Windows 11 VM on Parallels has broken virtual TPM.

[DanielC82]

Same behaviour on an Entra joined W11 on ARM VM running on MacBook Air M3 and Parallels Desktop Standard 26.4.0.
After the July update, the first thing I noticed was that there was a problem with the PIN service, I had to enter my password instead.
Then BitLocker started to pop upon each device start. Then the TPM/vTPM rabbithole begun.
I deleted the VM, made a new one, also fails, removed/recreated the chip in VM settings, deleted in Keychain. Nothing.

 

[fella5]

Looks like there might be a fix.
Parallels Desktop for Mac 26.4.1 Release Notes
Parallels Desktop for Mac 26.4 (57516) update addresses the overall stability and security issues and includes the following additions and improvements:

Windows virtual machines

• Fixed: Issues with Microsoft account sign-in, Windows Hello, and Intune enrollment after installing update KB5101650 on Windows virtual machines.

 

[DavidO31]

Our problem was that the VPN client we use inside our Windows 11 VM to connect to our customer's network stopped working due to this error. As a workaround, we installed the Azure VPN Client outside the VM, in my case, directly on the MacBook host, and connected from there instead. Then in Parallels Control Center, under the VM's network configuration, we switched to "Shared Network." After starting the VM, everything worked again, traffic from the VM was routed through the host's active VPN tunnel. We'll keep using this workaround until there's an official fix. Not the ideal solution, but at least we're back to work.

Hope this helps someone else stuck on this!

 

[SystemsGuy]

I just caught this by chance and was coming here to say the same. Has anyone tried it and verified that our issues our solved if we allow the update? Or do I need to be the experimentee.

 

[TimR18]

I just caught this by chance and was coming here to say the same. Has anyone tried it and verified that our issues our solved if we allow the update? Or do I need to be the experimentee.

I'm installing/testing it right now.

 

[fella5]

I just caught this by chance and was coming here to say the same. Has anyone tried it and verified that our issues our solved if we allow the update? Or do I need to be the experimentee.

haha... experiment I guess. I have not allowed MS updates yet but did update Parallels and the toolkit.

 

[TimR18]

I just caught this by chance and was coming here to say the same. Has anyone tried it and verified that our issues our solved if we allow the update? Or do I need to be the experimentee.

I've installed it and was able to enable Windows Hello (PIN and facial recognition). The PowerShell cmdlet "Get-TPM" still gives an error, and my next set of tests will cover the non-login auth prompts for other services configured to validate/authenticate with Windows Hello.

 

[ChrisD49]

Can confirm 26.4.1 fixed the issue for me. I had rolled back the KB5101650 update a while back to keep my Windows Hell functionality. I installed the 26.4.1 update, then installed the KB5101650 update. I was able to use my Windows Hello pin again even after the KB5101650 update was installed.

 

[SystemsGuy]

I installed the parallels update and noticed a much more encouraging event about the TPM and certs. Just now installed the KB5101650 update. Been up for 38 minutes without issue. Seems solved!!!

 

[fella5]

The only thing I still notice is this:

Get-Tpm : A specified output buffer is too small. (Exception from HRESULT: 0x80284005)
At line:1 char:1
+ Get-Tpm | Format-List *
+ ~~~~~~~
+ CategoryInfo : NotSpecified: ) [Get-Tpm], TpmWmiException
+ FullyQualifiedErrorId : Microsoft.Tpm.Commands.TpmWmiException,Microsoft.Tpm.Commands.GetTpmCommand

 

[SystemsGuy]

One closes and another opens...

 

[SystemsGuy]

Was good for about 3h then decided to install kb5101684. Looks to be a problem as TPM throws non-recoverable errors after I installed the preview. Uninstalling.

 

[PaulWoodward]

Actually... it jut fixed attestation for intune, get-tpm still reports as broken).

You can try tmptool instead. It seems to handle the Parallels tpm better than the powershell command.

 

[RobH6]

Parallels 26.4.1 appears to work for me (thus far) - even with a manual ViveTool to enable feature id:62861611.
I can recreate the exception on Get-Tpm in powershell but otherwise things appear to functioning normally. Will see how things run for the next few days. I had KB5101684 installed in the VM before I updated Parallels.

 

[Ashley Chumun]

Hello Everyone,
Please note that Parallels Desktop 26.4.1 release is known to fix the following issues:
1. Microsoft account sign-in, Windows Hello, and Intune enrollment after installing update KB5101650 on Windows virtual machines.
2. BitLocker fails to initialize TPM in Windows 11 VM.
Download link of Parallels Desktop 26.4.1: https://download.parallels.com/desktop/v26/26.4.1-57516/ParallelsDesktop-26.4.1-57516.dmg
Parallels Desktop 26 Release Notes: https://kb.parallels.com/en/131014
The issue regarding Get-Tpm : A specified output buffer is too small. (Exception from HRESULT: 0x80284005) is still being investigated by our Dev Team.
Thank you!

 

[AugustusC]

Looks like there might be a fix.
Parallels Desktop for Mac 26.4.1 Release Notes
Parallels Desktop for Mac 26.4 (57516) update addresses the overall stability and security issues and includes the following additions and improvements:

Windows virtual machines

• Fixed: Issues with Microsoft account sign-in, Windows Hello, and Intune enrollment after installing update KB5101650 on Windows virtual machines.

This new Parallels Desktop worked for me! After upgrading Parallels Desktop, my Windows 11 virtual machine successfully and completely logged into my company's resources.