What Is the TPM in Windows? — An Illustrated Guide to the "Safe That Never Lets Keys Out" and Measured Boot

“We cannot move to Windows 11.” “After a BIOS update we were asked for the BitLocker recovery key.” “We do not want the application’s private key to be taken off the machine.” These look like separate questions, but every one of them falls into place once you understand what the TPM is for.

The TPM is a processor dedicated to security that generates, stores, and governs the use of cryptographic keys. It is not a part that makes encryption faster, and it is not a part that stops viruses on its own. This article first shows how to check the state and how to respond when something goes wrong, and then explains how key protection and Measured Boot work.¹

1. The short answer: separate the TPM’s two jobs

The first one, “the key never leaves,” means that the non-exportable private key itself is never handed over. The second one, “releasing a key,” means that a sealed secret is made usable only when the conditions match. Once you separate computing with a key from unsealing a key, the diagrams later in the article become easier to read.²³

The measured boot state is also used to attest health. That, however, is a different operation from sealing and releasing keys. The TPM produces a report (a quote) signed over the current measurements, and a service and the MDM evaluate its contents. Section 8.3 covers this in detail.³

The PCRs are a record that accumulates hashes of the code and settings loaded during boot. Because BitLocker binds its key to that record, a change in firmware or boot configuration can cause it to ask for the recovery key. Clearing the TPM or replacing the motherboard, by contrast, is a problem not because the measurements changed but because the keys of the original TPM can no longer be used.⁴⁵

Before you change any TPM setting, confirm where the recovery key is and how you would recover. Clearing the TPM is not a routine inspection step; it is an operation that can destroy keys and the data they protect. Chapter 3 collects the procedure, including suspending BitLocker and resuming protection after the change.⁵

In the diagram a solid line marks a relation that always holds and a dashed line marks a conditional one (the conditions are given per relation on the detail page). The full list of relations (34 in total, with evidence and certainty) and the definitions of the main concepts are collected on the knowledge map detail page (in Japanese). Data: JSON-LD / Turtle

2. Check the state first: separate presence, readiness, and specification version

What you want to know is three things: whether a TPM is present, whether Windows can use it, and whether the specification version is 2.0. Keep looking at the state separate from changing settings or clearing the device. The first thing to internalize is that Windows 10 and 11 initialize the TPM and take ownership automatically. You therefore normally have no reason to touch settings in the TPM management console (tpm.msc), and Microsoft states that in most cases you should avoid configuring the TPM there. The exceptions are situations involving resetting the PC or a clean installation.¹ Incidentally, active development of the TPM management console ended with Windows Server 2019 and Windows 10 version 1809.¹

2.1. Looking at it in the GUI

• Win + R → tpm.msc opens the TPM management console. It shows whether a TPM is present, its state, its specification version, and its manufacturer. The screen is split into a Status area (whether it is in a usable state) and a TPM Manufacturer Information area (manufacturer name, manufacturer version, and specification version), and whether the specification version is 2.0 is what decides the Windows 11 TPM requirement. On a machine with no TPM, or with the TPM disabled, the console reports that no compatible TPM can be found (section 2.4 gives the order in which to check in that case).
• Windows Security shows the same information under Device security → Security processor details. From that screen you can go to Security processor troubleshooting → Clear TPM (chapter 3 covers this, but it is not a button to press lightly).⁵

2.2. Looking at it in PowerShell

For more than a handful of machines, PowerShell is the reliable route. The TrustedPlatformModule module has a full set of cmdlets.⁶

# Check the TPM state in one place (run as administrator)
Get-Tpm

The output looks like this.⁷

TpmPresent                : True
TpmReady                  : True
TpmEnabled                : True
TpmActivated              : True
TpmOwned                  : True
ManufacturerIdTxt         : INTC
ManufacturerVersion       : 402.1.0.0
ManagedAuthLevel          : Full
OwnerClearDisabled        : False
AutoProvisioning          : Enabled
LockedOut                 : False
LockoutHealTime           : 10 minutes
LockoutCount              : 0
LockoutMax                : 31

Do not assume the values in the sample output are your own machine’s settings; read the following items instead.⁷

If you want to decide mechanically whether the specification version is 2.0, WMI is the convenient route.

# Get the specification version, manufacturer, and enabled state
Get-CimInstance -Namespace 'root/CIMv2/Security/MicrosoftTpm' -ClassName Win32_Tpm |
    Select-Object SpecVersion, ManufacturerId, ManufacturerVersion,
                  IsEnabled_InitialValue, IsActivated_InitialValue, IsOwned_InitialValue

The property to watch out for here is ManufacturerId. The ManufacturerIdTxt that Get-Tpm returns (a string such as INTC) exists only on the Get-Tpm side; the Win32_Tpm class does not have it.⁸ If you carelessly write Select-Object ManufacturerIdTxt, that column silently comes back empty.

What Win32_Tpm has is ManufacturerId, a uint32 whose bytes form a string when interpreted as ASCII characters (for example 1414548736 → 0x54 0x50 0x4D 0x00 → TPM).⁸ If you want the string, either decode it yourself as below or simply use Get-Tpm.

# Convert ManufacturerId (uint32) to an ASCII string and list it
Get-CimInstance -Namespace 'root/CIMv2/Security/MicrosoftTpm' -ClassName Win32_Tpm |
    Select-Object SpecVersion, ManufacturerVersion,
        @{ Name = 'ManufacturerText'; Expression = {
            $bytes = [System.BitConverter]::GetBytes([uint32]$_.ManufacturerId)
            # Read the uint32 from the most significant byte (e.g. 1229870147 -> 0x49 0x4E 0x54 0x43 -> INTC)
            if ([System.BitConverter]::IsLittleEndian) { [array]::Reverse($bytes) }
            -join ($bytes | Where-Object { $_ -ne 0 } | ForEach-Object { [char]$_ })
        } }

SpecVersion comes back in the form “specification version, revision, errata,” such as 2.0, 0, 1.16.⁸ Whether it starts with 2.0 is what you use to decide whether the Windows 11 TPM requirement is met (the other requirements, such as CPU, memory, and storage, have to be checked separately; see chapter 11). For running this against many machines remotely, see “Getting started with PowerShell Remoting (WinRM)”.

Beyond that, Get-TpmEndorsementKeyInfo shows information about the EK and its certificate, and Get-TpmSupportedFeature shows whether a particular feature is supported. Unblock-Tpm clears a lockout, and Clear-Tpm resets the TPM.⁶

2.3. Looking at it with command-line tools

tpmtool is the standard tool for retrieving TPM information and diagnosing it.⁹

:: Display basic TPM information
tpmtool getdeviceinformation

:: Gather TPM logs into the current directory
tpmtool gatherlogs

To look at this together with the BitLocker state, use manage-bde -status or Get-BitLockerVolume alongside it. The procedure for investigating on the event log side is collected in “Investigating event logs in practice with Get-WinEvent”.

