How to Update TPM Firmware in Windows 11 (Dell, HP, and Lenovo)

Windows Update, Dell Command Update, HP Support Assistant, or Lenovo Vantage flagged a “TPM firmware update” as available. You double-click it like any driver, and it either fails outright or dumps you into BitLocker recovery. The TPM stores encryption ownership data tied to BitLocker, and it has to release that data before new firmware can flash safely.

Skip that step and you’re locked out, hunting for a recovery key. Here’s the right order to do it in.

What Is a TPM Firmware Update?

Your Trusted Platform Module (TPM) is a security chip. It can be physical, or emulated in firmware: fTPM on AMD, PTT on Intel. It stores encryption keys for BitLocker and Windows Hello. Manufacturers patch its firmware to fix security bugs or reliability issues, much like a BIOS update.

A graphics or network driver update is simple. A TPM update is different: it holds “ownership” credentials Windows uses to trust the chip. Flash new firmware while it’s still owned and protecting an encrypted drive, and the update can fail. Worse, it can lock you out of your own data until you dig up a recovery key.

Before You Begin

Make sure you have:

• A Dell, HP, or Lenovo PC running Windows 11 (Windows 10 also works)
• A local administrator account
• Your BitLocker recovery key saved somewhere outside the PC
• The laptop plugged into AC power (never run firmware updates on battery alone)
• 20–30 minutes without interruptions or forced reboots

Requirement	Details
Device	Dell, HP, or Lenovo PC with TPM 2.0 (discrete or fTPM/PTT)
OS version	Windows 11 or later
Access	Local administrator rights
Power	Plugged into AC power
Backup	BitLocker recovery key saved to a Microsoft account, USB drive, or printout

Not sure your PC has TPM 2.0 enabled? Check that first. These steps assume TPM 2.0 is already active in BIOS/UEFI.

Step-by-Step Guide

Step 1: Back Up Your BitLocker Recovery Key

Save your recovery key before touching anything TPM-related. If the update goes sideways, this key is the only thing that gets you back into your encrypted drive.

• Open Settings > Privacy & security > Device encryption (or Control Panel > System and Security > BitLocker Drive Encryption on PCs where BitLocker is manually managed).
• Click Back up your recovery key.
• Choose to save it to your Microsoft account, a USB drive, a text file, or print it. Do at least two of these.

Step 2: Suspend BitLocker Protection

Suspending BitLocker keeps it from treating the upcoming TPM/BIOS change as tampering. It only pauses protection; your drive stays encrypted. Windows just won’t demand the recovery key on the next boot.

• Open Control Panel > System and Security > BitLocker Drive Encryption.
• Next to your system drive, click Suspend protection.
• Confirm when prompted.

Or do it from an elevated PowerShell/Command Prompt window:

manage-bde -protectors -disable C:

Warning: Skipping this step is the #1 cause of Windows booting straight into a BitLocker recovery screen after a TPM or BIOS update.

Step 3: Check Your Current TPM Status

Before you make changes, check the TPM’s current state. You’ll compare this against the output after the update, so don’t skip it even if it feels like busywork.

• Right-click Start and choose Windows Terminal (Admin) or PowerShell (Admin).
• Run:

Get-Tpm

• Note the TpmPresent, TpmReady, and OwnerAuthorizationPossible (Owned) fields.

• Optionally, open the GUI version by pressing Win + R, typing tpm.msc, and pressing Enter.

• You can also check Device Manager > Security devices to confirm Windows sees the Trusted Platform Module.

Step 4: Update TPM Firmware on Dell PCs

Dell separates ownership release from the actual firmware flash. It’s more hands-on than HP or Lenovo, but more predictable too.

• Disable automatic TPM ownership first. This stops Windows from re-claiming it mid-update. Run this in an elevated PowerShell window:

Disable-TpmAutoProvisioning

• Go to Dell’s support site. Enter your Service Tag, which is on a sticker on the bottom of the PC, or run wmic bios get serialnumber in Command Prompt to find it.

• Filter downloads by BIOS or Firmware. Look for a package named “TPM 2.0 Firmware Update,” or one bundled into a BIOS update.
• If the Dell utility asks you to clear the TPM first, restart the PC and press F2 at the Dell logo to enter BIOS setup. Go to the Security tab, then select TPM Security > Clear TPM. Save and exit with F10.
• Boot back into Windows and run the downloaded Dell TPM/BIOS update executable as Administrator. Let it complete and reboot when prompted. Don’t power off manually.
• Once Windows is back up, re-enable automatic provisioning:

Enable-TpmAutoProvisioning

Step 5: Update TPM Firmware on HP PCs

HP bundles most TPM firmware updates into HP Support Assistant instead of a standalone tool. This one’s mostly a “click and wait” job.

• Open HP Support Assistant from the Start menu (it’s preinstalled on most HP PCs) or download it from support.hp.com.
• Click Updates and let it scan your specific model.

