A Trusted Platform Module (TPM) is a special in­teg­rated chip for laptops and other computers. The chip offers important security features for testing the integrity and security of systems and software in a protected en­vir­on­ment. If your operating system supports TPM, you can activate it using the BIOS features or de­ac­tiv­ate it as needed.

What does Trusted Platform Module mean?

Both companies and private users have an interest in security measures that protect their systems and fight malware and ransom­ware. There are a number of tools out there for in­creas­ing your system’s security, including firewalls, various antivirus programs, and the Trusted Platform Module. TPM is an in­teg­rated chip for laptops and other computers that offers ad­di­tion­al security features for hardware and software, including au­then­tic­a­tion, user iden­ti­fic­a­tion, checking software licenses, and saving keys, passwords, and cer­ti­fic­ates.

A TPM works like a safe. It’s an isolated en­vir­on­ment that’s protected from ma­nip­u­la­tions and malware. The TPM activates software and hardware during the boot process and checks their integrity. This ensures that the operating system isn’t com­prom­ised and that that the startup process won’t be dangerous. Even though TPM chips used to be used as stan­dalone chips for corporate computers, most modern AMD and Intel CPUs have TPM func­tion­al­it­ies. There are, however, still mother­boards that require an ad­di­tion­al TPM chip. In the long term, it will be standard for all hardware to have in­teg­rated TPMs, since Windows 11 requires TPM 2.0.

Where is a TPM located?

The TPM chip functions as a dedicated processor and is located in the device’s mother­board. Mother­boards without a pre­in­stalled TPM chip come with a slot for inserting a chip. You can use this chip slot for in­stalling a TPM in­de­pend­ently of your computer’s CPU. If you need a stan­dalone chip for TPM func­tion­al­ity, you should look for a com­pat­ible chip from the same year and same man­u­fac­turer as the mother­board.

What are the benefits of a Trusted Platform Module?

A TPM comes with the following benefits:

  • Creating and saving passwords, cer­ti­fic­ates, and crypto keys for more secure en­cryp­tion processes
  • Checking/mon­it­or­ing platform integrity using metrics and com­par­is­on processes in order to recognise ma­nip­u­la­tions with the boot process
  • Hardware au­then­tic­a­tion of the operating system using RSA cryptosys­tems
  • Pro­tect­ing the system from malicious changes to the software or firmware using an At­test­a­tion Key (AIK), which checks com­pon­ents’ integrity using hashing
  • Optimised defence against malware, ransom­ware, dic­tion­ary attacks and phishing with firewalls, smart cards, biometric tests, and antivirus programs
  • Checking software licenses using Digital Rights Man­age­ment (DRM)

How can you check the TPM on your own device?

Since TPM 2.0 is a re­quire­ment for Windows 11, a lot of users wonder whether their device has TPM. There are a few ways to check for a TPM chip in your system. Note that even in­teg­rated TPM chips aren’t always activated by default.

In Windows, you can check whether you have a TPM chip or check the version of your chip. Here are three ways to do that:

Open TPM Man­age­ment

One way to check whether you have a TPM chip is using the TPM Man­age­ment Tool. First, enter the command ‘tpm.msc’ into the Windows search field. This will open the in­teg­rated TPM Man­age­ment Tool. If your device doesn’t have a TPM chip, you’ll be shown a message saying so in the next window. If you do have a TPM chip on your mother­board, the window will display in­form­a­tion about the type and version of the chip.

Open Device Manager

You can also check for a TPM chip using the Device Manager. First, use the Windows shortcut [Windows] + [X] and click on ‘Device Manager’. Then navigate to the side menu on the left, click on ‘Security Devices’, and open the drop-down menu. If you do have a TPM chip, you’ll see which version it is there.

Check using the command prompt

To check whether you have TPM using this method, you’ll first need to open the command prompt. To do that, open the ‘Execute’ dialog using the shortcut [Windows] + [R]. Then enter the command ‘cmd’ and then use the shortcut [Windows] + [Shift] + [Enter] in order to open the command prompt as an ad­min­is­trat­or.

