Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / How Windows 11 Is Quietly Mandating Enterprise TPM 2.0 for All
Transcript
- Lucas: So there's a quiet change rolling through Windows 11 Enterprise that I think is going to catch a lot of IT teams off guard. Microsoft is effectively mandating TPM 2.0 — not just for new devices, but for all machines on your domain. And they're enforcing it through Intune compliance policies starting this quarter. Luna: TPM 2.0 — the Trusted Platform Module. We've talked about it as a recommendation before, but this sounds like it's moving from 'should have' to 'must have'. Lucas: Exactly. And it's not a new headline — TPM 2.0 has been a hardware requirement for Windows 11 since day one. But Microsoft has been lenient on enforcement for existing Enterprise devices. They allowed a grace period where PCs with TPM 1.2 or even no TPM could still upgrade, as long as you used the official bypass registry key. Luna: Right, that reg key. I know a lot of IT admins have been using that to keep older hardware in service. Lucas: That's exactly what's changing. Microsoft is quietly deprecating that bypass in the latest Windows 11 Enterprise feature update, version 24H2. And they're pairing it with a new Intune compliance baseline that flags any device without TPM 2.0 as non-compliant. If you're enrolled in automatic remediation, those devices get blocked from accessing corporate resources. Luna: So we're talking about a pretty broad impact. What kind of hardware are we looking at? Lucas: Think about the 2016 and 2017 business-class laptops — the Dell Latitude 5000 series, the HP EliteBook 800 series, the Lenovo ThinkPad T460s. A lot of those shipped with TPM 1.2 as standard, and the TPM 2.0 module was an optional upgrade. Many organizations never ordered the upgrade. Now those devices — which are still perfectly functional for most office work — are being pushed out of compliance. Luna: And we're not talking a tiny fleet. I've seen surveys that estimate around 12 percent of enterprise Windows devices still lack TPM 2.0. Lucas: That number sounds right. For a company with 10,000 endpoints, that's 1,200 machines that suddenly need a hardware refresh or a firmware update. And that's where the nuance gets important. Luna: Firmware TPM — Intel's Platform Trust Technology, AMD's fTPM. Some of those older machines can support TPM 2.0 through a firmware update, even if they shipped with TPM 1.2. But is Microsoft counting that? Lucas: Short answer: yes, but with a catch. Firmware TPM is technically TPM 2.0 compliant. The issue is attestation. Microsoft's new Device Health Attestation service — which is now mandatory for Intune compliance — checks not just the TPM version, but the TPM manufacturer and the certificate chain. Some firmware TPM implementations don't have the right certificates, so they fail attestation even though they're TPM 2.0. Luna: So it's not enough to just flip a BIOS setting. You have to verify that the firmware TPM is properly certified by Microsoft's attestation service. Lucas: Right. And that's tripping up a lot of IT teams. They update the BIOS, enable fTPM, and the device still shows as non-compliant because the attestation check fails. Microsoft has a list of approved TPM 2.0 modules, and if your system isn't on it, you're stuck. Luna: Which brings us to the hard question: upgrade or replace? Lucas: For some devices, you can install a discrete TPM 2.0 module. The Lenovo ThinkPad T460s, for example, has a dedicated TPM slot. The module costs about 20 to 30 dollars, and it's a 10-minute swap. But the module itself is getting harder to find — Lenovo stopped manufacturing them in 2024. So you're looking at third-party modules or eBay, which introduces supply chain and security concerns. Luna: And for devices that don't have a slot? Like many of the Dell Latitude 5000 series from that era — the TPM is soldered on. No upgrade path. Lucas: Exactly. Those machines are end of life for Windows 11 Enterprise compliance. And the timing is tricky because we're heading into Q3 2026. If you're planning a hardware refresh, you're competing with every other organization that's hitting the same deadline. Luna: So what's the actual deadline? I've seen different dates floating around. Lucas: Microsoft's published timeline says that Windows 11 Enterprise version 24H2 will be the last feature update to support the TPM bypass registry key. That means after October 2026, any new deployment must have TPM 2.0. But the Intune compliance baseline is rolling out now — some tenants are already seeing the policy applied automatically. So the practical deadline is sooner than October for many organizations. Luna: And what about devices that are already running Windows 11 without TPM 2.0? I've heard stories of machines that were upgraded using the bypass and have been running fine for months. Lucas: Those machines won't be forcibly downgraded or blocked from booting. But they will be flagged as non-compliant in Intune. And if your organization uses Conditional Access policies, non-compliant devices lose access to Exchange Online, SharePoint, Teams — essentially the entire Microsoft 365 suite. So it's a soft block, but it's a very effective one. Luna: That's the quiet part. Microsoft isn't breaking anything, but they're making it impossible to work without compliance. Lucas: And look, I get the security rationale. TPM 2.0 enables a whole set of features that Microsoft considers critical: Windows Hello for Business, BitLocker with measured boot, Credential Guard, Virtualization-Based Security. Without TPM 2.0, those features either don't work or are significantly less secure. Luna: But from the IT side, it's a hard sell to the CFO. 