News Windows 11 to Ship Without TPM Requirement for 'Special Purpose' Systems

[USAFRet]

Don't confuse things. Just because there's idiots out there, it means everyone is an idiot. That's a bit inconsequential. This would mean you're also an idiot, no?

What was the saying? "Those who would give up essential liberty, to purchase a little temporary safety, deserve neither liberty nor safety"?

The root problem here is knowledge and that problem is solved with education. But that's a bigger problem no one really wants to attack head on. Plus, the obvious elephant in the room is locking down systems and advertising.

Regards.

We're obviously not all idiots.

But you can't give a capability to the smart ones and simultaneously withhold it from the idiots.

 

[SamCPP]

Do you really need a TPM if you're not using storage encryption?
I enabled PTT setting in the BIOS, and got Trusted Platform Module 2.0 in device manager on Asus Strix Z390-E.
If Microsoft forces storage to become encrypted , how will that effect file recovery of damaged HDD/SSD?

You would need recovery tools and a recovery key (backup somehow of the encryption key used maybe just your boot password whatever that is). It isn't technically impossible.

 

[-Fran-]

We're obviously not all idiots.

But you can't give a capability to the smart ones and simultaneously withhold it from the idiots.

Uhm... Idiots are smarter than what they appear to be? Or something?

I'm sure you can hide features or just, you know, educate the mass about updates and how to keep your PCs in not awful conditions so you get viruses, spyware, malware, etc...

It's probably cheaper (not sure myself about this one even) to force TPM with all the "side benefits" to Microsoft of locking systems than just run an advertisement campaign to promote safer and better Windows maintenance or upkeep for regular users. Then, how do you bundle this for corporations? They have full dedicated IT teams which operate and get updates and all that rolled out, so I'm not even sure why this is really mandatory. The more I read about it, the less "security" sense it makes to me. Sure, it's a nice to have for some, but that's a far cry from making it mandatory.

Regards,

 

[USAFRet]

I'm sure you can hide features or just, you know, educate the mass about updates and how to keep your PCs in not awful conditions so you get viruses, spyware, malware, etc...

We've had people here, who theoretically should know better...

"How can I turn off Windows Updates completely? I want it to NEVER EVER do that."
Why? A result of his own faulty procedures and ignoring that the OS was telling him it needed to reboot.

or

"How do I turn off Windows Defender? It is using too much RAM, and I heard if I do that, it will give me a couple more FPS in my game."

or

"I was downloading something, my AV flagged it as malicious. I had to tell the AV to ignore. But now, all my files got changed to .rnsmware. Why did this happen and how do I get my files back?"


If you have a way to fix those people, I'm all ears.

 

[-Fran-]

We've had people here, who theoretically should know better...

"How can I turn off Windows Updates completely? I want it to NEVER EVER do that."
Why? A result of his own faulty procedures and ignoring that the OS was telling him it needed to reboot.

or

"How do I turn off Windows Defender? It is using too much RAM, and I heard if I do that, it will give me a couple more FPS in my game."

or

"I was downloading something, my AV flagged it as malicious. I had to tell the AV to ignore. But now, all my files got changed to .rnsmware. Why did this happen and how do I get my files back?"


If you have a way to fix those people, I'm all ears.

You just tell them why they're wrong.

I mean, you can't expect to teach a little kid how Electromagnetic Fields are calculated when they don't know how to sum or multiply, right? Leaving your super genius kid exception on the side, that is 😛

The little you can do, just do. Microsoft is just avoiding the real problem altogether from what I see. Here in the forums we can teach people, which more or less what hapens on a daily basis. Or at least, most try to do so. I won't disagree you can't "save them all", but at least try? MS is not even trying?

Regards.

 

[USAFRet]

You just tell them why they're wrong.

I mean, you can't expect to teach a little kid how Electromagnetic Fields are calculated when they don't know how to sum or multiply, right? Leaving your super genius kid exception on the side, that is 😛

The little you can do, just do. Microsoft is just avoiding the real problem altogether from what I see. Here in the forums we can teach people, which more or less what hapens on a daily basis. Or at least, most try to do so. I won't disagree you can't "save them all", but at least try? MS is not even trying?

Regards.

Those are the ones we come in contact with.
And even after a reasoned explanation of why to not do that...."I know what I'm doing! Just tell me how to turn this stupid thing off!"

The thousands (millions) of little Jimmy idiots out there are going by crap videos on utube and elsewhere.

