Enable Virtual TPM module on a VDI for Windows 10 to Windows 11 upgrade

Newbie558292 Lv1Posted Apr-28-2026 22:59

Hello,
in our infrastructure we currently have a VMP for aDesk, version 5.5.0, and a VDC version 5.5.0.
We would like to enable virtual TPM module on all our currently running VDIs to meet the requirements for an upgrade from windows 10 to windows 11.
How can we do that?

By solving this question, you may help 312 user(s).

Posting a reply earns you 2 coins. An accepted reply earns you 20 coins and another 10 coins for replying within 10 minutes. (Expired) What is Coin?

Enter your mobile phone number and company name for better service. Go

Humayun Ahmed Lv4Posted Apr-29-2026 13:30
  
you can’t just “turn on” vTPM for existing VDI desktops in place in Sangfor Technologies VDC 5.5.0 / aDesk (VMP) 5.5.0. vTPM has to be part of the VM template definition, so you’ll need to rebuild or recompose the VDIs from a new golden image with vTPM enabled.
net_specialist Lv2Posted Apr-29-2026 11:55
  
Step‑by‑step:
Prepare a new Golden Image
Power off the template VMChange firmware to UEFIEnable Secure BootAdd vTPM moduleBoot Windows 10Verify TPM:tpm.msc or Get-Tpm
Generalize the template
Run:BATsysprep /generalize /oobe /shutdown``Show more lines
Update the aDesk image
Upload or replace the image in VDC
Rebuild existing VDIs
Recompose or re-create VDIs from the new imageUser data should be preserved via:
Profile containers (if used)Roaming profilesUser data disks
✅ Result:All new VDIs will have TPM 2.0 + UEFI + Secure Boot, fully compliant with Windows 11.
Prosi Lv3Posted Apr-29-2026 11:43
  
You cannot do this cleanly on your current stack.
Windows 11 requires vTPM (TPM 2.0).
Depends on the hypervisor the VDI platform.
In VMP 5.5.0 / VDC 5.5.0, that capability is either not available or not fully supported for existing VDIs.
Damai_Group Lv2Posted Apr-29-2026 10:11
  
Unfortunately, you cannot natively enable a Virtual TPM (vTPM) on Sangfor VMP and VDC version 5.5.0.

Native vTPM 2.0 support—which is a strict requirement for official Windows 11 deployments—was not available in the 5.5.x branch. Sangfor officially introduced vTPM and the accompanying UEFI firmware support in later versions of their virtualization stack (specifically starting around VDI 5.9.6 and newer).

To migrate your currently running VDIs to Windows 11, you generally have two options:

1. The Official Path: Infrastructure Upgrade (Recommended)
To support Windows 11 natively, utilize security features like BitLocker, and remain fully compliant with Microsoft's hardware baselines, you will need to upgrade your Sangfor infrastructure.

Upgrade VMP and VDC: Plan an upgrade path from 5.5.0 to a modern release (such as the 5.9.x series) that natively supports vTPM.
Enable vTPM on the VMs: Once the platform is upgraded, the option to enable TPM 2.0 will become available in the individual VM settings (or base image template).
UEFI Requirement: Enabling vTPM requires the VM to boot via UEFI firmware rather than Legacy BIOS. If your current Windows 10 VDIs were installed using Legacy BIOS, an in-place upgrade to Windows 11 will fail even with vTPM enabled. You would first need to convert the Windows 10 partition scheme from MBR to GPT (using tools like `MBR2GPT`) and switch the VM boot mode to UEFI.

2. The Unofficial Path: OS-Level Bypass (Test Environments Only)
If you need to test Windows 11 on your current 5.5.0 infrastructure without immediately upgrading the VMP/VDC clusters, you can bypass Microsoft's TPM 2.0 and CPU checks entirely at the Windows OS level.

Note: This bypass is unsupported by Microsoft. It is strictly not recommended for a production VDI environment, as it can break compliance and potentially block future Windows security updates.

For an in-place upgrade on a running Windows 10 VDI:
1. Open the Registry Editor (`regedit`) on the target Windows 10 VM.
2. Navigate to: `HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup`
3. Create a new DWORD (32-bit) Value named `AllowUpgradesWithUnsupportedTPMOrCPU`.
4. Set its value data to `1`.
5. Run the Windows 11 installation media. The setup will now ignore the missing vTPM on the Sangfor host and allow the upgrade to proceed.

For a fresh base image deployment:
If you are building a new Windows 11 base image from an ISO, wait for the language selection screen, press `Shift + F10` to open the command prompt, run `regedit`, and navigate to `HKEY_LOCAL_MACHINE\SYSTEM\Setup`. Create a new key called `LabConfig` and add the following `DWORD (32-bit)` values, setting each to `1`:
- `BypassTPMCheck`
- `BypassSecureBootCheck`

Summary
Because version 5.5.0 is an older release, the best long-term strategy is to contact Sangfor support to map out a safe upgrade path for your VMP and VDC nodes. Be sure to verify that your current physical thin clients (aDesk boxes) and host servers are fully compatible with the newer firmware versions before proceeding.

I Can Help:

Change

Board Leaders

lungluk...

Weekly Questioners