TPM 2.0 for Optiplex 9020

Question

I have optiplex 9020, TPM 1.2 i need to update to TPM 2.0 optiplex 9020 support to Windows 11 or not

speedstep · Accepted Answer

@Philip_Yip  'The OptiPlex 9020 has a 4th Generation Intel processor. It doesn't have a TPM Version 2.0, this technology was introduced for systems with a 6th Generation Intel Processor. It is too old to run Windows 11.' I disagree.  It has secure boot and windows 10 drivers AND intel PTT. Some models come with both hardware TPM and INTEL PTT. https://www.dell.com/support/kbdoc/en-us/000181412 Intel PTT is basically the BIOS alternative to a the hardware based TPM. Intel PTT works on pretty much every processor/chipset since 4th Gen Core (Haswell) processors were introduced and it even supports BitLocker. This is because Intel PTT supports all Microsoft requirements for firmware Trusted Platform Module (fTPM) 2.0. Microsoft has also lowered the BAR for Windows 11 due to State and Federal complaints to TPM 1.2 You cannot have both enabled at the same time. Drivers for 9020 models however are NOT monolythic. The 9020M vs 9020 MT DT USFF vs 9020 AIO use different drivers. Current Driver CAB Summary Optiplex 9020 Windows10 6TD3V A05 04/10/2018 830 MB Download Now

speedstep · Accepted Answer

9020 comes with INTEL PTT so there would not be a reason to download the TPM simulator as its not necessary.

Intel PTT is a platform functionality for credential storage and key management used by Windows® 8 and 10. Intel PTT supports BitLocker for hard drive encryption and supports all Microsoft requirements for firmware Trusted Platform Module (fTPM) 2.0

PTT INTEL.png

TPM Software Stack from Microsoft Research
https://www.microsoft.com/en-us/download/details.aspx?id=52507

https://download.microsoft.com/download/2/8/C/28C3917F-EC5B-464E-B229-1DD1FA299316/TSS.MSR%20v2.0%20TPM2%20Simulator.zip

speedstep · Accepted Answer

It might apply to 7010 models with updated bios for UEFI. The reason I think not is that 7010 models dont have 4th GEN haswell or later processor support. There may however be specific models that have hardware TPM 1.2 on them.

7010 models.png

@DELL-Chris M might have more information.

I do not know this but any system before 2012 windows 8 absolutely would NOT have this aka 360 760 960 390 790 990 non UEFI systems.

PTT requires UEFI GPT booting 64 bit.

The original Release of 3010 7010 9010 models did not have CLASS 2.3.1 UEFI BIOS.

They had Class 1 UEFI bios with No GPT.

Ayman615 · Answer

TPM 1.2 i need to update to TPM 2.0 optiplex 9020 support to Windows 11 or not

Philip_Yip · Answer

The OptiPlex 9020 has a 4th Generation Intel processor. It doesn't have a TPM Version 2.0, this technology was introduced for systems with a 6th Generation Intel Processor. It is too old to run Windows 11.

"As of March 2017, all Dell Skylake (6th generation Intel Processors) platforms support TPM 2.0 mode and TPM 1.2 mode."

How to troubleshoot and resolve common issues with TPM and BitLocker | Dell UK

bradthetechnut · Answer

Dell computers tested for upgrade to Windows 11

Dark Victory · Answer

Hi, Simon again Try downloading  TPM Software Stack from Microsoft Research https://www.microsoft.com/en-us/download/details.aspx?id=52507 https://download.microsoft.com/download/2/8/C/28C3917F-EC5B-464E-B229-1DD1FA299316/TSS.MSR%20v2.0%20TPM2%20Simulator.zip   That will sort it for Windows 11   Got the BETA working perfectly.   Cheers, Simon

AMANGUJAR · Answer

I am able to install windows 11 on Dell 9020, I enabled TPM from security settings in bios and then converted my disk to gpt format.

bradthetechnut · Answer

Hi @speedstep, Does Intel PTT go back any further than the 9020, like 9010/7020/7010, etc.?

Philip_Yip · Answer

One thing to bare in mind with the OptiPlex 7020 (4th Generation) and OptiPlex 7010 (3rd Generation) is that they have a vulnerable version of Secure Boot which Microsoft might reject with Windows 11... In July 2020 there was a major security breach "Hole in the Boot":

https://eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/

The last UEFI BIOS Updates for the OptiPlex 7020 was in July 2019 and for the OptiPlex 7010 in July 2018 respectively and therefore these systems do not have this Security Exploit addressed.

The OptiPlex 7040 (6th Generation) had a UEFI BIOS Update in March 2021 and this addressed this Security Exploit. The Ubuntu 20.04.0 ISO for example which uses a vulnerable Bootloader passed Secure Boot on this system prior to the UEFI BIOS Update around July 2020 and was rejected by Secure Boot subsequent to this UEFI BIOS Update. The Ubuntu 20.04.1 ISO was updated to pass this updated Secure Boot.

speedstep · Answer

@Philip_Yip

Ubuntu 20.04.2 is current and goes out of fashion in 2025 just like windows 10. No idea why you reference .0 .1 as those are no longer current. Secure boot works just fine on 20.04.2 as it does on windows 10 21H1.

http://www.releases.ubuntu.com/20.04/ubuntu-20.04.2.0-desktop-amd64.iso

Its a good idea to install 20.04.2 now and upgrade to he new LTS version Before the 2025 EOL. The most significant change is bowing to microsofts demands to stop supporting 32 bit os.

So while there is a 32 bit 18.04 the 20.04.2 is 64 bit only,

Secure boot capable is required.

Secure boot ON is not required.

Microsoft Recently had the Jedi 20 billion dollar project cancelled due to demands for TPM 2.0 and Secure boot ON mandatory, They could not convince contracting officers in the DOD as well as Civilian Fed and State side that $700 video cards like the 1080TI must be OEM only and would not work well with windows 11 which is a no sale for many enterprises who went along with UEFI and Secure boot and upgraded to 10 in 2015 on the basis that 10 would be the last version of windows.

They since have back pedaled on TPM 2.0 or 8TH gen processors when older 4th gen haswell or later models with Hardware TPM 1.2 and INTEL PTT work just fine. Secure boot is a crock and a fabrication and does not provide security. You cant force millions of users to buy new hardware just on the basis of a power grab to control windows and the internet and privacy from only 1 company.

HARD FLOOR.jpeg

21.04 is the new LTS not yet released.

speedstep · Answer

@Ayman615  11 is not yet released so Its not yet firm.  Microsoft backed down on TPM 2.0 being a HARD FLOOR requirement. the 'new' requirements are met by 9020 but thats subject to change.

dfowensby · Answer

Windows 11 beta Insider Review candidate now loads and runs in 9020 with 1.2 TPM.

SCMcCruzer · Answer

I have an Optiplex 9020 with an upgraded Intel(R) Core(TM) i7-4790 CPU processor.  Do you think I could be successful installing  windows 11 even though I don't have TPM or secure boot enabled?

peterfelgate · Answer

This is how I did it on my Dell 3020, 7020 and 9020 machines....

Optiplex Desktops

TPM 2.0 for Optiplex 9020

Current Driver CAB Summary

Was this post helpful?

Register Now! for Secure Secrets with Kubernetes & DevSecOps - and grab a lab!