Interactive Troubleshooter

Published: Sep 28, 2026

TPM Not Detected for Windows 11 Upgrade: BIOS Enable

Time: 15 mins Level: Beginner

By StepDiag Engineering Team

Reviewed by Ibraheem Taofeeq Opeyemi

Systematically resolve TPM 2.0 detection errors during Windows 11 setup. This tree diagnoses firmware fTPM/PTT settings, PPI locks, corrupted endorsement keys, and missing TBS drivers.

Full Diagnostic Tree & Step-by-Step Overview

How is the TPM missing error reported during the Windows 11 upgrade assessment?

PC Health Check or Windows 11 Setup states 'TPM 2.0 must be supported and enabled on this PC'.
tpm.msc displays 'Compatible TPM cannot be found', but the hardware supports modern CPU architectures.
TPM is listed in Device Manager with a yellow exclamation mark (Code 10 or Code 14 error).
TPM is detected as version 1.2 instead of version 2.0 required by Windows 11 requirements.

What is the CPU architecture and motherboard platform type of the target system?

AMD Ryzen platform (AM4/AM5) where fTPM is disabled or unconfigured in firmware.
Intel Core platform (8th Gen or newer) where Platform Trust Technology (PTT) is disabled.
Custom desktop motherboard where Security Device Support or ACPI TPM tables are disabled.
Legacy CSM / MBR boot mode is active, suppressing UEFI TPM 2.0 ACPI table visibility.

AMD Firmware TPM (fTPM) Disabled in UEFI

Solution:

Root Cause: Disabled fTPM Module in AMD PSP Firmware

AMD processors integrate a firmware-based TPM within the AMD Platform Security Processor (PSP). When motherboard firmware defaults to Discrete TPM (dTPM) without a physical module installed, the ACPI tables omit TPM device declarations, causing Windows 11 checks to fail.

# Diagnostic Verification:

1. Open PowerShell (Admin) and run:

powershell
   Get-Tpm

2. Check if TpmPresent evaluates to False.

# Step-by-Step Fix:

1. Enter UEFI Setup:

Reboot and press Del or F2 during POST.

2. Enable fTPM:

Navigate to Advanced > AMD fTPM Configuration (or CPU Configuration).

Change TPM Device Selection from Discrete TPM to Firmware TPM or Enable AMD fTPM.

3. Save and Reboot:

Press F10 to save changes and restart.

# Prevention & Long-Term Monitoring:

Re-check fTPM settings after applying motherboard AGESA BIOS updates.

Intel Platform Trust Technology (PTT) Disabled in UEFI

Solution:

Root Cause: Disabled Intel PTT Engine in Management Engine (ME)

Intel systems use Platform Trust Technology (PTT) embedded in the Intel ME/CSME firmware to provide TPM 2.0 functionality. If PTT is disabled, the OS cannot detect a hardware security interface.

# Diagnostic Verification:

1. Open Command Prompt (Admin) and run:

cmd
   wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get IsEnabled_InitialValue

2. The query returns no instances found.

# Step-by-Step Fix:

1. Enter UEFI Setup:

Restart the PC and press F2 or Del during startup.

2. Enable Intel PTT:

Go to Security or Advanced > PCH-FW Configuration.

Set PTT or Intel PTT to Enabled.

3. Save and Exit:

Press F10 to save configuration and restart into Windows.

# Prevention & Long-Term Monitoring:

Keep Intel Management Engine (ME) firmware updated via vendor system packages.

ACPI Security Device Support Blocked in UEFI Firmware Settings

Solution:

Root Cause: Disabled Security Device Support Flag in System Firmware

Certain custom motherboards include a master 'Security Device Support' toggle. When disabled, the firmware hides TPM ACPI objects (MSFT0101) from the operating system kernel.

# Diagnostic Verification:

1. Open Device Manager (devmgmt.msc).
2. Expand Security devices. If the category is missing, security device support is disabled at the firmware level.

# Step-by-Step Fix:

1. Access UEFI Setup:

Enter system setup during POST (F2 or Del).

2. Enable Security Device Support:

Navigate to Security > Trusted Computing.

Set Security Device Support to Enable.

Set TPM 2.0 Device Found state to Active.

3. Save and Exit:

Press F10 to save and reboot.

# Prevention & Long-Term Monitoring:

Review Trusted Computing settings after clearing CMOS or replacing hardware.

Legacy CSM / MBR Configuration Suppressing UEFI TPM 2.0 Tables

Solution:

Root Cause: Compatibility Support Module (CSM) Blocking UEFI ACPI TPM Detection

TPM 2.0 requires a pure UEFI boot environment. Operating in legacy CSM (MBR) mode prevents the OS from enumerating the TPM 2.0 ACPI table, causing upgrade checks to fail.

