Home Blog Update HP TPM Firmware 1.2 to 2.0 using SCCM and HP TPM...

Update HP TPM Firmware 1.2 to 2.0 using SCCM and HP TPM Configuration Utility

By
Daniel Engberg
-
83
6307

Introduction

Upgrading TPM from 1.2 to 2.0 has been a recommendation for the past few years, but apart from increased security, there hasn’t been a practical reason why you would need to update.

But on Friday, June 25th, 2021, everything changed when Microsoft announced Windows 11 and the requirement of TPM 2.0.

Most computers released within the past 3 years should have TPM 2.0. Some older machines might have TPM, but TPM 1.2. In those cases, the TPM firmware needs an update to 2.0, which this blog post covers.

This blog post covers the TPM chip and how to do a firmware update from TPM 1.2 to TPM 2.0 for HP machines using HP TPM Configuration Utility and SCCM.

Note that a prerequisite for everything in this blog post is that enable TPM in the HP BIOS.

What is the TPM chip?

TPM 2.0 has been around since 2013, but since July 28, 2016, vendors are required to provide their machines with TPM 2.0.
The Trusted Platform Module (TPM), is a hardware component on the motherboard, developed by Intel, providing physical-level security for Windows 10. TPM 2.0 is now a requirement for Windows 11.

The TPM chip is required for features such as:

The only feature that I know of that requires TPM 2.0 is Device Encryption (Not Bitlocker). TPM 2.0 was also required for Credential Guard in Windows 10 1507, but this is no longer the case.

You can go to all machines in your environment, enable TPM in BIOS, and upgrade them to TPM 2.0. Unfortunately, this is no way of working in an enterprise environment.

This blog post describes how to upgrade the TPM chip firmware from 1.2 to 2.0 for HP machines using Microsoft Endpoint Manager (SCCM) and HP TPM Configuration Utility.

If you are interested in downgrading TPM from 2.0 to 1.2, refer to my other blog post.

TPM 1.2 vs. 2.0

TPM 2.0 adds additional security benefits compared to TPM 1.2.

Read more about it on Microsoft Docs.

How to verify TPM firmware version

Here you can find a list of HP laptops with TPM 1.2: https://support.hp.com/bg-en/document/c05381064 .

You can verify the current TPM firmware version on the device:

  1. Windows Security settings in Windows 10
  2. Powershell
  3. TPM.MSC

The different version properties on the chip are:

  • Manufacturer version
  • Specification version

Alternative 1 – Windows Security settings

Alternative 2 – Powershell

Start an elevated Powershell window and use the following Powershell command:

Get-WmiObject -Namespace rootcimv2securitymicrosofttpm -Class Win32_TPM | Select Specversion

Alternative 3 – TPM.MSC

The last alternative is by using TPM.msc

How to do a HP TPM update from 1.2 to 2.0 using HP TPM Configuration Utility

Configure HP BIOS settings

In the below sections, I reference some BIOS settings that are to be automatically configured.
Please refer to my blog post on How to use HP BIOS Configuration Utility to set BIOS settings to read about how I do this.

In the blog post above, you will learn how to enable TPM, a prerequisite for following this blog post.

Download HP TPM Configuration Utility

The best way to update the TPM firmware is by using TPM Configuration Utility. You can retrieve the latest version through the HP Image Assistant (HPIA). Once installed, select the model you want to update TPM from 1.2 to 2.0 and download TPM Configuration Utility through the tool.

IMPORTANT! Do NOT download the HP TPM Configuration Utility through any other sources, since you might not get the latest version!!

Create an encrypted password file

  1. Open <filename>
  2. Enter password
  3. Save file

Place source files on a source

Place the source files on a share accessible by Microsoft Endpoint Manager (SCCM).

Create a package in Microsoft Endpoint Manager (SCCM)

Select Create Package in the Microsoft Endpoint Manager (SCCM) console.

Give the package a name and browse to the UNC path of the source files.

hp tpm firmware update
hp tpm firmware update

Select Do not create a program.

hp tpm firmware update - create package

Complete the wizard.

hp tpm firmware update - finalize package

Add a step to update HP TPM firmware in the Task Sequence

In this example, we will run the TPM Upgrade steps in the Operating System Deployment Task Sequence. It is, however, possible to run an independent Task Sequence with these scripts.

