Preparing for Insider Preview Builds of Windows 11 - ***UPDATED 6/28***

Windows 11 requirement : TPM

Some ASUS motherboards (Like Rampage series) have a socket for TPM but do not display at PTT option nor the Advanced > PCH-FW Config option in bios to turn on PTT. Understand that installing a TPM module would turn on the TPM on these boards but until then there seems to be no fallback option other than having the TPM module (do not see newer bios from Asus to fix this). Therefore no PTT either.

What about Bitlocker to Go ! Is it still available for Windows Pro and Server users ?

Will it Qualify as a TPM equivalent ?

Will PC Checker pass the equipment if this is installed ?

I think I have the same problem

Well, it doesn't settle for me. Download, when installing a window appears that says that I should review these points, but nothing comes out, I give it to install and it does nothing, in the end I have to cancel and it keeps telling me to update... ¬¬

"Un-allowed DMA capable bus/device(s) detected"

And of course, this message should explicit which device was detected (if we can unplug it, or disable it at boot time, notably if it is not at all necessary for booting Windows.

I think this is related to "DDA" specifications (for dynamic allocation of PCI resources using an IOMMU, such as Intel VT-d, that must NOT be disabled in UEFI BIOS parameters)

Another blocking factor is "Secure MOR" (unexplained by Microsoft: I found that it means that the UEFI BIOS must implement a hardware protection for its firmware, so that it will be protected during boot (including when plugging in a JTAG: windows should not boot, and a new firmware assessment must be provided and certified by a certificate, signed by an endorsed PKI and the Microsoft HQLabs, otherwise the BIOS will be considered "unsafe"). This now blocks HVCI in Windows 11 (not in windows 10 where it was possible to have endorsed exceptions, notably for some BIOS updates made by manufacturers to solve compatibility with some models of CPU or memory banks, or fix energy and performance monitoring settings: this should NOT be blocking anyone if your CPU is not made for being overaccelerated and the CPU already implements hardware limitations of frequencies, and monitors temperature, voltages, and other regulators).

Note also that CPUs can also include updated microfirmwares (made by Intel, AMD, or Qualcomm) to implement mitigations: these microfirmwares are normally integrated in Windows, but some UEFI BIOS will preload these into the CPU.

As Windows wants to get full control of the CPU and all buses, if the BIOS properly hands up the lock and surrenders the property to the Microsoft UEFI preboot loader (shipped with the Windows installer), it's up to Microsoft to implement this and perform the necessary check.

"HSTI" is another limiting factor for the same reason: some *UEFI-COMPLIANT* are NOT required to implement the HSTI tests, if they surrender everything to the UEFI boot loader (e.g. when the BIOS was configured to use UEFI *without* CSM support, and all unnecesary devices (not needed for booting) have been disabled, and all others were correctly configured to use UEFI drivers, and not any legacy BIOS interface.

Unfortunately, the Windows pre-boot loader ("\EFI\Microsoft\bootloaderfw.efi" in the UEFI partition) makes false assumptions. It expects the UEFI BIOS to do all the job itself, and then provide an assessment (which may be unsafe as it is based only on limited tests made by the motherboard manufacturer just to get the Microsoft WHQL label, that it got successfully even for Windows 10; and there is still no other WHQL test for Windows 11: the WHQL label is fake and not a warranty, and customers are NOT informed and are left with no choice): this is Microsoft's fault, not making the correct assessments certifications, and then Microsoft using FALSE assumptions in its boot loaders for windows or in its FAKE compatibility checker (based only on purely administrative declarations) and not enforcing the rule for manufacturers to pass again the certification when they create BIOS updates.

In some cases, you'll have to revert the BIOS version to using one that had the correct certification (but expect then that some BIOS settings for performances will no longer work or will crash or "burn" your system, if you do not use the "BIOS defaults" (notably for CPU/GPU/memory timings, voltage and frequency regulation), or your newer CPU model that became usable on your system will no longer work with that BIOS, or you'll need to change your memory banks to those compatible with the older BIOS version.

If your BIOS was WHQL certified, it should include an HSTI assesment... but this has not always been the case: there's an HSTI declaration, but it is empty! And no normal user have any way to know it (and for many users, it is too late: the manufacturer has stopped servicing their motherboard since too long): this is a real hidden defect (normally not eligible to time limitation, but manufacturers don't care about it: they are in China and bypass the European or American laws, or reject their fault to the seller or importer, that were not informed either of the defect and have NO access to these tricky details).

And we are back to Microsoft's fault! For failing to provide hardware assesment tools that can be freely used by any customer, and in correct time before the manufacturer stops its support (this happens very soon, sometimes they've stopped their support since many months before you bought your new system, due to import delays or the long time these systems were left in harbours, cargos, or distribution supplies: sometimes more than one year). And Chinese manufacturers don't care: they will sell everything they still have in their depots, even if this hardware is no logner supported by them.

Law for consumer protection is abused, and Microsoft does not give any help to end users who don't know what they buy, and that will not work even if the hardware had a WHQL certification (which actually did not test all the requirements and settings).

