Preparing for Insider Preview Builds of Windows 11 - ***UPDATED 6/28***

Thanks for that indepth explanation. You connected a few dots for me that I hadn't connected since my hobby enthusiasm dropped significantly just before win10 came out and I hadn't really spent much time trying to connect those dots. 🙄

Unfortunately my Fujitsu t936 has an unsupported core i5 6200u which is disappointing because I'm certain that it's superior to some of the approved processors and has 16gig ram + a 512gig Samsung ssd. Its 6 yrs old I think and still runs better than many new laptops I've had to deal with. Hopefully they loosen up the specs a bit because I can't imagine that it wouldn't run well. I really wasn't planning to replace this thing for another year or so. With the rotating screen, high res display, fingerprint scanner, built in 4g, Backlit keyboard, dual digitizer, and general ruggedization it's gonna be expensive to replace. (it doesn't feel or look rugged but I've dropped it down a flight of stairs, drove off with it on top of my car, and let it slide off a roof where I was installing a ubiquiti access point and it never even flinched!)

In short, it's gonna cost me $2k to have a Win11 machine....

Intel PTT includes a TPM, inside the CPU itself.

Still you may need to use an external TPM (connected on the header) for example it is provided preconfigured by your organization with its own endorsement keys created by their certificates and their own private key, without needing the organization to access to your PC. That external TPM may be later reused on another PC, after jioning the new PC to their domain.

As well TPM modules may fail and could be locked permanently, as you cannot replace easily the CPU at low cost, it is just simpler to plug an external TPM on the header (external TPMs can store a verification chain allowing to assert online that it was not stolen, so that it can be untrusted and blacklisted by its legitime author, if this TPM module was stolen or lost, just like you can blacklist permanently a smartphone or PC that was stolen, or its CPU if that CPU contained the TPM).

TPM modules also exist on other devices, such as USB keys, network adapters. Which one will be used (of you have several one) should be configurable with the BIOS or could change depending on the OS you load from UEFI if your PC is multiboot and each OS is tuned for different organizations. Windows can support multiple TPM modules on the same machine, and will jsut use one that it can endorse as ready for use.

But most PCs only have one TPM for simple configuration.

If you don't have any TPM module connected, and you have disabled Intel PTT, you have no TPM available for Windows. You could enable both and you'd have to configure Windows to use and configure the correct TPM.

Technically a TPM is just used to assert that you are the correct owner of the system. There are different ways to provide this, with the same level of protection. Intel PTT is one of these systems that offers this protection strength.

Unfortunately, the new UEFI firmware bootloader in Windows 11 no longer detects all TPM2 modules that were recignized in Windows 10. as well it still does not recognize the Intel vPro processors (11th generation) such as Intel® Core™ vPro® i7-1185G7...

That fixed it, I now have Windows 11, thanks

John