To use the correct firmware, the TPM Configuration Utility will need to know the Manufacturer version of the TPM script.

With previous versions of the tool, you must either create a script to check the manufacturer’s version and apply the firmware file or create one Task Sequence step for each Manufacturer Version.

However, in the later versions of the HP TPM Configuration Utility, this can be done automatically, using a switch.

To upgrade TPM, you might need to disable virtualization, or more specifically, VT-X.

Configure the Update TPM to 2.0 step Options tab to only run with the following WMI query:

WMI Namespaceroot\cimv2\Security\MicrosoftTpm
WQL QuerySelect * from Win32_TPM Where SpecVersion Like "%1.2%"

Add a command-line step

Tpmconfig64.exe -s –a2.0 -ppassword.bin

Note: There should be no space between -p and the password file!

Conclusion

To comply with the newest security baselines and also to be able to install Windows 11, you should upgrade existing machines to TPM 2.0.

How many devices do you still have that run TPM 1.2? Please answer in the comments below 🙂

References

Related posts

83 COMMENTS

  4. Hi, I have Several HP Elitebooks and they all have TPM v1.2. (Elitebook 8460p, Folio 9470m)
    Can I upgrade them to 2.0 to be able to install Windows 11?
    The file link for HP TPM Configuration Utility is not working. Can you email me the link?

  5. Hi, I have Hp PC z240 and i have TPM v1.2 like everyone here suffering to have windows 11 because of TPM v1.2
    Anyone can help please to have TPM v2.0

  6. slight syntax issue in the PS command to get TPM version. \ char missing from namespace definition when reading this page using Edge v92.0.902.15. I believe the value should be ‘root\cimv2\security\microsofttpm’.

  7. Do you have any idea how to update the TPM firmware on HP Z400 and Z600 workstations? HP seems to have zero TPM related downloads/support for Z400 and Z600.

    For example, one HP Z400 has Infineon with version 3.16 (TPM Spec 1.2).

    We need to keep these machine running since they control important legacy test & measurement hardware.

    Physically the motherboards do not have the 0.1″ dual pin headers installed for TPM module. (The PCB traces are there but nothing installed.) The Infineon chip is directly soldered on the motherboard. I believe that Infineon chip can run TPM 2.0 if there is a way to update the firmware. But HP does not appear interested in supporting.

  8. Hi, good article. In the company there are 8 PCs [HP EliteDesk 800 G1 Tower PC] with TPM 1.2 and running Win10PRO 21H1. Using [WhyNotWin11.exe] the unsupported HW is CPU+TPM. HP listing for TPM upgrade does not show the model mentioned.
    Questions…
    1. Is there a way to safely upgrade TPM or method to bypass this requirement in Win11?
    2. Do you recommend to keep Win10 supported until 2025 and then purchase new equipment?

    • Hi Martin,
      When I last checked (a few months ago), this was not possible. I have been in contact with HP about it, and they came back to me that this is kept for security reasons.

      /Daniel

  10. I have an HP Z240 Tower Workstation. The version of the enabled TPM is 1.2 unfortunately. This PC was custom built for me regarding things like the chipset, amount of memory, upgraded graphics card, etc. I received this machine in May 2017, roughly one year since Microsoft mandated that PC’s manufactured after 2016 required TPM 2.0. I feel HP is in violation in my case.

  11. I don’t have SCCM, how to upgrade TPM from 1.2 to 2.0 on HP Z820 workstation?

    Manufacturer: Infineon (IFX)
    Manufacturer version: 3.19
    specification version: 1.2
    PPI specification version: 1.2
    TPM specification sub-version: 2, 2

  13. Hello everybody !

    It would be nice if HP would eventually propose an update to TPM 2.0 for their Workstation Z420 (and even the Zx20 while we’re at it), which is not very old and above all still very powerful compared to certain processors retained by Microsoft for compatibility with Windows 11, I think that the price of their expensive hardware is well worth it.

    And no, those who ask for it are not Chicken Little Mister DGroves from HP english support forum !!!

    Bye !

  14. It appears that the HPIA doesn’t work with HP Spectre x360 models (mine is 13-4003DX). It doesn’t list my HP model when I search within the HPIA, so how to do the TPM 1.2 to 2.0 upgrade??