Now Windows 11 is very extreme: it just says our machines are not compatible, but without saying why: consumers cannot report the issue to a manufacturer, that reject the fault to the consumers or the importers and sellers (which may now be inaccessible; notably for purchases on the web). Go to any real shop: they will also not let you run any compatibility check on their device: you have to trust what their partial specs say (and often don't say), showing only the sticker showing "designed for Windows N" and a licence label (and there are tons of fake labels, including in the most reputable and wellknown distributors and brands, except possibly DELL if you buy directly from them...)

So please Microsoft: develop a really informative hardware assesment tool that every customer (and resellers) can use, providing detailed logs of causes (missing features, incorrect default settings that may be changed...) and that can perform REAL checks, and not just looking at some declarative statements reported in UEFI data, notably when these declarations were NOT even mandatory to get the logo (Microsoft constantly changes the requirements over time, silently: it just made it a few days ago, including for windows XP, 7, Vista, 8, 8.1 and 10.0, whose online documentation was silently and destructively edited to match the new requiremens for Windows 10; this is a LIE and breach of support contract; the WHQL certification is just FAKE when Microsoft can change the rules at any time, even for existing supported systems)

Final Note: if your system currently has no TPM, it should be possible to connect one at low cost, and support it at boot time with a UEFI program to install on the system. It should work if your BIOS is UEFI compliant (and almost all of them ARE compliant, even if they don't implement all the new checks or new methods to plug and recognize a TPM in the preboot environment).

Note as well that this UEFI program support (ar preboot time, before even choosing which OS to boot from and before enumerating devices configurable in the UEFI BIOS) can also be implemented by Microsoft itself, in its "bootloaderfw.efi" installed with Windows. But it has no role after the OS is booting (using "bootloader.efi" in the second phase): at that time, the Windows boot will shutdown the UEFI services, and will use its own drivers, and tools like "tpm.msc": the UEFI surrenders and abandons the full control to Windows, exept for very limited devices (notably security devices implemented in the UEFI BIOS, such as "Intel TXT", supported by Intel and that should be trusted by Microsoft in Windows)

Note: even if your Windows is booting in UEFI secure mode, you may need to configure other settings in the BIOS:

* use the WHQL UEFI mode for Windows 8/10, not the legacy mode

* enable the NX protection (even if the UEFI BIOS may forget to report it in the HSTI assessment, its presence and effectiveness can be tested easily by the Windows boot loader, and then Windows can protect it itself)

* disable CSM support in EUFI mode

* disable legacy devices (such as option roms): configure them to use their UEFI ROM only, notably graphic cards, network adapters, storage and RAID devices, unless these devices provide an HSTI asssesment (that Microsoft should detect in its Windows loader).

* enable hardware virtualization

* enable the IOMMU (named "VD-d" with Intel motherboard)

* enable Intel security

* disable multimedia boot support (e.g. to switch on with a custom media player running only in UEFI or BIOS without any OS, e.g. to play a DVD)

* disable online services (that could wake up your PC remotely): real working systems like this are not reliable except on very costly servers used in datacenters.

* disable any device that is not plugged (unused PCI express or SATA slots, or legacy PS/2 mouse/keyboard when you have only USB inputs)

* check that your GPU firmware is updated (use its drive update tool: it should not only update the Windows driver but also its UEFI firmware if needed).

* disable the "onboard" display device (notably GPU integrated in old CPU) if you have a better graphics installed on a PCI slot, use it. In some cases, it will be the reverse: remove the extra GPU installed on the PCI device, as it may not have the necessary firmware support for secure boot, that the GPU embedded in the CPU has: you'll need to install another more modern graphics board later.

* configure the TPM device to use SHA2, not SHA1, if it supports both (but the Windows 11 bootloader has a BUG: it may still attempt to use SHA1, even if it does not support it, and if the TPM was properly configured to use SHA2). The UEFI BIOS may provide hardware assessments in PCR11 in BOTH channels (which one will be used is then dependant of the OS you'll choose to boot with): Windows 11 is inconsistant then reports a "missing" TPM2 module at boot time even if it was present (and correctly reported!), jsut because Windows 11 jut uses the first algorithm found (generally TPM1.2 before TPM2, the UEFI BIOS does not allow to hide TPM1.2 support, even when booting in UEFI WHQL Secure boot mode: this allowed to boot Windows 7/8/8.1 or Windows Server and even Windows 10, but no longer Windows 11) !!!

However this does not mean that Windows 11 will say your device is compatible: the last FALSE assumptions are those about the processor family (and here you generally cannot do anything as replacement implies changing the motherboard, the CPU, the memory, and this is costly!)

Sometimes, it is just enough to "restore BIOS defaults" in the UEFI BIOS settings, but some defaults may not be correct for windows if they disable the TPM, or IOMMU, or enable legacy BIOS boot.

Sometimes you'll need to revert some BIOS updates to a supported version (ignoring some betas that were not necessary for your configuration, such as specific processor or RAM models in specific markets: some of these are "tweaks" made for specific situations, never tested for Windows operation and certification).

But in some case, you'll need the last version that is the only one to support TPM2 (the last supported version was made for TPM1.2 and was fully compliant with Windows 8/8.1/10 to get the WHQL-certified label!)

I don't understand why Microsoft insists on TPM2, TPM 1.2 should still be enough !