 

[-Fran-]

Those are the ones we come in contact with.
And even after a reasoned explanation of why to not do that...."I know what I'm doing! Just tell me how to turn this stupid thing off!"

The thousands (millions) of little Jimmy idiots out there are going by crap videos on utube and elsewhere.

I'm not disagreeing that there aren't, but like I said it grinds my gears that MS is not acknowledging the existance of people that actually knows. And then, after talking about this, I can add it's also annoying they chose to do this instead of trying to educate more.

On our part, we can just do what we can, I guess.

Regards.

 

[USAFRet]

I don't especially like it either.

I also do not know of a better solution.

 

[Deleted member 14196]

Just remember Microsoft just like many corporations like money. They like money so much that that’s what they live for. The pursuit of money. If educating people costs money then you can forget about it.

I always think of Mr. Krabs saying “I like money” When he was asked what motivated him to open another store

 

[Aeacus]

it grinds my gears that MS is not acknowledging the existance of people that actually knows

It's most likely due to the reason that there aren't many real tech gurus out there, who know what they are doing, compared to the amount of average Joe/Jane, who, maybe know how to use the PC but have no clue about PC security.

For example, in my IRL community and within the people i know personally, i only know one other person, besides myself, who knows what they are doing when it comes to PC security. Half of them, who i know, do know how to use the PC and there are even several who are struggling to use PC on daily basis.

With that, in the wide world, there are perhaps 5% of the population who can be considered as "tech gurus" while the bulk are average and 25% doesn't know how to use PC. So, rather than cater for the small amount of tech gurus, it's better to cater for the majority (average/uneducated people), by forcing mandatory security features into OS.

Though, there are several options when it comes to the OS selection but those can be classified into 2 broad groups:
Average Joe/Jane - Windows
Tech guru - GNU/Linux

Even the PC hardware follows the same, 2 broad group pattern:
Average Joe/Jane - Prebuilt PC
Tech guru - DIY (enthusiast computing)

 

[USAFRet]

It's most likely due to the reason that there aren't many real tech gurus out there, who know what they are doing, compared to the amount of average Joe/Jane, who, maybe know how to use the PC but have no clue about PC security.

And worse, are the people who think they know, because they watched a couple of utube vids.

"I saw on a video that if you delete the /System32/ folder, it forces Windows to run in 64bit mode."
And then they do it....


Or the fools who hear about disabling various 'services', in an effort to make things run faster.
We have one here currently.
On his 3rd full reinstall after disabling some required stuff.
And still asking...

Or the other current dude from the other day:
"I want to disable Windows Defender. I want NO antivirus. It bogs my system down".

 

[GenericUser]

And then, after talking about this, I can add it's also annoying they chose to do this instead of trying to educate more.

From a "which is less work?" perspective, it's much easier to just close things off than to put out an informational campaign and hope enough people see it, understand it, and are willing to learn from it that its has enough of an effect.

Likewise, anything hidden behind a "power user" setting can be found out by anyone with a keyboard and 2 minutes on a search engine.

 

[aymen11512]

When giving instructions at this level, either give the whole thing, clear and concise, or not at all.

In any case, the actual Preview has been released from MS.

Lastly...if one needs to modify the install files to that level...Win 11 is not for your PC and vice versa.

the instruction was very clear you replace install from the first iso in the second one nothing is unclear about that and as for the pc win11 is working just fine no problems what so ever as far as i can tell

 

[TJ Hooker]

I don't get why M$ would put the "no Ryzen 1st gen or Intel 7th gen or older" CPU requirement for their Win 11. Since if we were to look other Win sys reqs, it has never to do with CPU generation, instead with CPU speed;

Win 95 - 20 Mhz or more
Win 98 - 66 Mhz or more
WinXP - 233 Mhz or more
Win Vista - 800 Mhz or more
Win 7, 8 and 10 - 1 Ghz or more

So, what's changed? If Win 11 is so power hungry, requirement could be 1.5 Ghz or more; or 2 Ghz or more. Not based on CPU gen.

Here, i don't get, how a i7-7700K would be incapable of running Win 11, while i3-8100 is more than capable of doing it. Or when to go to the extreme, then i7-7820X can't run Win 11 but Celeron G4900 can. It doesn't make sense.

All that CPU generation requirement does, is generating tons of e-waste since when Win 10 support ends in 2025, every PC with a CPU that has Ryzen 1st gen, Intel 7th gen or older CPU, will effectively be obsolete, despite they being well enough capable of functioning and working with Win 11.