  16. sir i have hp compaq elite 8300 ssf tpm is 1.2
    Can I upgrade to 2.0 to be able to install Windows 11?
    The file link for HP TPM Configuration Utility is not working. Can you email me?

  17. I am also trying to figure out how to upgrade my TPM 1.2 to 2.0 so I can upgrade to WIN11 when it’s released. I have an HP Spectre x360 laptop yet no HP Spectre x360 models are listed in the HP Image Assistant (HPIA) you say to use above, so I am at a loss as to what to try next.

  18. Hi, I have Several HP Elitebooks and they all have TPM v1.2. (Elitebook Folio 9470m)
    Can I upgrade them to 2.0 to be able to install Windows 11?
    The file link for HP TPM Configuration Utility is not working. Can you email me the link?

  19. Hello,

    Please will this work for any HP Laptop with TPM enabled in BIOS?

    For instance, I currently have HP Elitebook 8460p laptop with the following TPM information below:
    Manufacturer Name: IFX
    Manufacturer Version: 3.17
    Specification Version: 1.2

    So, my question again is can I upgrade and/or update my TPM to Version 2.0 using the latest HP TPM utility as well as following your guide?
    Hope to get your feedback soon.

    Thanks for the wonderful piece.

  20. Sir, We have six laptops run with TPM 1.2. so we can upgrade to TPM 2.0. If there is an option kindly suggest me.

    • Hi,

      Instead, try to open an elevated command prompt, browse to the directory, and run it from there. Then you will see any messages that might pop up. Check for success or failure in TPMConfig.log in the directory where you ran the TPM Configuration Utility.

      /Daniel

    • Very simple Oje, you run again TPMConfig64 It will now upgrade to TPM2.0. The first time you did it upgraded your TPM 1.2 version 4.63 from yours which was 4.60. Now you run the second time TPMConfig64 it will upgrade from TPM1.2 version 4.63 to TPM2.0 SURELY. Enjoy.

  23. Hi please am using a Diginnos PC. Below are my specifications
    Processor : Intel(R) Core(TM) i7-6500U CPU @ 2.50GHz, 2501 Mhz, 2 Core(s), 4 Logical Processor(s)
    BIOS Version/Date: American Megatrends Inc. 218, 1/13/2016
    BaseBoard Manufacturer: PEGATRON CORPORATION
    BaseBoard Product :D15S
    Is it possible to use your method to update my TPM 1.2 to 2.0

  24. Hi, do you know if an upgrade from TPM 1.2 to 2.0 can be done on an HP Elitebook 840 G2? On the chip manufacturer webpage (Infineon) they indicate it is possible to upgrade their TPM SLB 9660 chip to 2.0 specs (it would actually correspond to a SLB 9665 once upgraded from what I could read). Probleme is, HP doesn’t seem to provide such an upgrade for this module (as they do not support this notebook model anymore)…

    Looking on the Internet I found this package :
    https://www.eluktronics.com/content/TPM/CallTpmBat%20563_0116.zip

    It’s from another brand, but using the same TPM chipset.

    Would it work? Is there any risk?

    Thank you

    • Hi,

      You could always try to download the latest HP TPM Configuration Utility for EliteBook 820 G3, and run it with the -a switch and see if it finds an applicable firmware file.

      /Daniel

    • Hello Anton7581,

      I hope you found away to upgrade the TPM, as I have the same elitebook 840 G2, it was hard for me to follow this tutorial, I don’t have any programming background.
      Please let me know if you found anyway to update it and share it with me if possible.
      Thank you!

  26. Hi Daniel!
    I have an HP t630 Thin Client,
    with BIOS M40 v01.12
    running T7X70015 – ThinPro 2GB x86_64 7.0.0 build 15 (7.1 I think)
    kernel 4.15.7-hp
    TPM version 1.2
    In BIOS I see:
    Current TPM FW Version 04.40.0119.00
    Update TPM 2.0 FW
    but I do not know if I have SLB9660 for TPM 1.2 ver. 4.43.257.0 or SLB9665 for TPM 2.0 ver. 5.62.3126.0
    I am confused!
    Easy Update does not really work, says “Could not retrieve data from repository”. In fact even with Firefox I can only reach Google’s website. Can I upgrade TPM using ThinPro?
    I will use it with Lubuntu, but upgrading TPM will be probably impossible without ThinOS or Windows. Do I have to install Windows first? Could I upgrade TPM through BIOS?
    Thanks for any help!