# Diagnostic Verification:

1. Run msinfo32.exe.
2. Check BIOS Mode. If it displays Legacy, CSM is suppressing TPM 2.0 ACPI table exposure.

# Step-by-Step Fix:

1. Convert MBR Disk to GPT:

Open PowerShell (Admin) and run:

powershell
     mbr2gpt /validate /allowFullOS
     mbr2gpt /convert /allowFullOS

2. Disable CSM in UEFI:

Restart into UEFI setup > Navigate to Boot > CSM (Compatibility Support Module).

Set CSM to Disabled.

3. Enable Secure Boot and fTPM/PTT:

Set Boot Mode to UEFI Only and enable fTPM/PTT.

4. Save and Reboot (F10).

# Prevention & Long-Term Monitoring:

Always provision fresh Windows installations using GPT and native UEFI boot mode.

What state does the TPM exhibit when queried via Windows administrative tools?

tpm.msc shows 'TPM is ready for use', but Windows 11 setup fails to register detection.
TPM endorsement keys or ownership state are corrupt or locked by Physical Presence Interface (PPI).
TPM Base Services (TBS) service is stopped, disabled, or corrupt in Windows services.
TPM is locked out due to excessive invalid authorization attempts (Dictionary Attack Prevention).

Stale Windows Setup Cache / WMI Security Provider Desynchronization

Solution:

Root Cause: Outdated WMI Performance Counters and Cached Compatibility Results

Windows Update caches system compatibility checks. If fTPM was enabled after a failed upgrade attempt, Windows Setup may continue reading stale compatibility reports from the WMI database.

# Diagnostic Verification:

1. Open PowerShell (Admin) and query WMI directly:

powershell
   Get-CimInstance -Namespace "Root\Cimv2\Security\MicrosoftTpm" -ClassName Win32_Tpm

2. If IsActivated_InitialValue returns True while PC Health Check fails, cache clearing is required.

# Step-by-Step Fix:

1. Clear Compatibility Appraiser Cache:

Open Command Prompt (Admin) and run:

cmd
     schtasks /run /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser"

2. Reset Windows Update Health Data:

cmd
   net stop wuauserv
   rmdir /s /q C:\Windows\SoftwareDistribution\Download
   net start wuauserv

3. Restart the system and re-run the Windows 11 Upgrade Assistant.

# Prevention & Long-Term Monitoring:

Allow scheduled compatibility appraiser tasks to finish before re-triggering upgrade setup.

Corrupted TPM Endorsement Keys / Locked Physical Presence Interface

Solution:

Root Cause: Invalid TPM Provisioning State or Locked PPI Operations

A corrupted TPM endorsement key (EK) or storage root key (SRK) prevents Windows from initializing the cryptographic provider, causing Windows 11 setup to report detection failures.

# Diagnostic Verification:

1. Run tpm.msc.
2. Check the Status pane for warnings stating 'TPM is initialized but ownership is not taken' or error 0x80070002.

# Step-by-Step Fix:

1. Clear TPM via Windows Security:

Go to Settings > Update & Security > Windows Security > Device Security.

Select Security processor details > Security processor troubleshooting.

Click Clear TPM and restart.

2. Clear TPM via UEFI Setup:

Reboot into UEFI > Navigate to Security > Trusted Computing.

Select Clear TPM or TPM State Reset > Confirm on reboot.

# Prevention & Long-Term Monitoring:

Suspend BitLocker encryption before performing firmware TPM resets.

TPM Base Services (TBS) Service Failure

Solution:

Root Cause: Stopped or Disabled TPM Base Services (TBS) Execution

The TPM Base Services (tbssvc) service mediates communication between Windows applications and the TPM hardware. If disabled, Windows cannot query TPM capabilities.

# Diagnostic Verification:

1. Open PowerShell (Admin) and check service status:

powershell
   Get-Service -Name "tbssvc"

2. Check if Status reads Stopped or StartupType is set to Disabled.

# Step-by-Step Fix:

1. Re-enable and Start TBS Service:

powershell
   Set-Service -Name "tbssvc" -StartupType Automatic
   Start-Service -Name "tbssvc"

2. Verify Driver Stack:

Ensure tpm.sys is running in system drivers.

# Prevention & Long-Term Monitoring:

Ensure system optimization utilities do not disable essential security services.