2.4. The order to check when “it should be TPM 2.0 but it does not work”

First separate the cases using TpmPresent and TpmReady from Get-Tpm, then check the specification version and the lockout state. Do not proceed to clearing the TPM merely because it “cannot be found.”

Here is what to look for in the UEFI settings. On many models the firmware TPM is disabled by default, and enabling it is all you need.

• The name of the item differs by vendor. On Intel platforms it is usually labeled PTT (Platform Trust Technology) and on AMD platforms fTPM (AMD fTPM, AMD CPU fTPM, and so on), so on some models the word TPM never appears on the screen at all. Do not conclude “there is no TPM item, so the machine does not have one.”
• It usually lives under Security or Advanced. It can also sit under headings such as Trusted Computing or PCH-FW Configuration.
• Some models have a setting that switches between a discrete chip (dTPM) and the firmware TPM. That case is exactly the “switching between multiple TPMs sends BitLocker into recovery mode” situation in section 3.2, so once you have chosen, do not change it.⁵
• Check whether legacy/CSM mode is enabled. TPM 2.0 does not work in CSM mode. When that is the cause, you need MBR2GPT before switching to UEFI (chapter 4).¹⁰
• Before you change TPM settings in the UEFI, confirm where the recovery key is and suspend BitLocker. This changes the premises of the measurements, so treat it exactly like the cause-and-effect table at the start of chapter 3. Make it part of the preparation before the change, not of the cleanup afterward.

3. Handling trouble: separate the recovery key, clearing the TPM, and lockouts

The recovery key prompt, clearing the TPM, and a PIN lockout are different problems. Do not make “I was asked for the recovery key, so I will clear the TPM” your order of operations. Clearing destroys keys, and it belongs in a different category from routinely checking the state or recovering from a lockout.

If you are about to make a change, first confirm where the recovery key is stored and suspend BitLocker. This applies to UEFI updates, Secure Boot configuration changes, clearing the TPM, and replacing the motherboard. The storage location is Active Directory Domain Services or Microsoft Entra ID for an organization, or a Microsoft account for an individual. An organization can configure the recovery keys to be stored in AD DS.³

If the recovery key prompt is already on screen, work out the cause from the change that immediately preceded it. The PCRs are a record of the boot state. “The record changed” and “the key sealed by the original TPM is unusable” are different causes, so read the following table with that distinction in mind.⁴¹¹⁵

The top five rows are cases where the measurements, or the boot stage that requests the key, do not match the conditions. The bottom row is the case where the key bound to the original TPM is unusable. For recovery mode caused by an ordinary change, you either restore the configuration or unlock with the recovery key. In the bottom row, if you did not suspend beforehand and you do not have the recovery key, there is no recovery. The row about an attacker releasing the key describes a design-level defense, not a recovery procedure.

Moving the OS disk belongs in the bottom row because the sealed key lives inside the original PC’s TPM. Putting the disk into another PC does not bring the key along. Even if you only intend to swap the disk, in practice it amounts to the same thing as replacing the motherboard. If a move is planned, suspend BitLocker before the work or have the recovery key at hand.

3.1. You were asked for the BitLocker recovery key

Check the most recent change and decide whether you can put the setting back or whether you need to unlock with the recovery key. If you cannot account for any change, investigate with the possibility of an attack in mind, and unlock after collecting logs.

flowchart TD
    S["The recovery key prompt appeared at boot"] --> Q1{"Did you change anything just before?"}
    Q1 -->|"Updated the UEFI/BIOS"| A1["Measurements such as PCR 0 changed<br/>It is resealed from the next boot on, so<br/>unlock with the recovery key and carry on"]
    Q1 -->|"Changed Secure Boot settings<br/>Enabled CSM"| A2["The PCR 7 measurement changed<br/>Put the setting back or unlock with the recovery key"]
    Q1 -->|"Cleared the TPM<br/>Replaced the motherboard"| A3["The sealed key itself is gone<br/>If BitLocker was not suspended beforehand<br/>the recovery key is the only way"]
    Q1 -->|"Booted another OS from USB<br/>Changed the boot order"| A4["The boot configuration measurement changed<br/>Put it back and restart"]
    Q1 -->|"Nothing comes to mind"| A5["Investigate, including the possibility of an attack<br/>Collect logs, then unlock with the recovery key"]
    A1 --> R["Confirm where the recovery key is stored<br/>AD DS / Entra ID / Microsoft account"]
    A2 --> R
    A3 --> R
    A4 --> R
    A5 --> R

Figure 1: Triaging a BitLocker recovery key prompt

A firmware update is the classic trigger for recovery mode. Microsoft itself advises suspending BitLocker before a firmware update when the configured profile includes PCR 0.⁴ Put the other way round, on machines where Secure Boot is correctly configured and the key is bound to PCR 7, firmware updates drop into recovery mode less often.⁴ On Modern Standby capable machines the PCR 7 measurement is a logo requirement, and when the TPM and Secure Boot are correctly configured the key is bound by default to PCR 7 and PCR 11.⁴

Whether you put a suspension in front of the work changes the effort afterward completely. Suspending BitLocker leaves a clear key protector on the volume, so even if you clear the TPM or move to a new TPM, the machine boots without you entering the recovery key (resuming protection after boot reseals the key against the new TPM). Figure 1 says “the recovery key is the only way” for the case where you cleared or replaced without suspending. Put the other way round, a single preparatory step removes that branch entirely.

3.2. You want to clear the TPM, or you already did

Clearing the TPM causes data loss. The warning in the official documentation is explicit. Clearing destroys every key created in association with the TPM, along with the data those keys protect (virtual smart cards, sign-in PINs, and so on). For any data the TPM protects or encrypts, make sure you have a backup and a way to recover.⁵

Even when clearing is necessary, follow these conditions.⁵

• Do not clear the TPM of a machine you do not own (a work or school PC) without direction from its administrator.
• Always clear from an OS feature (tpm.msc or Windows Security), never directly from the UEFI.
• If you only want to stop the TPM temporarily, use “turn off the TPM” rather than clearing it.

After a clear, Windows automatically re-initializes the TPM and takes ownership again.⁵

Clearing the TPM and erasing the disk at disposal are different jobs

What deserves emphasis here is that clearing the TPM is not data erasure (sanitization). What a clear destroys are the keys inside the TPM; not a single byte of the data on the disk is erased. BitLocker recovery keys are normally escrowed to AD DS, Microsoft Entra ID, or a Microsoft account, so anyone who holds one can still decrypt the volume after you have cleared the TPM.

When you hand a machine to a third party, the main event is a storage erasure procedure: Windows’ “Reset this PC (remove everything),” a dedicated erasure tool, cryptographic erasure, or physical destruction. Clearing the TPM is no more than the finishing touch. The whole procedure for disposal and transfer is collected in “Checklist for disposing of or transferring a Windows PC”.

