Windows 11 "does not meet minimum requirements" with TPM 2.0 emulation, possibly because "processor not supported"

[neldredge-unco]

Describe the issue

Using UTM 4.3.2 beta release with a Windows 11 ARM guest, with the new TPM and Secure Boot support, out of the box Windows Update still refuses to change the insider channel to Canary and update to a new build.

I created a fresh VM using 4.3.2, deliberately using a VHDX from an outdated build (25346, while 25905 is current). Windows Update then claimed that no updates were available, other than the usual antivirus definition updates. On the Windows Insider screen, after linking my account, I still had a yellow box warning

Your PC does not meet the minimum hardware requirements for Windows 11. Your channel options will be limited.

The Insider Settings were locked to Release Preview with other options greyed out.

I downloaded and ran PC Health Check which complained "The processor isn't currently supported for Windows 11. Processor: virt-8.0". However it did give green check marks for Secure Boot and TPM 2.0, as well as RAM, disk space and number of cores.

Not sure if it might be as simple as just changing the name reported for the processor (is there a qemu command line option for that?) or if it is doing some deeper checks.

This can be circumvented with the following two regedit hacks as described here:

• Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsSelfHost\Applicability : BranchName -> CanaryChannel
• Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsSelfHost\UI\Selection : UIBranch -> CanaryChannel

At that point Windows Update is able to begin downloading and installing build 25905 (though UTM crashes before it can complete, see #5477). Note that the other registry hacks and TPM bypass scripts listed at the above link are not needed.

Configuration

• UTM Version: 4.3.2
• macOS Version: 13.4.1 (c)
• Mac Chip (Intel, M1, ...): M1 Pro

Debug log
debug2.log

Upload VM
config.plist.zip

[osy]

So I think we can get around this by faking as Qualcomm but I hesitate to do that in case it causes a lot of other issues down the road. Plus, I see the same error message in PC Health Check when using VMware so it is probably not a good idea to lie to Windows about what vendor the processor comes from. Let's just hope that Microsoft decides to remove or improve this check in the future and I think the registry hack isn't too invasive anyways. This check does not seem to block release channel updates, so I think we will keep things as is for now.

[thejasonweaver]

I applied the regedit hacks recommended by neldredge-unco and a canary build began to download but ultimately failed. What should I do? Wait for the next build of UTM? Revert the regedit changes to go back to the Preview channel I was restricted to? Or something else?

[neldredge-unco]

I applied the regedit hacks recommended by neldredge-unco and a canary build began to download but ultimately failed. What should I do? Wait for the next build of UTM? Revert the regedit changes to go back to the Preview channel I was restricted to? Or something else?

In what way did it fail? What was the exact symptom? Are you using UTM 4.3.5 or some other version?

[thejasonweaver]

I applied the regedit hacks recommended by neldredge-unco and a canary build began to download but ultimately failed. What should I do? Wait for the next build of UTM? Revert the regedit changes to go back to the Preview channel I was restricted to? Or something else?

In what way did it fail? What was the exact symptom? Are you using UTM 4.3.5 or some other version?

The Windows hardware checker (paraphrased) popped up and mentioned that the update failed because of TPM and secure boot (the 2 biggies). Same negative result on 4.3.5 and 4.4.1.

[neldredge-unco]

I applied the regedit hacks recommended by neldredge-unco and a canary build began to download but ultimately failed. What should I do? Wait for the next build of UTM? Revert the regedit changes to go back to the Preview channel I was restricted to? Or something else?

In what way did it fail? What was the exact symptom? Are you using UTM 4.3.5 or some other version?

The Windows hardware checker (paraphrased) popped up and mentioned that the update failed because of TPM and secure boot (the 2 biggies). Same negative result on 4.3.5 and 4.4.1.

What is reported by the PC Health Check app which I mentioned above?

You might also want to double check that you typed the registry entries correctly.

[thejasonweaver]

I already detailed what the PC Health Check app reported. Attached to this reply is a screen capture in case my previous paraphrasing wasn't clear. I already triple-checked the registry edits. I entered them precisely as instructed.

[neldredge-unco]

I already detailed what the PC Health Check app reported. Attached to this reply is a screen capture in case my previous paraphrasing wasn't clear. I already triple-checked the registry edits. I entered them precisely as instructed.

Oh I see, yes, I didn't realize that by "Windows hardware checker" you referred to the PC Health Check app.

But that means that your issue is not the same as mine, since in my case PC Health Check accepted the TPM and Secure Boot, and the registry edits solved it. So I think you should open a new issue (with complete info about OS, hardware, installation procedure, etc).

[neldredge-unco]

In the VM settings, under QEMU, you do have "UEFI Boot" and "TPM 2.0 Device" checked, right?

[thejasonweaver]

UEFI Boot was checked but "TPM 2.0 Device" was not (any longer). Strange! I am now updated to Windows 11 Insider Preview Build 25951 (Canary Channel). However...my display is not rendering full screen as with previous combos of UTM and Windows. And...I am now receiving the cautionary notification, "You need to activate Windows before you can personalize your PC."

[neldredge-unco]

You have to reinstall the Spice Guest Tools after each update. That's probably the cause of the screen resolution.

Regarding activating Windows, have you entered your license key? (Even though it's prerelease software in a virtual machine, Microsoft still wants your money...)

[thejasonweaver]

Where do I find the current Spice Guest Tools?

[neldredge-unco]

https://www.spice-space.org/download.html

[neldredge-unco]

Or, following https://docs.getutm.app/guest-support/windows/, click the CD icon on the title bar while the VM is running, eject any image currently inserted, and choose Install Windows Guest Tools.