitLocker before a UEFI update, a Secure Boot configuration change, clearing the TPM, or replacing the motherboard — and check first where the recovery key is stored (Active Directory, Microsoft Entra ID, or a Microsoft account).

How do I protect keys with the TPM from my own application?

Rather than issuing TPM commands directly, you use the CNG (Cryptography API: Next Generation) key storage provider named "Microsoft Platform Crypto Provider". In .NET, simply passing that provider and ExportPolicies.None to CngKey.Create creates the private key inside the TPM in a state where it cannot be taken out. The low-level TPM Base Services (TBS) are also public, but Microsoft itself recommends using the higher-level key storage APIs for key storage, signing, and encryption. In implementation terms, build into your design the facts that TPM operations are slow, that clearing the TPM destroys the keys, and that you need a decision about how to fall back on machines without a TPM.

Author Profile

Profile page for the article author.

Go Komura

Representative of KomuraSoft LLC

Focused on Windows software development, technical consulting, and investigations into failures that are difficult to reproduce.