  27. Hello I have a few HP Elitedesk 800 G1 usdt, they all have TPM 1.2 , can you please help me to upgrade them to 2.0
    Thanks
    Sam

  34. Hi,
    I have a HP Z440 workstation. The TPM version is 4.43 specificationversion 1.2.
    I have found the HP TPM Configuration Utility en downloaded sp87753.
    I have made een new map en copyd the TPM12_4.43.257.0_to_TPM20_5.62.3126.0.BIN in to it. Then i copyd the TPMConfig64.exe in to the same map.
    When i execute the TPMConfig64.exe there is a error under Options: Error loading string id: 117.
    Can i exept the warning en go true with the update?

    • Errors 117 and 118 in the TPM Configuration Utility’s Options field appear to be _text string_ errors only – and hence language-related / UI-related / localization errors in the utility – likely due to your Windows locale being other than English. Not sure if all non-English locales suffer from it, but apparently Dutch is one of them.

      You can easily work around this by adding the English language (pack) to your Windows 10 build (by “Add language” in Windows Settings) and switching to it, and then launch the TPM config utility, so these strings will be displayed in English. Then choose an option and update the firmware, continue the procedure (F1, reboot, clear TPM etc.) and revert Windows to your own locale when done.

      I.o.w. and in short,

      – error 117 reflects a missing / non-working localized text string for “Upgrade to Specification 2.0, version xxxx”
      – error 118 reflects a missing / non-working localized text string for “Update to Specification 1.2, version xxxx”

      There might be a similar error for “Update to Specification 2.0, version xxxx” too, such as 116 or 119, though I haven’t seen it myself.

      As far as I know, you’ll still face the issue of your CPU not qualifying for Windows 11 on the Z440, but at least the TPM can be updated to 2.0.

  35. Hello,

    Thx for your article, i’m in trouble.. because, TPMConfig64.exe is not present on the last version of HP IMA package, it just presents on sp81900, and on this package -a option is not present. can you help me to understand my error?

  36. Hi,

    Could you please share the utility file to upgrade TPM to 2.0 for my HP elitebook 8300 SFF desktop?

    I have tried many ways but those are unsuccessful.

    Or else please guide me if there is a way to upgrade my TPM.

  37. I have this old HP Spectre XT pro with win10 and it is still going stronk. Powerful enough for the small tasks with IOT adjustment purposes and for documenting. I would like to put win11 in it but it seems not to have TPM2. It has TPM 1.2 which is on from BIOS.

    Unfortunately I did not find any bios files or other info how to upgrade from this version. It seems that this version was not affected by the bug a few years ago and HP did not release an upgrade and/or this model was EOL at the time.

    Manufacturer: Infineon (IFX)
    Version: 3.19
    Specification v: 1.2

    Any idea how to upgrade to TPM2 ?

    • I got the same TPM info as you have posted and I have not found a way to update the infineon brand. It appears as though this one is not supported, no surprise there really. Mine is for the Elitebook 8470w which had a default OS of Windows 7 when it was released.

      Alternately you can join insiders program and install 11 that way even if you don’t meet the requirements but I can’t say for sure what will happen when MS terminates Windows 11’s insider program sometime down the road. I’ll find out eventually.

      If more users using older hardware join the program and force them to see how many users are able to install 11 but unable to keep and use it because they are being blocked by Microsoft’s own polices it might force them to change their stance over time. The key is don’t rush out to the stores buying new laptops and shit. What good is an operating system that only a handful of people can actually install and use? Answer: nothing, and Microsoft employees need to come to grips with that.

  39. Hello! I have several, 6+ HP Compaq Elite 8300 (Desktop), TPM 1.2

    Does this procedure or another one work with my devices?

    When I have run the HPIA program, it gives me an error that it doesn’t support Windows 10 21H1.

    Thank you in advance for any help you are able to provide!

  41. I suucessfully updated my girlfriend`s HP desktop with original TPM version 1.2 subversion 6.40. My own HP desktop has TPM version 1.2 subversion 3.14. The HP Configuration Utility for my machine requires a minimum subversion 6.40 in order to be allowed to upgrade to TPM version 2.0. How to first get from subversion 3.14 to subversion 6.40?