This isn't something new for Win11. Win 10 had a list of supported CPUs that excluded chips that were too old. Looks like 7 and 8 did too. https://docs.microsoft.com/en-us/windows-hardware/design/minimum/windows-processor-requirements

 

[TJ Hooker]

While still far-fetched, you have entire businesses (small and mdium, mainly) which will need to, most likely, upgrade in order to be compliant with some regulations before 2025. Imagine the Govt systems.

This is not a trivial requirement to fulfill, for sure. And while I don't necessarily disagree with you, mortar and brick stores will just upsell Win11 systems when people calls about their boxes not being elegible.

Regards.

Every place I've worked did regular hardware refreshes, so they'd be upgrading regardless. For government systems they can use Windows 10 LSTC (support until 2029), and/or pay MS to extend support like they did for XP.

 

[TJ Hooker]

A concern I've got with all this which nobody seems to have addressed where there are limitations with regards to the use of TPM and dual-booting. Through my work I find it invaluable to be able to a) either switch between a couple of different instances of Windows by choosing to boot a different VHD file, and b) roll back those instances by just rebooting and replacing that VHD file with a 'gold' image or previous snapshot. Most of the benefits of Virtual Machines but all of the speed and hardware support.
As I understand it, the OS sort of manages the TPM key store - any OS can reclaim control, but if you were to say use a dual/triple/etc boot configuration with multiple Win11 installs, the likelihood is they will forever be fighting over control of the system TPM - I can't see default disk encryption working well like that.

Add to this that if we consider dual-booting outside of a Windows environment, the UEFI Secure Boot feature requirement (which shouldn't need to be a requirement for all of the other security features to function) could also be a major headache as depending on which bootloader your attempting to use to control it, or how your system BIOS manages the different potential EFI bootloaders, it may suddenly become a lot more difficult for some to achieve such functionality. Depending on your scenario, the system BIOS/UEFI environment may:

• present to you the multiple OS's available and they actually work
• present a list of multiple OS's available and only some of them work
• present a list of multiple OS's where some entries are just garbage and maybe just one primary bootloader works
• present just one OS bootloader (usually listed as the Microsoft Windows option - even if Windows isn't installed)

I've seen all of the above scenarios from different systems all from major OEMs, and not necessarily the newer ones handling it better. Adding secure boot on top of UEFI boot to the mix in a couple of cases has introduced problems so I generally only use UEFI without secure boot.

I could almost see it being successfully argued that these requirements actually could be seen as anti-competitive behaviour - especially if systems ship with these features enabled but disabling them comes with the caveat of loosing access to boot the supplied OS as, to be honest MS's Windows EFI bootloader is great for multi-booting multiple versions of Windows but, Windows bootloader is crap at doing anything else.
BIOS programmers need to start getting their UEFI booting code up to scratch and MS better start working on making their bootloader easier to manager and chain other OS's bootloaders to it to show that they aren't trying to restrict general usage of hardware otherwise expect some states to actually push-back - the EU are always happy to spend their taxpayers hard-earned money in court.

EDIT: There's a feature for Tom's or other tech review site to look in to - dual-booting with UEFI secure boot and TPM where the OS's require it... Maybe there's a workaround where the security state of all the different Windows OS's at least can be duplicated to each boot instance - don't see that being the case for others though,

I have TPM 2.0 (via Intel PTT) + secure boot + bitlocker encryption enabled, and I can dual boot Win10 and LInux without issue. For some distros I have to go into my UEFI settings and add the bootloader to my list of enrolled EFI images, but for Debian (and Debian forks it seems) it works out of the box.

 

[A740G]

So, China and Russia do not use western encryption? So how does the iPhone and other Apple devices work there?

I suspect the only reason they don't want encryption is because their governments can spy on the people.

 

[-Fran-]

So, China and Russia do not use western encryption? So how does the iPhone and other Apple devices work there?

I suspect the only reason they don't want encryption is because their governments can spy on the people.

That and these are not technologies backed by Russian interests.

I mean, it's not that hard to put 2 and 2 together (as they say): US Corps with US backed technology offer enemies (on paper) technology to use in all layers of govt and systems. Think of the reverse with Russia or China offering technology to the US.

I can't blame them to be against it 🤷

Also, just to be on the safe side. "Encryption" is not the problem, but what the TPM chips allow the software to do without you (the user) knowing. These are effective locks on a computer you have little to no control over, unless you remove it (risking losing whatever data is using the keys in it). That''s why it's not such a straight forward conversation to have and I can't blame neither China or Russia for saying "thanks, but no thanks".

Regards.