TPM (Trusted Platform Module)

A TPM is a small, tamper-resistant component built into most modern PCs — either a separate chip or built into the processor. It securely stores secrets such as encryption keys and certificates, and it measures the computer’s startup process so changes, such as a tampered boot loader, can be detected.

You mostly notice the TPM because Windows 11 requires TPM 2.0. It’s one of the main reasons some older business PCs can’t upgrade — alongside an older processor — which became urgent when Windows 10 reached end of support on October 14, 2025. Many PCs have a TPM that’s simply switched off in the BIOS settings; your IT provider can check.

The TPM also powers everyday security features. BitLocker uses it to unlock the drive automatically for the right computer while keeping it locked if the drive is removed. Windows Hello uses it to protect PINs and fingerprints, and passkeys on Windows rely on it. Device health checks used by Conditional Access can confirm that encryption and secure boot are in place.

Example: an office plans its Windows 11 move and finds four PCs that fail the check. Two just have the TPM disabled — a quick settings change fixes them. The other two are too old and go into the replacement budget. Use our computer replacement planner and read Windows 10 end of support: what to do now.