Do not casually switch between multiple TPMs

Some systems carry more than one TPM and let you switch between them in the UEFI, but Windows does not support that configuration. After a switch Windows may fail to detect the new TPM correctly, and BitLocker enters recovery mode. If you do switch, you have to clear the TPM afterward and reinstall Windows. Microsoft strongly recommends that on a system with two TPMs you pick one and never change it.⁵

3.3. The TPM is locked out

Repeated mistyping of the PIN locks the TPM out. In the default Windows configuration, TPM 2.0 locks after 32 failed authorization attempts and forgets one failure every 10 minutes. Even while it is locked, you can get out of the lockout by leaving the machine powered on for the healing interval.² Ten minutes is only the Windows default, so check the actual interval in the LockoutHealTime that Get-Tpm returns on that machine (chapter 2). Leaving it alone is sometimes faster than restarting over and over in a panic.

If you need to clear it immediately, send the lockout reset command. Note, however, that the owner password and the lockout authorization are not the same thing. Since Windows 10 version 1607, Windows does not retain the owner password when it provisions the TPM (it sets a random high-entropy value and then discards it).¹² A procedure built on the assumption that “the administrator has the owner password” will stall in the field.

What gets used instead is the lockout authorization. The default value 5 of OSManagedAuthLevel means, for TPM 2.0, “retain only the lockout authorization.”¹² In other words, the default state is “the full owner password is gone, but the authorization needed to clear a lockout remains,” and the lockout time reset in tpm.msc and Unblock-Tpm normally work with that authorization. There is a setting that keeps the owner password itself (setting OSManagedAuthLevel to 4 in the registry), but Microsoft strongly discourages it.¹²

Note also that even without the owner password, a route remains for management operations such as enabling, disabling, and clearing the TPM through physical presence confirmation in the UEFI.¹² That is not, however, an alternative way to clear a lockout immediately and non-destructively. When the lockout authorization is unavailable, the basic answer is to wait for recovery over time (one failure every 10 minutes), and clearing is the last resort that destroys every key (section 3.2).

Note as well that in configurations where you explicitly enter the authorization value to reset, if you try a reset with the wrong value, the TPM will not allow another reset attempt for 24 hours.² Do not try values at random.

Note finally that TPM 2.0 also allows keys created without an authorization value, and those remain usable while the TPM is locked. BitLocker’s default TPM-only configuration can boot Windows even when the TPM is locked.²

4. The Windows 11 requirements: separate TPM 2.0 from the UEFI and IoT conditions

4.1. What is different between TPM 1.2 and 2.0

If you work with older PCs you still run into TPM 1.2. The gap between the two is more than “the version went up.”¹⁰

SHA-1 is what bites hardest. NIST required most federal agencies to move to SHA-256 as of 2014, and Microsoft and Google dropped support for SHA-1-based signatures and certificates in 2017. Because the TPM 1.2 specification can only use SHA-1, it cannot follow that shift.¹⁰

4.2. “Secure Boot capable” and “Secure Boot enabled” are different

The minimum requirements for Windows 11 on general-purpose PCs are a 64-bit CPU on the compatibility list, 4 GB of memory, 64 GB of storage, graphics compatible with DirectX 12 or later with a WDDM 2.0 driver, a display larger than 9 inches at 720p or better with 8 bits per color channel, system firmware that is “UEFI, Secure Boot capable”, and TPM 2.0.¹³

Read that precisely. What the minimum requirement asks for is that the system be capable of Secure Boot, not that it be enabled.¹³ The requirement itself is satisfied even while it is disabled, so there is no need to touch UEFI settings just to move to Windows 11. That said, if you enable Secure Boot and the platform also meets the conditions for binding to PCR 7, BitLocker binds to PCR 7 and drops into recovery mode less often (chapter 7). Enabling it does not automatically produce that result, so check which PCRs the volume is actually bound to with the PCR validation profile in manage-bde -protectors -get C:. Enabling it for that practical benefit, rather than because it is a requirement, is the correct way to frame it.

4.3. Moving from legacy/CSM to UEFI is not just a settings change

Another point that is easily missed is that TPM 2.0 is not supported on a BIOS in legacy mode or CSM (Compatibility Support Module) mode. A device with TPM 2.0 has to have its BIOS mode configured as “native UEFI only,” and the legacy/CSM options have to be disabled.¹⁰

That creates an awkward situation in practice, because an OS installed in legacy mode stops booting once you change the BIOS mode to UEFI. Before changing the BIOS mode, you have to use the MBR2GPT tool to bring the OS and the disk into a UEFI-capable state.¹⁰ A machine that “has a TPM but still cannot be upgraded to Windows 11” is quite often in exactly this state. The overall picture for deciding how to move off Windows 10 is collected in “The realistic options after Windows 10 end of support — a decision table for ESU, LTSC, and replacement”.

Note also that for Device Health Attestation, what Windows supports is TPM 2.0, and a device with a legacy BIOS will not behave as expected even if it carries a TPM 2.0.¹

4.4. The IoT Enterprise exception: decide by edition and version

Everything above about “Windows 11 requires TPM 2.0” concerns the editions for general-purpose PCs. Windows 11 IoT Enterprise has a separately defined, relaxed set of minimum requirements for dedicated devices, and on IoT Enterprise LTSC (and on non-LTSC 24H2 and later) both the TPM and Secure Boot are Optional.¹⁴ On industrial PCs and embedded equipment, knowing this is what flips the conclusion “this board cannot run Windows 11.”

The official requirements table has two columns: PREFERRED and OPTIONAL (the minimum for dedicated devices).¹⁴

There are three things to watch.

• This is not “LTSC means no TPM needed.” The relaxed requirements are defined for IoT Enterprise, and Windows 11 Enterprise LTSC (without IoT) is treated the same as the general-purpose editions. The names are similar enough to be confused, but which license you procure changes the conclusion.
• Non-LTSC IoT Enterprise differs by version. In the OPTIONAL requirements for 21H2 through 23H2, TPM 2.0 is still required (only Secure Boot is optional), and the TPM becomes optional only from 24H2 onward.¹⁴
• Processor requirements are defined separately. Even where the TPM and Secure Boot are optional, the list of supported processors is defined elsewhere, so be sure to check it.¹⁴

Microsoft itself also cautions about what choosing the relaxed requirements means. The gist is that lowering the requirements on a device where end users can add software later deserves careful consideration, and that not providing a TPM can affect the software end users need.¹⁴ Without a TPM, BitLocker cannot seal its key to the boot state, and Windows Hello’s keys fall back to software protection. Switch your reasoning from “we fit it to meet a requirement” to “we fit it to obtain the protection this device needs.”

The overall picture of how to choose between IoT Enterprise and LTSC and how to procure licenses is collected in “Which Windows belongs on an industrial PC? — a practical guide to Windows IoT Enterprise and LTSC”.

