TPM (Trusted Platform Module)

Since Windows 11, the abbreviation TPM has been familiar to many IT departments: without TPM 2.0, the operating system cannot officially be installed. But the small security chip does not only protect at startup. It manages keys for encryption – and therefore also plays a role when retiring devices.

Structure and how it works

The TPM is an independent cryptoprocessor with protected memory. It exists as a separate chip on the motherboard, as a function in the processor (firmware TPM, such as Intel PTT or AMD fTPM) or, in servers, as a pluggable module. The specification comes from the Trusted Computing Group; version 2.0 is also published as the international standard ISO/IEC 11889.

Function	What it is used for
Key storage	Protects keys, for example for BitLocker, from being read out
Measurement of the system boot	Detects tampering with firmware and bootloader
Random numbers	Provides random values for cryptographic methods
Attestation	Proves to services that a device is in a trustworthy state
Sign-in protection	Binds credentials such as PIN or face recognition to the device

TPM 1.2 and TPM 2.0

TPM 1.2 was the standard for a long time but only supports older methods such as SHA-1. TPM 2.0 allows more modern algorithms and more flexibility. Windows 11 requires TPM 2.0. Many devices that do not meet this requirement are being retired with the end of support for Windows 10. More on this in the article Selling used PCs at the end of Windows 10 and in the entry End of Support.

What to note when retiring devices

• Encryption: If BitLocker is active, the TPM holds the key. If the hard drive is installed in another device, it cannot be read without the recovery key.
• Resetting the TPM: When the TPM is cleared, all keys stored in it are lost. Data that was protected only by them can no longer be decrypted afterwards.
• Not a substitute for data erasure: Resetting the TPM is not a documented erasure method. The data carrier itself must be erased.
• Firmware locks: A set BIOS password often prevents resetting and reduces resale value.
• Device registration: For devices in Windows Autopilot the hardware ID is registered. It must be removed before sale.

TPM and Second IT

Second IT erases data carriers from PCs and notebooks using Blancco software, regardless of encryption, and issues a digitally signed erasure certificate for each device. During refurbishment, devices are equipped with a current operating system. More on certified data deletion.

Frequently asked questions about the TPM

How do I find out whether my PC has TPM 2.0?

In Windows, using the command "tpm.msc". It shows the status and specification version. On some devices, the TPM must first be enabled in the firmware settings.

Can TPM 2.0 be retrofitted?

On some motherboards, via a pluggable module or by enabling the firmware TPM. On many older notebooks, this is not possible. In that case, replacing the device is the rule.

Is data on the hard drive lost when the TPM is reset?

The data remains physically on the data carrier. If it was encrypted with a key from the TPM and the recovery key is missing, it can no longer be read afterwards. Unencrypted data remains readable.

What is the difference between TPM 1.2 and TPM 2.0?

TPM 1.2 only supports older methods such as SHA-1. TPM 2.0 allows more modern algorithms and more flexibility. Windows 11 requires TPM 2.0, which is why many older devices are retired with the end of support for Windows 10.

Does resetting the TPM replace data erasure?

No. Resetting the TPM is not a documented erasure method. The data carrier itself must be erased. Before a device is passed on, data erasure, TPM reset and removal of locks belong together.