Can I change hardware in devices with a TPM?

Question

I'm trying to buy a desktop computer. I intend to carry out heavy simulation work with this computer, and it may become important to carry out tasks such as upgrade the RAM, etc., depending on what I need to do with it.

I found out that Windows 11 will require its machines to run a Trusted Platform Module (TPM). From Wiki, the intent of such modules are to "ensure that the boot process starts from a trusted combination of hardware and software", but that raises a question.

If my machine has a TPM, will it allow me to change the computer's hardware? Can a manufacturer deem hardware "untrusted" with a TPM if it is not part of a brand they own?

Answer 1

Can I change hardware in devices with a TPM?

You do not need to worry about upgrading your hardware that has a TPM in most cases.

While Windows 11 requires a TPM, Windows 10 already lets you opt-in to using this security feature. If your current PC already has a TPM and it is enabled you might be using the same boot technology without even realizing it.

The worst thing that can happen by switching hardware is that an encrypted file is no longer possible to open because the hardware "signature" has changed from the one that was used to encrypt the file. Most software that will be encrypting files would not use a TPM in this way unless it made sense to require the exact same hardware to read that data.

On the other hand, the most likely symptom you could see is being logged out of some accounts in software that secured their session with the TPM.

Can a manufacturer deem hardware "untrusted" with a TPM if it is not part of a brand they own?

It is Windows that gets to deem whether the hardware is trusted or not. The devices all contribute to some sort of "signature" that Windows will use to determine whether the currently booting system matches the same hardware that Windows was installed on.