5. Key protection: never hand over the private key, return only the result

5.1. How is this different from software key protection?

Start by imagining a world without a TPM. If you try to protect a private key in software alone, the key eventually becomes plaintext in memory at some point, because the CPU has to read the key value in order to compute a signature or a decryption. In other words, it cannot in principle be hidden from malware that has reached the kernel, or from an attacker who can physically read memory. The official documentation says as much: software-based key protection is “subject to reverse-engineering attacks that analyze how the key is stored in memory while in use and how copies of it are made.”³

When you create a non-exportable private key in the TPM, there is no need to load the key into the process and compute there. The application or the OS asks the TPM to “sign this” or “decrypt this” and receives only the result. It is a mechanism that separates receiving a private key from using it.³

flowchart TB
    subgraph SW["A. Protecting a key in software alone"]
        A1["Application / OS"] -->|"Loads the key and computes"| A2["The private key in memory<br/>There is a moment when it is plaintext"]
        A2 -.->|"Can be read out"| A3["Malware that has reached the kernel<br/>Memory analysis, physical attack"]
    end
    subgraph HW["B. Entrusting the key to the TPM"]
        B1["Application / OS"] -->|"Sends only a request to<br/>sign or to decrypt"| B2["TPM"]
        B2 --> B3["Computes with the private key inside the TPM<br/>The key never leaves the chip"]
        B3 -->|"Returns only the result"| B4["The application / OS receives only<br/>the signature or the decrypted result"]
        B5["Malware that has reached the kernel<br/>Memory analysis, physical attack"] -.->|"The key itself cannot be extracted"| B2
    end
    SW ~~~ HW

Figure 2: The difference between protecting a key in software alone and entrusting it to the TPM

5.2. The TPM itself does not watch for viruses

The important point here is that the TPM is passive. It does not monitor anything on its own initiative and it does not stop viruses. It is a part that receives commands and returns responses, nothing more.¹⁰ That is precisely why drawing value out of a TPM requires the OEM (the PC vendor) to integrate hardware and firmware carefully, and why Windows builds its features on top of that integration.

5.3. Limit PIN guessing attempts on the TPM side

The other pillar is anti-hammering. A key the TPM protects can have an authorization value such as a PIN attached to it. When guesses at the authorization value fail a certain number of times, the TPM refuses further attempts and locks out. For TPM 2.0, Windows configures this behavior. Specifically, it locks out after 32 failed authorization attempts and forgets one failure every 10 minutes. After 320 minutes with no failures at all, the remembered failure count returns to zero.²

The fact that “the attempt limit lives in hardware” is what makes this work. If you count failures in software, the count can be defeated by restarting the machine, rolling the system clock back, or rolling back the file that records the count. With the TPM, none of that is possible.³ This is precisely the basis for saying that a four-digit Windows Hello PIN is safer than a password.

6. The internal roles: proving identity, protecting keys, recording the boot

You do not have to memorize all the acronyms at once. Read them by role instead: EK and AIK prove identity, the SRK protects keys, the PCRs record the boot, and NVRAM is non-volatile storage. Look at the whole picture in the diagram first, then read about each relationship.

flowchart TB
    TPM["TPM 2.0"]
    TPM --> EK["EK / endorsement key<br/>Derived from a seed set at manufacturing<br/>Comes with a manufacturer certificate"]
    TPM --> SRK["SRK / storage root key<br/>The parent key that wraps other keys"]
    TPM --> PCR["PCR 0-23<br/>Accumulate the boot measurements"]
    TPM --> NV["NVRAM<br/>A small area that survives power loss"]
    EK --> AIK["AIK / attestation identity key<br/>The ID shown outside in place of the EK"]
    SRK --> K1["BitLocker's key"]
    SRK --> K2["Windows Hello's key"]
    SRK --> K3["A certificate's private key"]
    PCR -.->|"Constrain it to be released<br/>only at these values"| K1

Figure 3: The TPM’s main components and the parent-child relationships among keys

6.1. EK and AIK: proving it is a genuine TPM while avoiding device tracking

The EK (Endorsement Key) is an asymmetric key pair unique to that TPM. The private half is held inside the TPM and is never disclosed to, or accessible from, the outside.² It comes with an EK certificate signed by the manufacturer, which shows that “this key really is inside a TPM we manufactured.” That is how you can tell a genuine TPM from malware pretending to be one.³

Aside: a TPM 2.0 EK is not a “burned-in key” but a “key derived from a seed”

Microsoft’s documentation describes the EK as an RSA key pair,² but that wording dates back to the TPM 1.2 era. The immutable secret written into a TPM 2.0 chip at manufacturing time is, strictly speaking, a seed called the endorsement primary seed, and the EK is derived from that seed by a fixed procedure (a template). Deriving from the same seed always yields the same key, so even though the EK can be recreated, it remains in effect a key unique to that TPM. Both RSA and ECC EKs can be derived, and it is not unusual for a real machine to have both. This is not needed to follow the main thread, so feel free to skip it.

Showing the EK directly to the outside world, however, would uniquely identify the PC and create a privacy problem. Real scenarios therefore use an AIK (Attestation Identity Key). A certificate authority uses the EK and its certificate to prove that “this AIK exists inside a genuine TPM” and issues an AIK certificate. Because you can use a different AIK for each relying party, multiple verifiers cannot collude to track the same machine.³

6.2. The SRK: encrypted keys can also live on external storage

The SRK (Storage Root Key) is the parent key used to wrap other keys. The TPM can encrypt a key it created and emit it, and that key can only be decrypted by that same TPM. This operation is called wrapping, or binding.² In other words, there is no need to store every key in the small amount of memory inside the TPM. By placing encrypted keys on external storage and using them only on the original TPM, you can handle a large number of keys. “The private key cannot be extracted” and “encrypted key data can be saved outside” are not in conflict.

6.3. PCRs and NVRAM: the boot record and non-volatile storage

The PCRs (Platform Configuration Registers) are special registers that accumulate boot-time measurements. There are 24 of them, numbered 0 through 23, and what each one measures is defined.⁴ The important property is that you cannot write an arbitrary value directly; the value can only be advanced with an operation called Extend. Extend is a one-way operation that concatenates the current value with the new measurement, hashes the result, and makes that the new value, so “erasing just the inconvenient part of the record along the way” is impossible in principle. The values reset on reboot.³

TPM 2.0 does also have PCRs with a resettable attribute (for DRTM and application use). The PCRs BitLocker seals to, however (0, 2, 4, 7, and 11), are static Measured Boot PCRs and cannot be reset before a reboot. This article’s explanation assumes those.

