Windows 11 VM on Parallels has broken virtual TPM.

After installing the July 2026 cumulative security update KB5101650 (build 26200.8875), the virtual TPM stopped working.

Running in an elevated PowerShell:

Get-Tpm

returned:

Get-Tpm : TPM 2.0: The structure is the wrong size. (Exception from HRESULT: 0x80280095)
+ CategoryInfo : NotSpecified: (:) [Get-Tpm], TpmWmiException
+ FullyQualifiedErrorId : Microsoft.Tpm.Commands.TpmWmiException,Microsoft.Tpm.Commands.GetTpmCommand

In another state the same command returned:

Get-Tpm : The specified output buffer is too small. (Exception from HRESULT: 0x80284005)

Also observed:
- tpm.msc: TPM shown as locked, Specification version "Unknown", and the MMC snap-in throws an error and unloads.
- Windows Security > Device security: no "Security processor" section; message "Standard hardware security not supported".
- WebAuthn passkey registration: the "Choose where to save the passkey" dialog offers only Microsoft Password Manager and Security key -- the "This Windows device" option is missing, so device-bound passkeys cannot be created.

What did NOT help
- Full VM power cycle.
- Removing and re-adding the TPM chip in Parallels (a fresh, empty vTPM produced the exact same 0x80280095 error), which shows the problem is not the stored vTPM file.

What fixed it
Uninstalling KB5101650 (Settings > Windows Update > Update history > Uninstall updates) fully restored the TPM. tpm.msc now reports:

The TPM is ready for use.
Manufacturer Name: PRLS
Specification Version: 2.0

The issue is reproducible on my machine: it appears with KB5101650 installed and clears when the update is removed.

Note: KB5101650 is being delivered as a staged rollout, so many Parallels / Windows 11 ARM VMs may not have received it yet -- more reports could follow as it reaches more machines. I'm reporting early. I've paused Windows Update for now to keep the update off.

Question: is this a known interaction between KB5101650 and the Parallels virtual TPM on Windows 11 ARM, and is a fix or an updated Parallels build planned?
 
Removing the July security update seems to fix my issue. Clear-TPM gave a TPM returned an unexpected result 0x8029010c error and Get-TPM gave TPM 2.0 Structure is wrong size 0x80280095

Remove KB5101650:
wusa /uninstall /kb:5101650 /promptrestart

Parallels: Version 26.4.0 (57513)
 
I am also experiencing this issue. I followed a process similar to ChristopherB6 to eliminate possibilities. When doing a fresh Windows 11 installation, everything worked fine at first. Then, upon installing the July security updates, the TPM chip became corrupted and the VM is unable to run Bitlocker. This is a work stoppage for me as well. Get-TPM shows the TPM chip is the incorrect size and seems to have been corrupted in the upgrade process.

Happy to send engineering information. Please open a case.
 
On 26.4.0 installed Microsofts latest update today on Win 11 VM and it Broke TPM. Organization requires and if I don't meet requirements it forces logout in 10m.
Not good...not good at all.
 
Good day team,

I am encountering the same issue with my Windows 11 vm on my machine.

Machine: M1 Max MacBook Pro
Parallels version: Version 26.4.0 (57513)

Get-Tpm:
get-tpm : TPM 2.0: Structure is wrong size. (Exception from HRESULT: 0x80280095)
At line:1 char:1
+ get-tpm
+ ~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Get-Tpm], TpmWmiException
+ FullyQualifiedErrorId : Microsoft.Tpm.Commands.TpmWmiException,Microsoft.Tpm.Commands.GetTpmCommand

Trying to sign into Microsoft services:
Correlation Id: 9e2520dc-a1d7-46f9-a987-f8f4396a1752
Timestamp: 2026-07-15T16:38:34.000Z
DPTI: fd814758c8693e8d6d8392c694cc36922c20a62e4f734a76004a23df8003e0e7
Message: The credential is invalid. Unexpected sub status (6008).
Tag: 657rx
Code: 2148073520

tpm.msc
Microsoft has detected an error with a snap-in and will unload it.

FX:{7d3830aa-e69e-4e17-8bd1-1b87b97099da}
Object reference not set to an instance of an object.

Exception stack trace:

at Microsoft.SnapIns.TrustedPlatformModule.TrustedPlatformModuleWmi.WmiGetLockoutHealTime(UInt32& healTime)
at Microsoft.SnapIns.TrustedPlatformModule.OverviewView.UpdateTpmInfoMessages(OverviewViewControl form)
at Microsoft.SnapIns.TrustedPlatformModule.OverviewView.RefreshData(Boolean throwExceptions)
at Microsoft.SnapIns.TrustedPlatformModule.OverviewView.OnShow()
at Microsoft.ManagementConsole.View.ProcessNotification(Notification notification)
at Microsoft.ManagementConsole.ViewMessageClient.ProcessNotification(Notification notification)
at Microsoft.ManagementConsole.Internal.IMessageClient.ProcessNotification(Notification notification)
at Microsoft.ManagementConsole.Executive.SnapInNotificationOperation.ProcessNotification()
at Microsoft.ManagementConsole.Executive.Operation.OnThreadTransfer(SimpleOperationCallback callback)

Please provide feedback urgently.
 
I'm in the same boat after updating a couple updates from Windows today. I opened a support case and the chat bot replied back to check for Parallel updates that will resolve this issue.
This is my ticket id: 5773722
 
Quick update...I got hold of a Parallels tech on the phone, and this is what worked for *ME* (may not work for you):

Shut down the Win 11 VM
Remove the TPM chip in Parallels config for that VM
Restart Windows
Open Outlook...and suddenly I can "see" my emails from today (yay!!!)
Shut down the VM
Re-add the TPM chip
Restart the VM

Worked for me...I am back in action...hope it works for others.
 