TPM Hardware Lockout Triggered by Dictionary Attack Logic

Solution:

Root Cause: TPM Dictionary Attack Mitigation Active

Repeated authorization failures force the TPM into a lockout state, preventing Windows Setup from verifying cryptographic functions.

# Diagnostic Verification:

1. Open tpm.msc.
2. Status displays: 'The TPM is defending against dictionary attacks and is in a time-out period'.

# Step-by-Step Fix:

1. Reset Lockout in Windows:

Run tpm.msc > Click Reset TPM Lockout in the right Action pane.

Provide owner authorization file or let Windows auto-reset.

2. PowerShell Reset Command:

powershell
   Unblock-Tpm

3. Allow cooldown period (up to 24 hours) if hardware lockout timer is enforced by firmware.

# Prevention & Long-Term Monitoring:

Store TPM owner passwords securely in enterprise credential vaults.

What error code is reported by Device Manager for the TPM device?

Device Manager displays Code 10: 'This device cannot start'.
Device Manager displays Code 14 or Code 31: 'Windows cannot identify/load driver'.
AMD fTPM stuttering or system lag occurs with driver initialization warnings.
TPM driver displays Code 43 or resource allocation conflicts in Device Manager.

TPM Device Driver Failure (Code 10)

Solution:

Root Cause: ACPI Driver Initialization Error or Corrupted Security Device Node

Device Manager Code 10 indicates that the Windows ACPI driver (acpi.sys) failed to start the TPM security device node due to stale registry subkeys.

# Diagnostic Verification:

1. Open Device Manager (devmgmt.msc) > Expand Security devices.
2. Double-click Trusted Platform Module 2.0 and check Device status for Code 10.

# Step-by-Step Fix:

1. Uninstall Security Device Node:

Right-click Trusted Platform Module 2.0 > Select Uninstall device.

Do not delete driver software if prompted.

2. Rescan Hardware Changes:

Click Action menu > Select Scan for hardware changes.

3. Force Update Driver via Windows Standard Driver:

Right-click TPM device > Update driver > Browse my computer for drivers > Let me pick from a list.

Select Trusted Platform Module 2.0 and complete wizard.

# Prevention & Long-Term Monitoring:

Keep chipset drivers updated directly from vendor support channels.

Corrupted Security Devices Driver / Missing System Files (Code 14/31)

Solution:

Root Cause: Missing Core Security Driver Binaries (tpm.sys / tbssvc.dll)

Code 14 or Code 31 indicates that core Windows system files required to load the TPM stack are missing or corrupted.

# Diagnostic Verification:

1. Check Device Manager status for Code 14/31.
2. Review system logs in Event Viewer > System for driver load failures.

# Step-by-Step Fix:

1. Repair Windows System Files:

Open Command Prompt (Admin) and execute:

cmd
     sfc /scannow
     DISM /Online /Cleanup-Image /RestoreHealth

2. Reinstall Chipset Drivers:

Install latest AMD or Intel Chipset Drivers to restore official INF device definitions.

# Prevention & Long-Term Monitoring:

Run monthly DISM integrity checks on critical enterprise workstations.

AMD fTPM Audio/System Stuttering & NVRAM Transaction Hangs

Solution:

Root Cause: AGESA Firmware Microcode NVRAM Memory Transaction Lag

Early AMD AGESA microcode versions experienced transaction delays when fTPM executed memory operations in SPI flash memory, causing system stuttering and temporary TPM detection drops.

# Diagnostic Verification:

Windows Event Viewer displays TPM transaction timeouts alongside noticeable desktop audio/mouse stutter.

# Step-by-Step Fix:

1. Update Motherboard BIOS to AGESA 1.2.0.7 or Newer:

Download the latest BIOS update containing AGESA 1.2.0.7 (or higher) from the motherboard vendor.

Flash the BIOS using Q-Flash / EZ-Flash or UEFI update utility.

2. Clear fTPM NVRAM Keys:

Confirm prompt to reset fTPM keys upon rebooting post-flash.

# Prevention & Long-Term Monitoring:

Refer to the official Microsoft Official Support Guide for vendor-specific TPM requirements.

TPM Hardware Resource Conflict (Code 43)

Solution:

Root Cause: Memory-Mapped I/O (MMIO) Address Space Conflict

Code 43 occurs when the TPM MMIO address space (FED40000 - FED44FFF) conflicts with another motherboard peripheral device.

# Diagnostic Verification:

1. Check Device Manager > Trusted Platform Module 2.0 > Resources tab.
2. Identify conflicting device listed in the Conflict information box.

# Step-by-Step Fix:

1. Reset Motherboard CMOS:

Power off PC, disconnect power, and remove CMOS battery for 5 minutes (or short CLRTC pins).