  45. I don’t have any HP computers. All my desktop cpu’s are hand built, from parts.

    How to upgrade from 1.2 to 2.0 on these type cpu’s ?

  46. Does anyone know of Softpaq to update an HP Z620 Workstation from 1.2 to 2.0…..have tried all available HP Softpaqs I can find, with no luck

    The Module installed is : Trusted Platform Module 1.2 (Infineon Tech. AG, SLB 9635 TT1.2) Firmware Version 3.19.11.0 (ROM CRC 0x9AE5)

  47. In the link https://support.hp.com/bg-en/document/c05381064, I do not see my EliteBook Folio 9470m (HP Product # C6Z63UT) listed as using TPM 1.2. Security Processor Details shows Specification Version as 1.2.
    The Bios Configuration Utility does not list my computer as eligible to upgrade to TPM v2.0.
    The HP Image Assistant will not run on Windows 10 21H1, not supported on this product. Any suggestions on how to upgrade the TPM to 2.0 in order to run Windows 11?

    • Probably not. I have the 8470w and the windows insider program (windows update) says my device doesn’t meet the requirements. It’s been on Windows 11 since early August and received countless updates to both the newly built desktop (Early 2020) and my older “freebie” laptop that was given to me as a form of payment a few years ago. The desktop is working great without any warnings, errors, or notification to go shell out cash at BestBuy or Amazon.

      On the Elitebook 8470w the only missing requirement is the TPM 2.0. That’s it, the insider version is working fine, but I don’t know if I’ll be able to keep 11 or how long MS plans on keeping the insider program for 11 active. I assume if the WI program closes then systems running 11 that don’t qualify will simply be unable to boot after a specific update is installed in the future.

      I am now wondering if it is possible to update the central processing unit in the laptop to a better 3rd gen Intel Core processor, or if that would even help at all. I really need to find a list of compatible processors for 11 so I can see what the options there are.

      Once they are done extracting ideas from the public, to then turn around and try to make money from the ideas, then I can see the users in this group being dumped to the curb like last weeks garbage. I had high hopes for 11, but as the last few months have passed the excitement has turned in to blind hatred for this company and the sheer ineptness of the public mouth pieces behind their blog posts. Their all paid actors reading a script to the public and it’s obvious.

      Their company had it’s hayday back in the 90’s and they’ll never achieve that level of success again, it’s just not possible but the leadership seems to ignore reality every chance they get. It’s only a matter of time before this profits first mentality destroys them from within via alienation of the user base that made them powerful in the first place.

  52. Hi,

    Thanks for the informative post. I have an HP laptop with 1.2 TPM. I’m retired IT and my only comment is that this is the reason why people choose to pay extra for an Apple computer. It should be incumbent on MS to provide a simple turn-key upgrade path, not a process that is beyond the normal person’s ability or courage. We, MS’s customers, have always been much too willing to accept technical obfuscation and previous generation mainframe IT systems were much too often similarly made with an IT user rather than a lay user in mind.

  53. My Laptop isn’t listed on HPIA, it’s the original zbook 15 (not a G2 or higher).
    Does anyone know if there is any way around this?

  54. Hello, (rage alert) I have been trying for a few weeks now, on and off to see if it is possible to update my 2012 HP Elitebook 8470W. It’s a very nice laptop even after almost 10 years, and it currently has the most recent developer build of Windows 11 installed on it via the Insiders Program. Go figure. it meets every requirement except for the processor and DX12 support. Not surprised there.

    It appears the Intel i5 3360M isn’t supported which is a lame duck issue spurred on by MS management in cohorts with the hardware manufactures. I’m not buying a new laptop to replace a working computer no matter what lame gimmicks MS and the Big Brand manufactures pull.

    That’s just stupid and wasteful, but I get it, MS is trying to force the consumer market to go out and spend money they don’t have. What a failed company and business model, honestly I don’t how they stay in business sometimes. I hope MS goes out of business because of this (and many other) underhanded tactic(s), I can only assume that’s how much of a screw up the people that work there are. “Eye’s was just doin muh job”

    Microsfot’s own internal policy has the software development teams geared to fight amongst themselves to prove who’s the best internally. This leads to software sabotage and breakage by vindictive programmers trying not to get fired by being lazy sacks of shit I presume. It’s not an environment where real development can happen. I say this so people outside of it all can try to understand just how poorly managed MS has become, and why the company seems to have lost direction in what it’s products are.