NVRAM is a small non-volatile area used to hold things such as certificates. TPM 2.0 improves on TPM 1.2 in algorithms, crypto, hierarchies, root keys, authorization, and NVRAM.¹⁰

7. Measured Boot: record the hashes, release the key in the expected boot state

Even if you can store a key safely, you also need a condition of use in order to “stop another OS from using that key.” BitLocker creates that condition by sealing the key to the Measured Boot record. Below, the explanation follows the order hash computation → recording into the PCRs → releasing the key.³

7.1. What does “measuring” actually mean here?

Before going further, let us make the word “measurement” concrete. Measuring here is not measuring a physical quantity such as weight or temperature. It means computing a hash over the entire byte sequence of the program or configuration data that is about to be executed. A hash is a fixed-length value, like a fingerprint of the content, with the following properties.

• The same content always yields the same value, whoever computes it and whenever
• If the content differs by even one byte, the value is completely different
• Recovering the original content from the value is effectively impossible

For example, computed with the SHA-256 hash, abc becomes

ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

and abd, which differs only in the last character, becomes

a52d159f262b2c6ddb724a61840befc36eb30c88877a4030b65cbe86298449c9

A one-character difference changes the value entirely, and comparing the two values leaves not even a hint that the contents were similar. You can compute the SHA-256 of any file with PowerShell’s Get-FileHash, so you can get a feel for this “fingerprint” on your own machine.

In short, “the boot measurements” are the hashes of the firmware, the boot loader, and the settings involved in the boot process. If every measurement matches the previous boot, you can state with confidence that the software and configuration involved in booting were exactly the same as last time. Conversely, if the boot loader has been tampered with, or the machine was booted from a different OS, the corresponding measurement is guaranteed to change. That is the foundation of Measured Boot.

7.2. The chain of measurements — measure what you load before you run it

The mechanism is simple. Inside the system firmware there is an unconditionally trusted starting point called the CRTM (Core Root of Trust for Measurement). The CRTM unconditionally hashes the next software component to be executed and records that measurement into the TPM. Every component after that repeats the same thing — you measure what you load before you run it. Because the measurement is sent before execution, a component cannot erase its own measurement from the TPM.³

sequenceDiagram
    autonumber
    participant FW as UEFI firmware CRTM
    participant BM as Windows boot manager
    participant OS as Windows kernel
    participant T as TPM

    FW->>T: Extend the hash of the code to be executed next
    Note over T: PCR 0 / 2 / 4 / 7 are updated
    FW->>BM: Hand over control
    BM->>T: Ask for the sealed BitLocker key to be released
    alt The PCRs hold the same values as at sealing time
        T-->>BM: Return the key
        BM->>BM: Decrypt the OS volume
        BM->>T: Extend the kernel, ELAM, and boot drivers
        Note over BM,T: Measure before executing, then hand over control
        BM->>OS: Hand over control and start Windows
    else The PCRs hold different values
        T-->>BM: Do not return the key
        BM->>BM: Go to the recovery key entry screen
    end

Figure 4: The flow of Measured Boot and the release of the BitLocker key

The diagram shows the kernel being measured after decryption because, per the principle of Measured Boot, what you load is measured before it runs. The Windows boot loader verifies the kernel’s digital signature before loading it, and the kernel in turn verifies the boot drivers, the startup files, and ELAM, forming a chain.¹⁵ If the kernel measured itself after starting, the measurement could simply be skipped, which would defeat the purpose.

BitLocker creates, inside the TPM, a key that can only be used when these measurements have the expected values. The expected values are computed for the point at which the Windows boot manager runs from the OS volume on the system disk. If the machine is booted from a different OS, or the configuration is changed, the measurements inside the TPM change, the TPM does not permit use of the key, and the encrypted OS volume cannot be decrypted.³

7.3. The PCRs BitLocker uses: 0, 2, 4, and 11 versus 7 and 11

So which PCRs are actually being watched? The default platform validation profile for native UEFI configurations is as follows.⁴

By default, PCR 0, 2, 4, and 11 are the sealing targets. When the Secure Boot state (PCR 7) is supported, however, sealing uses PCR 7 and PCR 11 instead.⁴ That is an important difference. PCR 0/2/4 are hashes of the firmware and boot manager images themselves, so their values change every time the firmware is updated, which drops the machine into recovery mode. PCR 7, by contrast, measures “whether Secure Boot is on and which keys are trusted,” so as long as the signer is the same, the value does not change when an image is updated. Microsoft explains, too, that binding to PCR 7 reduces the chance of entering recovery mode because of a firmware or image update.⁴

7.4. PCR 11: do not let a key be requested later than the boot manager

PCR 11 also restricts which boot stage may request a key, even when the same machine’s TPM is used. The scenario it addresses is an attacker who leaves the victim’s machine as it is (keeping the hardware and firmware) and replaces only the OS disk with one of their own. Because the key is sealed to the original TPM, changing the whole machine would be pointless; the point is to keep using the victim’s TPM. The attacker extracts the sealed BitLocker key blob from the metadata of the victim’s OS partition, boots an OS under their own control, calls the TPM API, and tries to unseal that key blob.

This does not work because Windows seals the key with the value of PCR 11 set to 0, and the boot manager always changes PCR 11 to 1 when it hands control to the next boot loader, legitimate or not. By the time the attacker’s OS is running, the boot manager has already relinquished control and PCR 11 is certainly no longer 0. Therefore, even on the same machine with the same TPM, a key cannot be requested from a stage later than the boot manager.¹¹

Secure Boot itself is also part of BitLocker’s defense. By default BitLocker uses Secure Boot’s integrity protection through the PCR 7 measurement, preventing unauthorized EFI firmware, EFI boot applications, and boot loaders from starting and obtaining BitLocker’s key.¹¹

8. How Windows uses it: BitLocker, Hello, and health attestation compared

Each Windows feature uses a different property of the TPM. BitLocker is about releasing a key according to the boot state, Hello is about authentication with a device-specific key, and health attestation is about reporting the measurements. Look at the whole set of uses first, then read about the feature you need.

flowchart LR
    TPM["TPM 2.0"]
    TPM --> BL["BitLocker / device encryption<br/>Seals the key to the boot state"]
    TPM --> WH["Windows Hello<br/>Protects the key tied to a PIN or biometrics<br/>Anti-hammering keeps a short PIN safe"]
    TPM --> CG["Credential Guard<br/>Protects the isolated environment's key with measurements"]
    TPM --> MB["Measured Boot / remote attestation<br/>Issues a quote signed over the boot state"]
    TPM --> HA["Device Health Attestation<br/>Input for MDM conditional access decisions"]
    TPM --> PCP["Platform Crypto Provider<br/>Makes a certificate's private key non-exportable"]

Figure 5: The main Windows security features built on the TPM

8.1. BitLocker and device encryption

BitLocker and device encryption. As covered in chapter 7. There are four unlock methods — TPM only, TPM + PIN, TPM + startup key, and TPM + PIN + startup key — and TPM only is described as the most convenient and, correspondingly, less secure than the methods that require an additional authentication factor.¹¹

Note that the prerequisites for device encryption (the mechanism that enables BitLocker automatically) have changed in the past few years. It used to require meeting the Modern Standby or HSTI requirements and having no DMA-capable external ports, but from Windows 11 version 24H2 those prerequisites were removed and more machines are now in scope.¹⁶ The claim in older write-ups that “it only works on Modern Standby capable machines” does not hold from 24H2 onward. You can check whether a given machine is in scope under “Device Encryption Support” in msinfo32.exe (System Information).¹⁶

8.2. Windows Hello and Credential Guard

Windows Hello and Windows Hello for Business. These authenticate by combining a key provisioned per device with a PIN or biometrics. If a TPM is present the TPM protects the key; if not, it is protected in software. Biometric data is used on that machine only to gain access to the provisioned key, and is not shared between machines.³ On a machine with a TPM the key cannot be copied elsewhere, which gives you the property that even if credentials leak, they cannot be used on another machine.

