Verified that this works for me. Had to restart my VM after disabling the feature 2 times before intune gave a go on "accessing company resources".
Install the app
How to install the app on iOS
Follow along with the video below to see how to install our site as a web app on your home screen.
Note: This feature may not be available in some browsers.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an alternative browser.
You should upgrade or use an alternative browser.
Windows 11 VM on Parallels has broken virtual TPM.
- Thread starter SirioN
- Start date
Verified that this works for me. Had to restart my VM after disabling the feature 2 times before intune gave a go on "accessing company resources".
PaulWoodward
Member
Seeing same here
-Macbook Pro M4 Max
-OS: macOS Tahoe 26.5.2
-Parallels Desktop 26.4.0 (57513)
-Windows 11 Pro 25H2
Confirmed removing Windows July updates as workaround, but like many already reporting here, my VM has to be compliant to MDM rules for my company, which means bitlocker and TPM as well as latest updates to be operational for resource access.
Opened support case 5781803
This is the reality that Parallels seem not to grasp. We need to run VMs with the latest updates and security features for compliance with corporate security requirements. The fact they seemingly don't test or report any of this proactively when a change breaks things is concerning.
It is preferable to block only this specific update (KB5101650) rather than completely disabling Windows Update. This way, you will continue to receive security updates.
You can proceed as follows:
Hide the affected update (recommended method)
Microsoft provides the "Show or Hide Updates" (wushowhide) utility, which allows you to hide a specific update so that it is no longer offered for installation.
If the update has already been installed, uninstall it first, then hide it.
The utility is:windows-update-show-hide_fr_432485.diagcab
You can proceed as follows:
Hide the affected update (recommended method)
Microsoft provides the "Show or Hide Updates" (wushowhide) utility, which allows you to hide a specific update so that it is no longer offered for installation.
If the update has already been installed, uninstall it first, then hide it.
The utility is:windows-update-show-hide_fr_432485.diagcab
It is preferable to block only this specific update (KB5101650) rather than completely disabling Windows Update. This way, you will continue to receive security updates.
You can proceed as follows:
Hide the affected update (recommended method)
Microsoft provides the "Show or Hide Updates" (wushowhide) utility, which allows you to hide a specific update so that it is no longer offered for installation.
If the update has already been installed, uninstall it first (wusa /uninstall /kb:5101650 /promptrestart), then hide it.
The utility is:windows-update-show-hide_fr_432485
You can proceed as follows:
Hide the affected update (recommended method)
Microsoft provides the "Show or Hide Updates" (wushowhide) utility, which allows you to hide a specific update so that it is no longer offered for installation.
If the update has already been installed, uninstall it first (wusa /uninstall /kb:5101650 /promptrestart), then hide it.
The utility is:windows-update-show-hide_fr_432485
PaulWoodward
Member
Before you consider running without the July update I would urge you to look at the number and severity of the security vulnerabilities KB5101650 fixes. TL;DR it's the highest number of fixes they've ever released in a monthly update.
@PaulWoodward's solution works indeed. The only assumption I make now is that when Parallels comes with an updated vTPM, we run the same vivetool and enable id:62861611 again.
thanks Paul!!
thanks Paul!!
It is preferable to block only this specific update (KB5101650) rather than completely disabling Windows Update. This way, you will continue to receive security updates.
You can proceed as follows:
Hide the affected update (recommended method)
Microsoft provides the "Show or Hide Updates" (wushowhide) utility, which allows you to hide a specific update so that it is no longer offered for installation.
If the update has already been installed, uninstall it first (wusa /uninstall /kb:5101650 /promptrestart), then hide it.
The utility is:windows-update-show-hide_fr_432485
@VALLAJ , that does not work for me, because then my company detects not all updates are installed and blocks access to company resources.
PaulWoodward
Member
Yeah, that's a bummer. It "just" modifies the registry, to turn off optional feature AIKv2. I was hoping to extract the new Reg entry so I could just push that out, but Microsoft have made things very hard by obfuscating the settings and combining many settings into a single entry. It's not so simple, sadly.My company will block the unapproved executable unless i can persuade the IT overlords to grant an exception. so still waiting on the fix.
PaulWoodward
Member
Probably not 'enable', no. That would force AIKv2 to be on. As I understand it AIKv2 should not be in use anywhere just yet, and especially not on VMs where there is no EK cert available. That's likely to be the case for some time to come. So when this is generally fixed, to back out the change and remove the manual override, use vivetool /reset /id:62861611@PaulWoodward's solution works indeed. The only assumption I make now is that when Parallels comes with an updated vTPM, we run the same vivetool and enable id:62861611 again.
thanks Paul!!
PaulWoodward
Member
I made a typo. It's "thebookisclosed", not "thisbookisclosed" on github. Sorry for any confusion caused.
Thanks @PaulWoodward - that worked a treat. Hoping for no future TPM-related issues...
ok i am now completely blocked on this as a critical feature apparently relied on the local microsoft authentication and that just expired. and it keeps telling me i need to login from a machine that is compliant. hoping I can get support from internal support to disable this garbage but it's a stretch.
In my case, the virtual machine was added/managed via Intune tenant, so removing the chipset is not an option because BitLocker management is out of my control. I can confirm that the removal of the KB made the TPM work again, but the patch will definitely be applied again, so the issue will probably come back. Anyways, I upgraded the virtual machine RAM size before the TPM issue; that could be also an actor on this tragedy. Is anyone from Parallels working on this issue, or even aware of it?
PaulWoodward
Member
Try to get your IT support to let you run the vivetool. It'll fix the issue permanently, and does not compromise your security posture. It's the least bad option they have (well apart from telling you 'no'). I know it's not an official tool, but it is well regarded and has been widely used by security researchers and others for some time. Good luck!ok i am now completely blocked on this as a critical feature apparently relied on the local microsoft authentication and that just expired. and it keeps telling me i need to login from a machine that is compliant. hoping I can get support from internal support to disable this garbage but it's a stretch.