Enable TPM: Determine if TPM is present

The trusted platform module (TPM) is a hardware component installed in many newer computers by computer manufacturers. It works with BitLocker to help protect user data. And to ensure that a computer has not been tampered with while the system was offline. In this article, you will learn about “Enable TPM: Determine if TPM is present”. Kindly refer to the following TPM-related guides. How to upgrade Windows 10 with an unsupported CPU and TPM 1.0 to Windows 11​, and How to Install Windows 11 in Oracle VirtualBox with no TPM Support,

BitLocker offers the option to lock the normal startup process until the user supplies a personal identification number (PIN) or inserts a removable USB device. Such as a flash drive, that contains a startup key. These additional security measures provide multifactor authentication and assurance that the computer will not start or resume hibernation until the correct PIN or startup key is presented.

Trusted Platform Module

The TPM Chip also known as the Trusted Platform Module is a hardware security module on your motherboard. It is designed by the Trusted Computing Group Consortium. Here are some similar guides. How to delegate permissions for backing up TPM passwords, and how to clear the TPM via the management console or Windows Defender Center App.

​​​​​The “TPM is ready for use” confirms that the device has a TPM and it’s enabled and ready for us.

The tpmtool utility can be used to get information about Trusted Platform Module (TPM). boot process, and Windows 11 Feature-specific, Hardware and Software Requirements: How to upgrade to Windows 11 from Windows 10 as a Windows Insider.

Note: TPM 2.0 is designed to be fully functional in UEFI mode. Systems must be in UEFI mode with TPM enabled and secure boot configured to attain the security status.

Determine if TPM is present and enable TPM in the BIOS

You can quickly use these commands to check the TPM Status. From the Command Line, you can see if it is Enabled, Activated, or Owned.

wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get IsEnabled_InitialValue
wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get IsActivated_InitialValue
wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get IsOwned_InitialValue

Alternatively, you can run the following command from the command line to determine if TPM ownership has been taken. (Press CTRL + R and type cmd, then right-click cmd.exe and click Run as administrator).

Wmic /namespace:\\root\CIMV2\Security\MicrosoftTpm path Win32_Tpm get /value

TPM is a chip that is either integrated into your device (not available on all PCs’) motherboard. Or added separately into the CPU.

Its purpose is to help protect encryption keys, user credentials, and other sensitive data behind a hardware barrier so that malware and attackers can’t access or tamper with that data. Below are TPM States:

Disabled

• The TPM chip is disabled, you need to enable it in the BIOS.

Enabled, Not Ready

• No owner password is set, you need to initialize the TPM

Enabled, Ready

• A Password is set and is ready for use.

Please use the following command to quickly view the TPM information of the device as shown in the image below.

tpmtool getdeviceinformation

You could check if your device has TPM via the Command Prompt: To do this, open the elevated Command Prompt and run the following command below. You could also use the command “get-tpm” to get your desired result.

wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get * /format:tpmlist.xsl

When the TPM isn’t present on the device, the following error message below will be prompted. This command can be run on PowerShell and Command Prompt.

Determine if TPM is present via the TPM.MSC snapin

Ensure you have your device’s “TPM chipset 2.0” enabled and activated. There are numerous ways to determine this.

Check this via the following basic steps
- Device Manager, 
- TPM Management snap-in (tpm.msc), or via the Windows Settings. I highly recommend taking a look at this guide for other steps to determine if TPM is present on your device: How to check if you have Secure Boot and TPM enabled.

Enable TPM via PowerShell

If the TPM is disabled through the BIOS settings. You have to re-enable it in BIOS or run the following Windows PowerShell command as an administrator:

$tpm = gwmi -n root\cimv2\security\microsofttpm win32_tpm
$tpm.SetPhysicalPresenceRequest(6)

After you run the command, you must restart the operating system and accept any BIOS prompts.

Enable TPM Manually

To enable  TPM (Trusted Platform Module). Please follow the steps discussed below. Kindly refer to this guide for more information on “how to clear, enable or disable TPM in Windows via the BIOS or UEFI“.

1. Boot the computer using F2 into the BIOS setup mode
2. Locate the “Security” option on the left and expand
3. Locate the “TPM” option nested under the “Security” setting
4. To enable the TPM settings you must check the box saying.  “TPM Security” to enable the TPM hard drive security encryption
5. Ensure the “Activate” radio button is turned on in order to ensure the TPM option works
6. If the TPM is ‘Deactivated’, or the TPM Security is not enabled the drive will not encrypt until those settings are made
7. TPM changes sometimes need to be verified by restarting after they are applied

Manage-bde TPM Command

This session applies to Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012 only, and NOT Windows workstation. To turn on the TPM, type:

manage-bde  tpm -turnon

Below is a command to configure the computer’s Trusted Platform Module (TPM). Attached also is the description of all available parameters that can be used with the command.

manage-bde -tpm [-turnon] [-takeownership <ownerpassword>] [-computername <name>] [{-?|/?}] [{-help|-h}]

I hope you found this blog post helpful. In this guide, you have learned how to Enable TPM: Determine if TPM is present. If you have any questions, please let me know in the comment session.