Windows Autopilot: TPM attestation not working on Intel Tiger Lake platforms
Summary
Microsoft documents that TPM (Trusted Platform Module) attestation on Intel firmware TPM Tiger Lake devices requires a minimum update level of Windows 10, version 21H2. Older Windows versions are not supported, so attestation does not work there. The requirement is to install KB5007253 or later.
Symptoms
TPM attestation does not work on Intel Tiger Lake devices running Windows versions without the required update. The source gives no specific error codes or messages.
Affected
- Intel firmware TPM Tiger Lake platforms
- Devices with Windows 10, version 21H2 without the November 2021 cumulative update KB5007253 or later
- Older Windows versions (not supported)
Workaround
- Install the November 2021 cumulative update KB5007253 or a later cumulative update on the affected devices.
Fix
Install KB5007253 or later. Older versions of Windows are not supported for TPM attestation on these platforms.
Recommendation
Check Intel Tiger Lake devices planned for Autopilot with TPM attestation and make sure they run Windows 10 21H2 with KB5007253 or later (or a newer supported Windows version) before enrolment.
Sources
- Windows Autopilot: known issues Vendor · learn.microsoft.com
- November 22, 2021 - KB5007253 (OS Builds 19041.1387, 19042.1387, 19043.1387 and 19044.1387) Preview Vendor · support.microsoft.com
Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 18:25.
Where the information comes from
We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:
- Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
- other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
- community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
- targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
- early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online
Summary and translation with AI (Claude by Anthropic) – without any data of visitors.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.