In the Windows11ReadinessAudit I got a suspiciously large number of 'fails' on missing (or not-recorded) TPMs.
In order to find more detail and try to establish what was the case I created my own TPM-report:
SELECT
dbo.tblAssets.AssetID,
dbo.tblAssets.AssetName,
dbo.tblAssetCustom.Model,
dbo.tblAssets.Domain,
dbo.tblAssets.Firstseen,
dbo.tblAssets.Lastseen,
dbo.tblAssets.Username,
dbo.tblAssets.IPAddress,
CASE WHEN dbo.tblTPM.SpecVersion IS NULL THEN 'No TPM recorded' ELSE dbo.tblTPM.SpecVersion END AS TPM,
dbo.tblTPM.IsActivated_InitialValue AS [TPM IsActivated],
dbo.tblTPM.IsEnabled_InitialValue AS [TPM IsEnabled],
dbo.tblTPM.IsOwned_InitialValue,
dbo.tblOnBoardDevice.Description AS [OnBoardDevice found],
dbo.tblOnBoardDevice.Enabled AS [OnBoardDevice Enabled],
dbo.tblOnBoardDevice.Tag AS [OnBoardDevice Tag],
dbo.tblAssets.LastActiveScan,
dbo.tblAssets.OScode,
dbo.tblAssets.SP
FROM dbo.tblAssets LEFT OUTER JOIN
dbo.tblAssetCustom ON dbo.tblAssets.AssetID = dbo.tblAssetCustom.AssetID LEFT OUTER JOIN
dbo.tblOnBoardDevice ON dbo.tblAssets.AssetID = dbo.tblOnBoardDevice.AssetID LEFT OUTER JOIN
dbo.tblTPM ON dbo.tblAssets.AssetID = dbo.tblTPM.AssetId
WHERE (dbo.tblOnBoardDevice.Description LIKE N'%TPM%')
This report gave me the view that there are hundreds of PCs that have no info in table tblTPM but in table tblOnBoardDevice it says that there is a TPM in that PC and it is active too... Here is a screenshot of the report:
![pschreutelkamp_1-1694429746262.png pschreutelkamp_1-1694429746262.png](/t5/image/serverpage/image-id/3553iCACF36DF9EA3A454/image-dimensions/809x339?v=v2)
For privacy reasons I removed usernames, assetnames, domain and IP info.
These PCs are mentioned in the Windows11ReadinessAudit as "not Win11 compatible", while some of them are only weeks old and absolutely capable of running Windows11.
Thinking on this discrepancy I came to the thought that probably the contents of tblTPM is based on registry-info and tblOnBoardDevice is queried out of the BIOS via WMI.
Spotchecks on the PC details learned me that there were no scan-errors, which should have been there if scanning was somehow corrupted.
We install our PC all in the same automated way using a combi of a scripted bare-metal installer, SCCM and PDQ so the endresult is always the same.
Do you have any ideas why this discrepancy exists?