'We need to replace 1,200 perfectly good laptops because the chip that handles encryption keys isn't the right version.' That's a tough conversation. Lucas: It is. And the cost adds up. At roughly 1,000 dollars per device for a mid-range business laptop, you're looking at 1.2 million dollars for that fleet replacement. Plus deployment labor, data migration, disposal of old hardware. It's not trivial. Luna: And the smaller organizations — the ones with 50 to 200 devices — they might not have the IT staff to even audit their TPM status. Lucas: That's a good point. Microsoft does provide a PowerShell script to check TPM version across the domain, but it requires some familiarity. And the Intune compliance report only shows compliant vs non-compliant — it doesn't tell you why a device failed. So you might have a fleet of otherwise identical laptops where some pass and some don't, and you have to dig into each one. Luna: What about the security argument? Is TPM 2.0 really that much better than 1.2? Lucas: It is. TPM 1.2 uses SHA-1 hashing, which is deprecated and considered weak against modern attacks. TPM 2.0 supports SHA-256 and larger key sizes. It also supports more algorithms and has better support for modern cryptographic standards. So from a pure security standpoint, the mandate makes sense. The issue is the speed of enforcement. Luna: And the fact that Microsoft is using the Intune compliance mechanism to force it, rather than just saying 'we recommend upgrading.' Lucas: Exactly. It's a classic Microsoft move — give people a feature, let them use it voluntarily, then quietly make it mandatory. We've seen it with Secure Boot, with UEFI, with Windows Hello. TPM 2.0 is the latest. Luna: I think the real question is: what's next? If TPM 2.0 is mandatory now, what's the next hardware requirement that becomes a hard block? Lucas: I've been thinking about that. The obvious candidate is Pluton — Microsoft's security processor that's integrated into the CPU. It's already in some AMD and Qualcomm chips, and Intel is starting to include it. Pluton goes beyond TPM by providing a dedicated secure enclave that's harder to attack. But it's not widespread yet. I'd give it two to three years before Microsoft starts pushing Pluton as a requirement. Luna: That would be a much bigger hardware refresh. Pluton is only in very recent chips. Lucas: Right. So for now, the immediate pressure is TPM 2.0. And the smart move for IT teams is to audit now, not in September. Identify which devices can be upgraded with a firmware update or a discrete module, and which need replacement. Build a timeline for the replacement cycle. And test your attestation flow before the compliance policy hits. Luna: If today's conversation gave you something usable — a checklist item, a timeline to check — that's exactly why we do this show. Lucas: We keep these episodes ad-free by design. No sponsors, no product placements, just the conversation we think is worth hearing. If that model works for you, and you'd like to support it, there's a buy me a coffee page — it's buy me a coffee dot com slash fexingo. No pressure, but it helps us keep the show exactly as it is. Luna: Yeah, and it's a way to say 'this matters to me' without any of the usual podcast ads. We appreciate it. Lucas: So back to that audit — one practical tip: you can run the Get-Tpm PowerShell cmdlet remotely across your domain. It returns the TPM version, whether it's ready, and the manufacturer info. That's your starting point. Luna: And if you find a device with TPM 1.2, check the BIOS version. Some manufacturers released firmware updates that enable TPM 2.0 on the same hardware. Lenovo, for example, did that for several ThinkPad models in 2021. Lucas: Good call. And if you're buying new hardware now, make sure the TPM 2.0 is discrete, not just firmware, if you can. Discrete TPM modules are more secure and less likely to have attestation issues. But firmware TPM is better than nothing, and for most organizations, it'll pass the compliance check as long as it's certified. Luna: So the takeaway: don't wait. Start your audit this week. The compliance police are already rolling out. Lucas: Exactly. And we'll keep tracking how Microsoft enforces this. If there are workarounds or changes, we'll cover them. That's it for this episode.