That d
hilgert said:
Quick update...I got hold of a Parallels tech on the phone, and this is what worked for *ME* (may not work for you):

Shut down the Win 11 VM
Remove the TPM chip in Parallels config for that VM
Restart Windows
Open Outlook...and suddenly I can "see" my emails from today (yay!!!)
Shut down the VM
Re-add the TPM chip
Restart the VM

Worked for me...I am back in action...hope it works for others.
Click to expand...

I did that but it still shows the TPM chip in the not ready state, so I have to authenticate with Smart Card or Yubikey for everything I do, I went the nuclear route and spun up a new VM on a different hypervisor.
 
TLDR; The MS update today was KB510650. Uninstalling the update got me back to working. But work will force it at some point.
After the update installed and I rebooted, it was like my work account lost contact with the VM. Had to reauthenticate which was not working correctly. Kept asking me for my PIN but it was failing. Rebooted a second time and got in and it readded my work account to VM, so it was like I was adding a new device. Kept getting Windows Hello errors and this machine does not meet work requirements. Turns out TPM failed, and of course could not enable encryption. Therefore BitLocker was turned off. Same thing after multiple reboots until I uninstalled the update.
 
SystemsGuy said:
TLDR; The MS update today was KB510650. Uninstalling the update got me back to working. But work will force it at some point.
After the update installed and I rebooted, it was like my work account lost contact with the VM. Had to reauthenticate which was not working correctly. Kept asking me for my PIN but it was failing. Rebooted a second time and got in and it readded my work account to VM, so it was like I was adding a new device. Kept getting Windows Hello errors and this machine does not meet work requirements. Turns out TPM failed, and of course could not enable encryption. Therefore BitLocker was turned off. Same thing after multiple reboots until I uninstalled the update.
Click to expand...

Confirming that after uninstalling that update everything is back to normal for me as well. This is the relevant KB:
https://support.microsoft.com/en-us...kb5101650-os-builds-26200-8875-and-26100-8875
 
SystemsGuy said:
TLDR; The MS update today was KB510650. Uninstalling the update got me back to working. But work will force it at some point.
After the update installed and I rebooted, it was like my work account lost contact with the VM. Had to reauthenticate which was not working correctly. Kept asking me for my PIN but it was failing. Rebooted a second time and got in and it readded my work account to VM, so it was like I was adding a new device. Kept getting Windows Hello errors and this machine does not meet work requirements. Turns out TPM failed, and of course could not enable encryption. Therefore BitLocker was turned off. Same thing after multiple reboots until I uninstalled the update.
Click to expand...
This worked for me.... so we shall see how long before it does get pushed.
 
hilgert said:
Quick update...I got hold of a Parallels tech on the phone, and this is what worked for *ME* (may not work for you):

Shut down the Win 11 VM
Remove the TPM chip in Parallels config for that VM
Restart Windows
Open Outlook...and suddenly I can "see" my emails from today (yay!!!)
Shut down the VM
Re-add the TPM chip
Restart the VM

Worked for me...I am back in action...hope it works for others.
Click to expand...
Sadly that did not work for me either, which is really frustrating because this is my primary work "machine". Uninstalling the update resolves the issue, but then IT forces the update again right away. Here was my process:
  1. Uninstalled the update
  2. Verified that the TPM was working enough for things like Bitlocker and Windows Hello to work. Note that Get-Tpm in PowerShell still gives an error, but it is different than with the update: 'A specified output buffer is too small. (0x80284005)'
  3. Turned off Bitlocker, watched it decrypt, then shut down the VM as soon as it finished decrypting.
  4. Backed up the VM
  5. Removed the TPM from the VM
  6. Deleted NVRAM.dat and NVRAM.tnvs from the VM's directory
  7. Booted the VM
  8. Updated Windows again and rebooted
  9. Ran sfc /scannow. It found and repaired some errors.
  10. Rebooted
  11. Ran sfc /scannow again. No errors this time
  12. Shut down
  13. Added the TPM
  14. Booted back up
  15. TPM is fully broken again and Get-Tpm in PowerShell is back to 'Get-Tpm: TPM 2.0: Structure is wrong size. (0x80280095)'
I guess I will switch to using my laptop for now, which is less than ideal but at least I can work.
 
Same issue, I restored a backup. I submitted this info I was able to pull:

Parallels vTPM returns 0x80280095; tpm.msc crashes at WmiGetLockoutHealTime; M365 sign-in returns 0x80090030.
 
I can also confirm that uninstalling KB510650 resolves the TPM issue. However I don not think the update is the actual root cause of the problem.
What I see happening when the update is installed is that the TPM Manufacturer Name changes from PLRS to SRLP. For me this points to a Parallels issue that could be fixed with an update.
 
I can confirm that Microsoft update KB5101650 breaks the vTPM. Uninstalling the update makes my Windows 11 Pro VM work again, only need to reset the PIN again and sign in to company apps.
 

Attachments

  • upload_2026-7-16_15-6-5.png
    upload_2026-7-16_15-6-5.png
    103.7 KB · Views: 3
  • upload_2026-7-16_15-6-21.png
    upload_2026-7-16_15-6-21.png
    103.7 KB · Views: 5
You must log in or register to reply here.
Back
Top