TPM issues since the 2026 certifate updates

Event ID 17 from the TPM and recurring TPM failures after the 2026 Secure Boot certificate updates indicate a firmware/TPM hardware problem rather than an OS or disk issue.

Based on the provided information and the documented behavior for similar TPM issues, the next steps are:

1. Update all firmware and Windows components
   1. Ensure the latest Windows Servicing Stack Update (SSU) and Cumulative Update (CU) are installed. These are required for reliable TPM and Secure Boot behavior.
   2. Check MSI’s support site for:
      • Latest BIOS/UEFI firmware for the X870E Gaming WiFi.
      • Any TPM or security-related firmware updates.
   3. If BIOS update tools (M-Flash, rear Flash BIOS button) are failing, treat this as a potential board/firmware fault and proceed to hardware escalation (see step 5).
2. Check for known TPM hardware issues Event ID 17 (“The Trusted Platform Module (TPM) hardware failed to execute a TPM command”) is documented as a TPM device issue that prevents Windows from reliably using TPM-dependent features (BitLocker, modern authentication, next-generation credentials). The recommended actions are:
   1. Confirm all Windows updates are installed (SSU + latest CU).
   2. Confirm the motherboard BIOS and TPM firmware are fully up to date from MSI.
   3. If the issue persists after updates, contact the motherboard vendor to diagnose the TPM device. This is explicitly recommended when Event ID 17 continues after firmware and OS updates.
3. If BitLocker/Device Encryption is enabled
   1. If BitLocker or Device Encryption is using PCR[7] and the system hits recovery or boot issues after firmware changes, check:
      • Event ID 24658 in Windows Logs > System (BitLocker-Driver) for unexpected Secure Boot configuration changes.
      • Event ID 817 in Application and Services Logs > Microsoft > Windows > BitLocker-API > Management to compare PCR[7] values across boots.
   2. If repeated recovery or TPM binding issues are seen, consider:
      • Suspending BitLocker/Device Encryption temporarily.
      • After hardware/firmware is stable, re-enabling BitLocker so keys are resealed to the TPM.
4. TPM-specific remediation steps If the TPM is intermittently failing or locked out, the documented steps are:
   1. In UEFI/BIOS, disable the TPM, save, and boot into Windows once.
   2. Reboot, re-enter UEFI/BIOS, and re-enable the TPM, then boot into Windows again.
   3. If TPM still fails to prepare or continues to log critical errors, clear the TPM as a troubleshooting step:
      • Open Windows Security (Windows Defender Security Center).
      • Go to Device security → Security processor details → Security processor troubleshooting → Clear TPM.
      • Follow the prompts to restart and confirm.
      • Warning: Clearing the TPM removes all TPM keys and can cause data loss (for example, BitLocker keys, PINs, virtual smart cards). Ensure all important data is backed up and BitLocker recovery keys are safely stored before clearing.
5. Treat this as a likely motherboard/TPM hardware fault The combination of:
   • Persistent Event ID 17 TPM command failures after clean OS install and disk replacement.
   • BIOS update mechanisms (M-Flash, rear flash button) not functioning correctly.
   • System instability and failure to generate minidumps.
   aligns with the guidance that, after OS and firmware updates are applied, remaining TPM failures should be escalated to the hardware vendor. For TPM 1.2 systems the guidance is to update firmware and, if unresolved, replace the motherboard; the same principle applies here:
   1. Proceed with the replacement motherboard that is already on order.
   2. After installing the new board:
      • Install the latest BIOS/UEFI from MSI before putting the system into production.
      • Verify TPM is enabled and properly detected in Windows.
      • If BitLocker/Device Encryption is used, enable it only after confirming stable boots with no TPM errors in the System log.
6. If issues persist on the new motherboard
   1. Re-check for Event ID 17 or other TPM-related events.
   2. Ensure Secure Boot certificate updates and Windows updates are fully applied.
   3. If the same TPM errors occur on a second board with current firmware and a clean OS, escalate directly to MSI support with:
      • Event logs (especially Event ID 17 and any BitLocker/TPM events).
      • Firmware versions (BIOS, TPM) and confirmation that SSU/CU are installed.

These steps follow the documented path: update Windows and firmware, reset/clear TPM with appropriate precautions, and if TPM errors persist (especially Event ID 17) after that, work with the hardware vendor and, if necessary, replace the motherboard.

References:

• Event ID 14, 17 log for TPM command failure or non-recoverable error
• BitLocker cannot encrypt a drive: known TPM issues
• Troubleshoot the TPM
• BitLocker check after firmware update
• Windows devices for home users, businesses, and schools with Microsoft-managed updates
• Secure Boot certificate updates guidance for IT professionals and organizations
• BitLocker and TPM: other known issues
• Boot to UEFI Mode or legacy BIOS mode