2. Update System Firmware:

Flash system BIOS to clear stale ACPI resource allocation tables.

# Prevention & Long-Term Monitoring:

Avoid installing unsupported legacy PCI expansion cards on modern TPM 2.0 platforms.

What is the hardware configuration of the TPM 1.2 installation?

System contains a discrete TPM 1.2 chip that supports firmware upgrading to TPM 2.0.
Enterprise system (Dell/HP/Lenovo) locked to TPM 1.2 via field upgrade mode.
Legacy CPU/Motherboard hardware incapable of supporting TPM 2.0 firmware.
TPM mode is set to 1.2 in UEFI setup under Discrete TPM operational settings.

Discrete TPM 1.2 Firmware Upgrade Capability

Solution:

Root Cause: Legacy TPM 1.2 Specification Mode Active

Certain discrete security chips (e.g., Infineon SLB 9665) ship in TPM 1.2 mode but support vendor firmware flasher utilities to upgrade to the TPM 2.0 specification.

# Diagnostic Verification:

1. Run tpm.msc.
2. Review Specification Version. If it reads 1.2, a firmware specification update is required.

# Step-by-Step Fix:

1. Download Vendor TPM Flash Utility:

Download official TPM 1.2 to 2.0 update utility from OEM support (Dell/HP/Lenovo).

2. Clear TPM Ownership:

Clear TPM in tpm.msc or BIOS before flashing.

3. Execute Flash Utility:

Run vendor flasher executable in Windows or via bootable USB to apply TPM 2.0 firmware.

# Prevention & Long-Term Monitoring:

Ensure AC power remains connected during firmware flashing procedures.

OEM System Locked to TPM 1.2 Operational Mode

Solution:

Root Cause: Factory Security Provisioning Mode Set to TPM 1.2

Commercial systems often ship configured in TPM 1.2 mode for legacy Windows 7/8.1 enterprise image compatibility.

# Diagnostic Verification:

Check UEFI setup under Security > TPM Operation. Mode displays 1.2 with an available toggle for 2.0.

# Step-by-Step Fix:

1. Clear TPM in Operating System (tpm.msc).
2. Enter UEFI Setup > Security > TPM Security.
3. Switch TPM Mode from 1.2 to 2.0.
4. Save and reboot (F10).

# Prevention & Long-Term Monitoring:

Audit fleet hardware specifications prior to initiating enterprise OS migrations.

Unsupported Legacy Hardware Platform (TPM 2.0 Incompatible)

Solution:

Root Cause: Hardware Generation Incompatibility

Processors older than Intel 8th Gen or AMD Ryzen 2000 series lack integrated firmware TPM 2.0 (PTT/fTPM) capabilities required for native Windows 11 installation.

# Diagnostic Verification:

1. Query CPU model via msinfo32.exe.
2. Verify CPU model against official Windows 11 supported processor lists.

# Step-by-Step Fix:

1. Upgrade Hardware:

Replace system motherboard and CPU with a supported platform.

2. Workaround via Registry (Unsupported Lab Configurations):

Open Registry Editor during setup (Shift + F10 > regedit).

Navigate to HKLM\SYSTEM\Setup\LabConfig.

Create DWORD (32-bit) named BypassTPMCheck and set value to 1.

# Prevention & Long-Term Monitoring:

Deploy Windows 11 natively on fully supported hardware configurations.

Discrete TPM Specification Toggle Set to 1.2 in UEFI

Solution:

Root Cause: Manual Firmware Override Enforcing TPM 1.2 Mode

Dual-mode motherboard firmwares allow manually forcing the discrete TPM header to run in 1.2 legacy mode.

# Diagnostic Verification:

Run tpm.msc and verify specification version displays 1.2 despite modern motherboard hardware.

# Step-by-Step Fix:

1. Enter UEFI Setup during startup (F2 or Del).
2. Navigate to Security > Trusted Computing.
3. Change TPM Spec Version from 1.2 to 2.0 (or switch from dTPM to fTPM/PTT).
4. Save and Exit (F10).

# Prevention & Long-Term Monitoring:

Verify Trusted Computing settings following motherboard firmware upgrades.

Related Diagnostic Guides

Firmware Update Stuck at 0%: Force Recovery Mode

Hyper-V VM Black Screen After Start: Integration Services

Secure Boot Violates Policy: Key Enrollment Fix

BIOS Keeps Resetting: CMOS Jumper and Battery Fix

SharePoint Online Access Denied Even as Owner

Subscribe to StepDiag

Embed Guide on Your Website