Credential Guard. This feature performs credential hashing in an isolated memory region that the kernel cannot access. That isolated region is initialized and protected during the boot process, and Credential Guard uses the TPM to protect its key with the measurements. The key is accessible only at the stage of the boot process where the isolated region is initialized, and cannot be used from the normal kernel.³

8.3. Health attestation, certificates, and virtual smart cards

Measured Boot and remote attestation. Using an AIK, the TPM can produce a statement (a quote) cryptographically signed over the current state of the measurements. Sending it to a remote party proves “which software and configuration the machine booted with and initialized the OS under.”³ Because measurement stops at the initial state of Windows, it contains no privacy-sensitive information such as which applications you use.³

Device Health Attestation. Microsoft’s health attestation service issues AIK certificates for TPMs from multiple vendors, analyzes the Measured Boot information, and converts it into simple statements such as “is BitLocker on,” “is Secure Boot on,” and “is DEP enabled.” An MDM such as Intune can then use those statements, rather than parsing a complex quote itself, to quarantine a machine or cut off its access to cloud services.¹³

Platform Crypto Provider. This protects a certificate’s private key with the TPM. A certificate template can specify “use the TPM’s Platform Crypto Provider,” and the private key of a certificate configured as non-exportable cannot be taken out of the TPM. For a certificate that requires a PIN, the TPM’s anti-hammering applies automatically.³ This is the entry point to the developer’s view covered in chapter 10.

Virtual smart cards. This feature makes the TPM behave like “a smart card that is always inserted,” removing the cost of buying and distributing physical cards and readers.³ Microsoft now recommends, however, that users of virtual smart cards move to Windows Hello for Business or FIDO2 security keys.² It survives as an existing asset, but it is not the direction to choose for a new design.

9. Implementations and procurement: comparing dTPM, integrated TPM, fTPM, and Pluton

9.1. Do not turn implementation differences into a simple ranking of protection

Because the phrase “TPM chip” has caught on, people tend to assume a TPM must be a separate component, but there are three implementation forms.¹⁰

flowchart LR
    C1["CPU"] ---|"LPC / SPI bus"| T1["A dedicated TPM chip<br/>= discrete, dTPM"]
    C2["The CPU / chipset<br/>package"] --> T2["Dedicated hardware in the same package<br/>logically separated<br/>= integrated"]
    C3["General-purpose CPU"] --> T3["Runs on a trusted execution environment, TEE<br/>a firmware implementation<br/>= firmware, fTPM"]
    C4["SoC"] --> T4["A Microsoft-designed<br/>security processor<br/>= Pluton"]

Figure 6: The three TPM implementation forms, and Pluton as their extension

• A discrete TPM (dTPM) is a dedicated chip in its own semiconductor package. It is mounted on the motherboard, and it has the advantage that the OEM can evaluate and certify it separately from the system itself.¹⁰
• An integrated TPM sits in the same package as other components while being implemented as logically separated, dedicated hardware.¹⁰
• A firmware TPM (fTPM) runs the TPM as firmware in the trusted execution environment (TEE) of a general-purpose execution unit.¹⁰ It suits small, low-power devices where a dedicated chip is not practical.

Windows uses any compatible TPM the same way. Microsoft takes no position on which implementation form a TPM should use, saying that a broad ecosystem serves every need.¹⁰ In other words, an fTPM is not a second-class TPM.

9.2. Pluton: CPU integration and the firmware update path

Microsoft Pluton takes the integrated form one step further. It is a secure cryptographic processor designed by Microsoft, manufactured by silicon partners, and built into the CPU, designed to provide TPM functionality while also providing security features beyond the scope of the TPM 2.0 specification.¹⁷ As of 2026, Pluton is available on Windows 11 machines with the following chipsets.¹⁷

• AMD: Ryzen 6000 / 7000 / 8000 / 9000 series, Ryzen AI series
• Intel: Core Ultra 200V series, Core Ultra Series 3 and Series 3 processors
• Qualcomm: Snapdragon 8cx Gen 3, Snapdragon X series

Operationally, Pluton’s distinguishing characteristic is that it has two firmware update paths. Besides the traditional UEFI capsule update of the firmware on the motherboard’s SPI flash, new Pluton firmware can be loaded dynamically through OS updates. At system boot it is initialized with the firmware on the SPI flash, and during Windows startup the latest version obtained through Windows Update (if any) is loaded.¹⁷ When a TPM firmware vulnerability turns up, the possibility of a fix shipping without waiting for the PC vendor’s BIOS update is a welcome property in practice.

At procurement time, do not decide that “a dedicated chip is better” or “an fTPM is inferior”; check the vendor’s support policy and how reliably it ships firmware updates. Make your criterion not the implementation form but whether the device can be updated for as long as you will keep using it.

10. For developers: protect keys with CNG, and design for reuse, permissions, and recovery

When a requirement comes up in your own application — “we want to tie the license key to the machine,” “we want to use a machine-specific client certificate for the connection to the server,” “we want the secret values in the configuration file to be decryptable only on this machine” — the TPM is a strong option.

10.1. Use CNG, not TBS

Windows offers TBS (TPM Base Services) as a low-level API. It is a system service that centrally manages TPM access across applications, provided as an API over RPC, and it cooperatively schedules TPM access based on the priority the caller specifies.¹⁸

If your goal is to store, sign with, encrypt with, and persist keys, Microsoft recommends the higher-level key storage APIs over TBS. Separate “I want to operate the TPM directly” from “I want to protect my application’s keys”; for the latter, go through CNG.¹⁸

What you should use is the CNG (Cryptography API: Next Generation) key storage provider named “Microsoft Platform Crypto Provider”. CNG separates cryptographic providers from key storage providers, and the Platform Crypto Provider is a KSP that uses the TPM to store private keys securely and keep them from being extracted.¹⁹

The Platform Crypto Provider offers two properties that a software-only CNG provider cannot provide (or cannot provide to the same degree).³

• Key protection: it can create a key with usage restrictions inside the TPM. The OS can load and use the key inside the TPM without copying it into system memory. It can be configured as non-exportable. A key the TPM created exists only in that TPM, and that TPM never becomes a source of copies of the key.
• Anti-hammering: a key can require an authorization value such as a PIN, and if there are too many guesses the TPM refuses for a period of time.