Next, to check whether you have a TPM chip, enter the following command:

wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get /value
shell

If you do have a TPM chip, you can see which version you have in the line ‘SpecVer­sion=’.

How can you activate and de­ac­tiv­ate a TPM chip?

Your TPM chip may or may not be activated by default, depending on the model, version, and age of your computer. Note that even if a TPM chip is in­teg­rated, that does not guarantee that it’s been activated by default. Some firmware TPMs might require BIOS or UEFI updates. If the TPM isn’t activated by default, there are a couple of options for ac­tiv­at­ing it manually or for de­ac­tiv­at­ing it.

Ac­tiv­at­ing and de­ac­tiv­at­ing TPM in BIOS

Step 1: start up your system and open BIOS. (Depending on your operating system, you can do that by pressing [F2], [F12], or [DEL] during startup.)

Step 2: in the menu, go to ‘Security’ and then to ‘Trusted Computing.’

Step 3: activate the item ‘Security Device Support’.

Step 4: activate ‘PTT’ from under ‘TPM Device’.

Step 5: save the changes and restart the computer. To de­ac­tiv­ate TPM, follow the same steps and de­ac­tiv­ate items instead of ac­tiv­at­ing them

Ac­tiv­at­ing and de­ac­tiv­at­ing TPM using the TPM Man­age­ment Tool

Step 1: enter ‘tpm.msc’ and press [Enter] to open the TPM tool.

Step 2: navigate to ‘Action area****Activate TPM’. Read the page ‘Activate TPM security software’ carefully.

Step 3: go to ‘Shut down’ or ‘Restart’ and follow the UEFI steps.

Step 4: when the computer starts up again, accept the new TPM con­fig­ur­a­tion. This is how the system ensures that only au­then­tic­ated users make changes.

Step 5: TPM will then be activated for Windows.

Step 6: to de­ac­tiv­ate, go to ‘Action area****De­ac­tiv­ate TPM’. Under ‘De­ac­tiv­ate TPM security software’, select whether you want to enter your password using removable media, enter it manually, or de­ac­tiv­ate without entering your password.

What happens when you de­ac­tiv­ate TPM?

If you delete or de­ac­tiv­ate TPM, you might end up losing data. This applies to keys, passwords, cer­ti­fic­ates, virtual smart cards, and login PINs. To prevent any un­in­ten­tion­al losses, take the following pre­cau­tions:

  • Make sure you have a backup of the data saved in the TPM chip.
  • Only delete or de­ac­tiv­ate TPMs on your own devices, or make sure you have the IT admin’s per­mis­sion to do so.
  • Check what the owner’s manual has to say about TPM or look it up on the man­u­fac­turer’s website.
  • If possible, use the TPM Man­age­ment Tool when you de­ac­tiv­ate and/or create a system backup before you make changes in BIOS and UEFI mode.

What types of TPMs are out there?

There are a number of different types of TPMs, which mostly differ in the way they’re im­ple­men­ted.

  • Discreet TPM: a discreet Trusted Platform Module is a dedicated chip and is usually the best type of TPM. It offers support for more en­cryp­tion al­gorithms, provides pro­tec­tion from ma­nip­u­la­tion, and gives rise to very few errors. The downside is that it requires more space.
  • Physical-based TPM: this type is in­teg­rated into the CPU and provides physical security features that protect you from ma­nip­u­la­tions and malware.
  • Firmware-based TPM: like physical-based TPMs, firmware-based TPMs work in a secure CPU execution en­vir­on­ment and prevent ma­nip­u­la­tions.
  • Virtual TPM: virtual TPMs can be created using a hy­per­visor. The TPM will generate security keys in­de­pend­ent of the virtual machine.
  • Software-based TPM: software-based TPMs aren’t advisable, as they only offer limited security benefits and are more open to errors and malware.
Go to Main Menu