• Look for an update listed under BIOS, Firmware, or explicitly named “TPM Firmware Update.” Select it and click Install.
• If HP Support Assistant doesn’t show it, go directly to support.hp.com and enter your product number or serial number. Browse the Software and Drivers section by hand; the automatic detector sometimes misses niche firmware packages.
• Follow the on-screen prompts. HP’s tool usually handles ownership release on its own, but the PC will reboot at least once during the flash.

Step 6: Update TPM Firmware on Lenovo PCs

Lenovo’s standalone TPM Firmware Update Tool mainly targets desktop ThinkCentre and ThinkStation models. Laptops usually get TPM firmware bundled with a BIOS update through Lenovo Vantage instead.

• Open Lenovo Vantage (or Lenovo System Update on older business PCs) from the Start menu.
• Go to the Updates or System Update tab and click Check for updates.

• If a TPM firmware update or BIOS update mentioning TPM/Security Chip appears, select it and click Install.
• For ThinkCentre/ThinkStation desktops without the update showing in Vantage, go to support.lenovo.com. Search your exact model and look for “TPM Firmware Update Utility” under the BIOS/UEFI category.
• Run the downloaded utility as Administrator and let the PC reboot as many times as it needs. Lenovo’s tool sometimes flashes in two passes. That’s normal, not a sign it’s stuck.

Step 7: Resume BitLocker and Verify the Update

• Open Control Panel > System and Security > BitLocker Drive Encryption and click Resume protection, or run:

manage-bde -protectors -enable C:

• Confirm the TPM is healthy again:

Get-Tpm

• Check that TpmReady shows True. Then open tpm.msc and confirm the Specification Version or firmware version under Manufacturer Information has changed from what you noted in Step 3.
• Open the Windows Security app > Device security > Security processor details. It gives you a plain-language confirmation that the security processor works properly.

Configuration: Key Settings to Know

Setting	What It Controls	Default
BitLocker protection status	Whether BitLocker actively uses the TPM to protect the drive	On (if BitLocker is enabled)
TPM auto-provisioning	Whether Windows automatically re-claims TPM ownership	Enabled
TPM state in BIOS/UEFI Security tab	Enables/disables the TPM or PTT and lets you clear ownership data	Enabled

Tips and Troubleshooting

The update tool fails or refuses to run. The TPM is probably still owned, or the utility doesn’t match your exact model. Suspend BitLocker, run Disable-TpmAutoProvisioning, and clear the TPM from the BIOS Security tab. Then re-run the manufacturer’s model-matched tool as Administrator.

PC boots into BitLocker recovery after the update. You didn’t suspend BitLocker before the change, so it saw altered boot measurements and locked the drive. Enter the 48-digit recovery key you backed up in Step 1. Next time, suspend BitLocker before any TPM or BIOS change, then resume it afterward.

Get-Tpm still shows Owned: True after trying to clear it. Auto-provisioning likely re-claimed ownership before the utility ran. Run Disable-TpmAutoProvisioning first. Then use the Clear TPM action in tpm.msc or the BIOS Security tab, reboot, and re-check with Get-Tpm before retrying the firmware tool.

The OEM tool says “No updates available” even though Windows Update flagged one. The support app’s catalog may be stale, or it’s misreading your model. Check the manufacturer’s site directly using your exact service tag or serial number instead of relying on auto-detection.

“Clear TPM” is greyed out in BIOS/UEFI. A supervisor password or Secure Boot conflict is blocking it. Enter the BIOS admin password if prompted, or temporarily disable Secure Boot, save, then retry. Turn Secure Boot back on afterward.

The PC won’t boot or hangs after flashing. Don’t power it off. Let it retry automatically if it’s mid-flash. If it doesn’t recover on its own, contact the manufacturer’s support with your model and service tag. A genuinely interrupted TPM flash usually needs a vendor-level recovery tool, not a DIY fix.

Wrapping Up

The whole process comes down to four moves: back up the recovery key, suspend BitLocker, run the manufacturer’s tool, then resume BitLocker and check Get-Tpm. Dell asks you to get hands-on in BIOS settings. HP and Lenovo mostly handle ownership behind the scenes through their support apps.

Step	Action	Applies To
1	Back up BitLocker recovery key	All PCs
2	Suspend BitLocker protection	All PCs
3	Check TPM status with Get-Tpm	All PCs
4	Disable-TpmAutoProvisioning, clear TPM in BIOS, run Dell update tool	Dell
5	Run update via HP Support Assistant	HP
6	Run Lenovo Vantage/TPM Firmware Update Tool	Lenovo
7	Resume BitLocker, verify with Get-Tpm	All PCs

If Get-Tpm still looks wrong after a clean retry, or the PC won’t boot, stop there. That’s a hardware or BIOS compatibility problem. Call the manufacturer instead of fighting it through PowerShell.