    I’ve searched the HP website several times and tried to make sense of this guide you posted but I can’t follow it since I can’t find any functional software that will patch the TPM for me. I’m pretty sure my chip isn’t to old to run Windows 11 as it’s working right now but only because the requirements are lifted due to the insiders program. If my chips are running this thing as they are then why the hell do I need or want TPM 2.0? I don’t, but MS says’ we gotta have it and none of the blow back from the users in the insiders hub has phased these bastards on this subject. Can anyone say “Cash Grab”?

    The processor/BIOS on this laptop uses TPM version 1.2. I have secure boot on and virtualization enabled to, even in Windows Defenders Device Security section I see al three of the necessary security features are on, yet I don’t meet the requirements. Hence why I’m in such a foul mood with the developers at MS.

    This whole setup/scam they got going on is a load of horse hockey and they know it! This shouldn’t even be necessary for the general public to have to even do this stuff and most will blindly and stupidly rush to the stores and buy some over priced junk that will be obsolete whenever MS deems it so.

    I don’t expect you to respond I just wanted to drop my two cents on this topic as it’s got me pretty heated up about it. The blatant arrogance of these bastards sitting in some “soy boy” filled office space telling each other how great they are for being trolls under a bridge. A fist to the face of the owners at MS is beyond required, and it’s why they sit in hiding all the time. Never get their names and if you do, it’s foreign as hell. Says a lot about the nature of the company and what exactly is running it.

    That’s the picture that forms in my head whenever I think of the people working for that company. Over 100 feedback reports sent out to them expressing my grievances with Windows 11, along with 1000’s of other people, only to have it fall on deaf ears at “Soy Central”.

    I pray daily that this plan of theirs backfires so hard they go bankrupt and have to sell off their company and send those trolls packing to the unemployment lines! That’s how much I hate Microsoft and it’s current leadership. They can burn in hell forever for all I care.

    Windows 10 sucks in comparison to the updated feel of 11 so all I can do for now is just leave the laptop in the insiders program and see how long it last before the team of queergineers send out the kill codes or whatever underhanded bull they got coming.

    It’s enough to make me want to just switch away from Windows 10 or 11. I think if enough people could actually do that, it would be the only way to get the people behind this company to listen. Hit em where it hurts, in the wallet, by not falling for this trick and sticking with 10 or 7, or Linux, which is what I’ll probably end up doing or going back to 7. Thankfully the laptop is not my main computer anyway, was just hoping to update the TPM to 2.0 so I could keep the laptop going for another 10 years with the current Windows.

  55. I have tried updating my TPM on hp probook 450 G3 many times, but the version is still the same (1.2). The processor manufacturer is Infineon (IFX).

  58. Good afternoon Mr. Engberg,

    first of all, congratulate him on the interesting article, however I can not use it since I must be very careful with my laptop, because I do not want it to be turned into a brick, since I do not have money to buy another.

    My computer has TPM 1.2, IFX, Version 3.19. It is an HP EliteBook 8770w and like the vast majority of those who have preceded me in their posts, I want to install Windows 11.

    I would greatly appreciate it if you had the time to review my case and guide me.

    Thank you very much in advance. Greetings from Chile.

  59. Looks very helpful, before I start can I check as I have two Elitedesk 800 G1 SFF where I have managed to update TPM to 4.34-1011. The TPM Configuration version I got was sp87753, following your instructions, where the bin files lowest version needs 4.40 (TPM12_4.40.119.0_to_TPM12_4.43.257.0.BIN). Will your method be OK in this situation? Do you know where I can get the upgrade softpaqc

  60. Hi
    I have HP zBook 15u G3, I already SP81900 and 1.2 to 2.0 firmware scuessful, then TPM.msc show 1.2, I don’t understand, how fix to 2.0?

    • Hi, again, I got problem, run tpmconfig64.exe then pop-up then restart then press F1 for agree, then Press F1 for upgrade, I got message, said “tpm FIRMWARE IMAGE IS MISSING ”

      What do I do?

LEAVE A REPLY

Please enter your comment!
Please enter your name here

© Daniel Engberg - 2010-2022