Windows 11 VM on Parallels has broken virtual TPM.

Verified that this works for me. Had to restart my VM after disabling the feature 2 times before intune gave a go on "accessing company resources".

 

This is the reality that Parallels seem not to grasp. We need to run VMs with the latest updates and security features for compliance with corporate security requirements. The fact they seemingly don't test or report any of this proactively when a change breaks things is concerning.

 

It is preferable to block only this specific update (KB5101650) rather than completely disabling Windows Update. This way, you will continue to receive security updates.
You can proceed as follows:
Hide the affected update (recommended method)
Microsoft provides the "Show or Hide Updates" (wushowhide) utility, which allows you to hide a specific update so that it is no longer offered for installation.
If the update has already been installed, uninstall it first, then hide it.
The utility is:windows-update-show-hide_fr_432485.diagcab

 

It is preferable to block only this specific update (KB5101650) rather than completely disabling Windows Update. This way, you will continue to receive security updates.
You can proceed as follows:
Hide the affected update (recommended method)
Microsoft provides the "Show or Hide Updates" (wushowhide) utility, which allows you to hide a specific update so that it is no longer offered for installation.
If the update has already been installed, uninstall it first (wusa /uninstall /kb:5101650 /promptrestart), then hide it.
The utility is:windows-update-show-hide_fr_432485

 

Before you consider running without the July update I would urge you to look at the number and severity of the security vulnerabilities KB5101650 fixes. TL;DR it's the highest number of fixes they've ever released in a monthly update.

 

Same problem, waiting for Parallels to release update...

 

@PaulWoodward's solution works indeed. The only assumption I make now is that when Parallels comes with an updated vTPM, we run the same vivetool and enable id:62861611 again.

thanks Paul!!

 

@VALLAJ , that does not work for me, because then my company detects not all updates are installed and blocks access to company resources.

 

My company will block the unapproved executable unless i can persuade the IT overlords to grant an exception. so still waiting on the fix.

 

Yeah, that's a bummer. It "just" modifies the registry, to turn off optional feature AIKv2. I was hoping to extract the new Reg entry so I could just push that out, but Microsoft have made things very hard by obfuscating the settings and combining many settings into a single entry. It's not so simple, sadly.

 

Probably not 'enable', no. That would force AIKv2 to be on. As I understand it AIKv2 should not be in use anywhere just yet, and especially not on VMs where there is no EK cert available. That's likely to be the case for some time to come. So when this is generally fixed, to back out the change and remove the manual override, use vivetool /reset /id:62861611

 

I made a typo. It's "thebookisclosed", not "thisbookisclosed" on github. Sorry for any confusion caused.

 

Same problem, still waiting for Parallels to solve vTPM issue...

 

I have the same problem. Deleting the update worked. I installed this wushowhide download.microsoft.com/download/f/2/2/f22d5fdb-59cd-4275-8c95-1be17bf70b21/wushowhide.diagcab to hide the update for now. Now Im waiting eagerly for a parallels update so that I dont have to do this.

 

Thanks @PaulWoodward - that worked a treat. Hoping for no future TPM-related issues...

 

ok i am now completely blocked on this as a critical feature apparently relied on the local microsoft authentication and that just expired. and it keeps telling me i need to login from a machine that is compliant. hoping I can get support from internal support to disable this garbage but it's a stretch.

 

Yep same. And Paralells support has been useless on this.

 

In my case, the virtual machine was added/managed via Intune tenant, so removing the chipset is not an option because BitLocker management is out of my control. I can confirm that the removal of the KB made the TPM work again, but the patch will definitely be applied again, so the issue will probably come back. Anyways, I upgraded the virtual machine RAM size before the TPM issue; that could be also an actor on this tragedy. Is anyone from Parallels working on this issue, or even aware of it?

 

Also having this issue. No information to add that is relevant. Just wanted to throw my hat into the ring in the hope that this gets picked up and sorted.

 

There is a temporary fix here so you don't have to remove the whole KB. https://patchmypc.com/blog/why-intune-devices-became-noncompliant-after-the-july-windows-update/