10.2. A minimal example, and a practical one that reopens an existing key

From .NET you work with this through the CNG classes in System.Security.Cryptography. First, the minimal form that creates a key inside the TPM and makes it non-exportable is this short (.NET 8 / Windows).

using System.Security.Cryptography;

var parameters = new CngKeyCreationParameters
{
    // The key storage provider that uses the TPM
    Provider = new CngProvider("Microsoft Platform Crypto Provider"),
    // Do not allow the private key to be exported at all
    ExportPolicy = CngExportPolicies.None,
};

using var key = CngKey.Create(CngAlgorithm.Rsa, "KomuraSoft.DeviceKey", parameters);
using var rsa = new RSACng(key);

With that, the private key is created inside the TPM and never appears in the process’s memory. In production, however, you also have to handle “open the existing key from the second run on,” “per-user or per-machine,” and “races between concurrent starts.” The following code builds those in.

using System;
using System.Security.Cryptography;

const string KeyName = "KomuraSoft.DeviceKey";

// NTE_EXISTS: "the object already exists" (a key with the same name is already there)
const int NTE_EXISTS = unchecked((int)0x8009000F);

// The key storage provider that uses the TPM
var provider = new CngProvider("Microsoft Platform Crypto Provider");

// Decide between a per-user key and a per-machine key (used from a service or a task).
// The creating side and the consuming side must always agree - a mismatch here
// turns into "the key I created cannot be found".
const bool UseMachineKey = false;
var openOptions = UseMachineKey ? CngKeyOpenOptions.MachineKey : CngKeyOpenOptions.None;
var creationOptions = UseMachineKey
    ? CngKeyCreationOptions.MachineKey   // creation requires administrator rights
    : CngKeyCreationOptions.None;

CngKey OpenOrCreateKey()
{
    if (CngKey.Exists(KeyName, provider, openOptions))
    {
        // From the second run on, open the existing key (it is persisted in the TPM)
        return CngKey.Open(KeyName, provider, openOptions);
    }

    var creationParameters = new CngKeyCreationParameters
    {
        Provider = provider,
        KeyCreationOptions = creationOptions,
        // Do not allow the private key to be exported at all - this is the whole point of using the TPM
        ExportPolicy = CngExportPolicies.None,
    };
    creationParameters.Parameters.Add(
        new CngProperty("Length", BitConverter.GetBytes(2048), CngPropertyOptions.None));

    try
    {
        return CngKey.Create(CngAlgorithm.Rsa, KeyName, creationParameters);
    }
    catch (CryptographicException ex) when (ex.HResult == NTE_EXISTS)
    {
        // If another process creates a key with the same name between Exists and Create,
        // Create fails with NTE_EXISTS. Only in that case, reopen the key the winner created.
        // Any other failure (TPM unavailable, insufficient rights, and so on) is rethrown to the caller.
        return CngKey.Open(KeyName, provider, openOptions);
    }
}

using (var key = OpenOrCreateKey())
using (var rsa = new RSACng(key))
{
    byte[] payload = System.Text.Encoding.UTF8.GetBytes("device-attestation-challenge");
    // The signing happens inside the TPM. The private key never appears in process memory
    byte[] signature = rsa.SignData(payload, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
}

10.3. Three key points in the code: no export, scope, and race handling

ExportPolicy = CngExportPolicies.None is the crux. Leave it at the default and you can end up with a configuration where the key can be taken out despite your having used the TPM. “The key never leaves” is the reason to use a TPM, so specify non-exportable explicitly.

The other pitfall is mixing up per-user keys and per-machine keys. The two-argument overloads of CngKey.Exists and CngKey.Open only look for per-user keys. If you change only the creating side to CngKeyCreationOptions.MachineKey and leave the consuming side alone, the existing machine key is not found and you get the failure mode where the code “tries to recreate the key under the same name every time and fails.” As in the code above, line up the same scope in all three places — creation, existence check, and open (CngKeyCreationOptions.MachineKey and CngKeyOpenOptions.MachineKey).

There is also a reason for factoring OpenOrCreateKey out into a function and putting a try/catch in it: “check that it exists, then create it” is weak against races. If two processes — say, from a double launch of the application — both see Exists == false and then proceed to Create, the one that creates it first wins and the loser fails with “a key with the same name already exists.” It only happens at first start and even then only rarely, so tests will almost never hit it. Build in the cleanup from the beginning: the loser reopens the key the winner created.

Reopening is only appropriate, however, when the reason for the failure is “a key with the same name already exists” (NTE_EXISTS). If you route other failures, such as the TPM being unavailable or insufficient rights, down the same path, the real cause is replaced by a different exception from Open saying “the key cannot be found,” and the investigation wanders. That is why the code above narrows on HResult in an exception filter.

10.4. Operational design: speed, key loss, ACLs, and machines without a TPM

Working code is not the whole of running it in production. In particular, where a key is stored and which account is allowed to use it are two different things. Decide on speed and which thread runs the work, on re-enrollment after a repair, on access rights, and on how to treat machines without a TPM.

• The TPM is not fast. It is a dedicated microcontroller, or a small processor running in a protected mode of the CPU.² Key generation taking several seconds is not unusual. Never use a TPM key directly to encrypt large amounts of data. Encrypt the data with a symmetric key such as AES and protect that symmetric key with the TPM key, in two stages.
• Do not run key generation or signing on the UI thread. The slowness above shows up directly as a freeze.
• Clearing the TPM destroys the keys. Assume they will be lost to a repair, a motherboard replacement, or an OS reinstall, and design a re-enrollment path (a procedure for re-registering the device on the server side, for example). A design where “if the key is gone you are stuck” will break in the field without fail.
• Decide between per-user and per-machine. A per-user key is tied to the profile. If a service or a scheduled task will use it, you need a per-machine key (CngKeyCreationOptions.MachineKey), and creating one requires administrator rights. Do not forget to pass CngKeyOpenOptions.MachineKey on the consuming side as well. For how to think about where data belongs, “Choosing where a Windows application stores its data” is also worth reading.
• Making a key per-machine does not by itself let a service’s account use it. MachineKey decides only where the key store is; who may use the key is decided by the ACL (the security descriptor) attached to the key. A classic breakage is an administrator creating the key and a non-administrator service account failing to open it with “access is denied.” The fix is either to create the key under the identity that will use it (the service’s account) or to grant the service’s SID in the security descriptor (CNG’s Security Descr property) at creation time. Either way, always verify it under the actual runtime account.
• Decide how to handle environments without a TPM. Do you reject them as a requirement, or fall back to Microsoft Software Key Storage Provider and accept the reduced level of protection? In mixed environments, a real-world approach is to have the certificate template prefer the Platform Crypto Provider while still permitting the software provider.³
• Think carefully about whether to attach a PIN to a key. Anti-hammering is an advantage, but the TPM lockout is global. Managing a failure count per individual key is not technically practical, so too many authorization failures lock the whole TPM.² That means a typo in your own application can take out Windows Hello on the same machine.
• Handling the credentials themselves remains a separate problem. How to design so that nothing is stored in plaintext in scripts or configuration files is collected in “Handling credentials safely in PowerShell”.

11. Standard practice (decision table)

12. Summary

The starting point for understanding the TPM is the distinction between letting a private key be used without handing it over and making the boot measurements a condition for using a key. The TPM is a passive part, and the OS and firmware are what use its functions. In Measured Boot, things are measured before they run, and the static PCRs BitLocker uses cannot have their record rolled back before a reboot.³¹⁰

When checking state, separate the TPM’s presence, its readiness, and its specification version. Do not conclude that TPM 2.0 alone makes a machine eligible for Windows 11; check the UEFI, the CPU, and the rest as well. The minimum requirement for Secure Boot is capability, which is not the same as having it enabled. A configuration that meets the conditions for binding to PCR 7 has the benefit of fewer BitLocker recoveries caused by firmware updates.¹³⁴

Keep Windows 11 for general-purpose PCs and the relaxed IoT Enterprise requirements separate in your head. The TPM is optional on IoT Enterprise LTSC and on non-LTSC 24H2 and later; non-LTSC 21H2 through 23H2, and Enterprise LTSC without IoT, are not treated the same. Do not rank implementation forms by name alone; choose on the protection you need and on how updates and support are supplied.¹⁴¹⁰

In operations, make confirming the recovery key and suspending BitLocker before the change, and resuming protection after it, one continuous procedure. Clearing the TPM is not disk erasure. In development, use CNG’s Platform Crypto Provider and design not only for non-exportability but also for key scope, ACLs, creation races, and re-enrollment after loss.⁵¹⁸¹⁹

Related articles

• The realistic options after Windows 10 end of support — a decision table for ESU, LTSC, and replacement
• Which Windows belongs on an industrial PC? — a practical guide to Windows IoT Enterprise and LTSC
• Checklist for disposing of or transferring a Windows PC
• Getting started with PowerShell Remoting (WinRM) — managing many Windows machines at once
• Investigating event logs in practice with Get-WinEvent — how fast you can filter decides how long the investigation takes
• Handling credentials safely in PowerShell — getting plaintext passwords out of your scripts
• Choosing where a Windows application stores its data

Related consulting areas

KomuraSoft LLC handles reviews of the hardware requirements that come with a Windows 11 migration, consulting on BitLocker operations, and Windows Custom Software Development for business applications, including machine-specific key management with the TPM.

• Windows application development
• Bug investigation and root cause analysis
• Legacy asset reuse and migration support
• Contact

References

Related Articles

Recent articles sharing the same tags. Deepen your understanding with closely related topics.

Related Topics

These topic pages place the article in a broader service and decision context.

Where This Topic Connects

This article connects naturally to the following service pages.

Frequently Asked Questions

Common questions about the topic of this article.

What does the TPM actually do?

In a phrase, it is a small safe that lets you use a private key without ever letting the key out. A private key created inside the TPM can, depending on configuration, never leave the chip at all. Applications and the OS do not receive the key itself; they ask the TPM to "sign this data" or "decrypt with this key" and receive only the result. On top of that, the hashes of the firmware and boot loader that were loaded at startup are accumulated and recorded into an area called the PCRs, and a key can be sealed so that it can only be released when those values are what you expected. That mechanism is exactly why BitLocker cannot be unlocked once the innards of the PC have been swapped out.

Why did Windows 11 make TPM 2.0 mandatory?

Because BitLocker, Windows Hello, Credential Guard, and device health attestation are all designed around a hardware-rooted anchor of trust. TPM 1.2 could only use RSA and SHA-1, and its lockout behavior varied from vendor to vendor, whereas TPM 2.0 supports newer algorithms and Windows configures anti-hammering consistently. Note that TPM 2.0 does not work in legacy BIOS compatibility mode (CSM), so a native UEFI configuration is a prerequisite. The exception is Windows 11 IoT Enterprise: for IoT Enterprise LTSC and for non-LTSC 24H2 and later, both the TPM and Secure Boot are optional (on non-LTSC 21H2 through 23H2, TPM 2.0 is still required, and the similarly named Windows 11 Enterprise LTSC, without IoT, does not get the relaxed requirements).

What is the difference between dTPM, fTPM, and Pluton? Which should I choose?

They differ in how they are implemented. A dTPM (discrete TPM) is a dedicated chip on the motherboard, an fTPM (firmware TPM) is a software implementation running in the CPU's trusted execution environment, and Pluton is a Microsoft-designed security processor integrated into the CPU. From Windows' point of view they are all used the same way, and Microsoft explicitly states that it takes no position on which implementation you should choose. The practical differences are that a discrete chip has a bus between it and the CPU that can become a target for physical attack, that an fTPM's behavior depends on CPU firmware updates, and that Pluton's firmware can be updated through Windows Update. If you can choose at procurement time, the realistic criteria for business machines are the vendor's support policy and how reliably it ships firmware updates.

I updated the BIOS and was asked for the BitLocker recovery key. Why?

The BitLocker key is sealed to the boot-time measurements (PCRs), so when what is measured changes, the key is not released and the machine enters recovery mode. A firmware update is precisely an operation that changes measurements such as PCR 0. Microsoft itself advises suspending BitLocker before a firmware update when the profile includes PCR 0. Once you unlock with the recovery key, the key is resealed against the new measurements, so the same thing will not happen again. Operationally, always suspend BitLocker before a UEFI update, a Secure Boot configuration change, clearing the TPM, or replacing the motherboard, and check first where the recovery key is stored (Active Directory, Microsoft Entra ID, or a Microsoft account).

How do I protect keys with the TPM from my own application?

Rather than issuing TPM commands directly, you use the CNG (Cryptography API: Next Generation) key storage provider named "Microsoft Platform Crypto Provider". In .NET, simply passing that provider and ExportPolicies.None to CngKey.Create creates the private key inside the TPM in a state where it cannot be taken out. The low-level TPM Base Services (TBS) are also public, but Microsoft itself recommends the higher-level key storage APIs for storing keys, signing, and encrypting. In implementation terms, build into your design the facts that TPM operations are slow, that clearing the TPM destroys the keys, and that you need a decision about how to fall back on machines without a TPM.

Author Profile

Profile page for the article author.

Go Komura

Representative of KomuraSoft LLC

Focused on Windows software development, technical consulting, and investigations into failures that are difficult to reproduce.