guide · static export
Security

Check the TPM and Prepare a PC for Sale

Read the TPM state, see what is bound to it, wipe the drive the right way and leave nothing behind that points back to you.

by@guidox updated:10/31/26 time:2 h level:Intermediate tested on:Windows 11 24H2 works on:Windows 10, Windows 11 tools:PowerShell as administrator, TPM management console
TL;DR

Read the TPM with **Get-Tpm** and **tpm.msc**, reset the PC with **Remove everything > Clean data**, then clear the TPM so the keys protected by it are destroyed.

Before you start

Requirements

  • Admin rights
  • A power supply for the whole process
  • Two hours
Step by step

Instructions

01

Read the TPM state

Present and ready are two different answers. A present but not ready TPM is usually disabled in the firmware or owned by a state the OS cannot use.

Get-Tpm
02

Confirm the version

Windows 11 requires 2.0. A device that reports 1.2 is the reason setup refuses, even when the chip is enabled.

Get-CimInstance -Namespace root/cimv2/security/microsofttpm -ClassName Win32_Tpm | Select-Object SpecVersion,ManufacturerIdTxt
tipFirmware TPM, Intel PTT and AMD fTPM all work. If the version says 1.2, look for a firmware update before selling.
03

Know what the TPM protects here

Device encryption keys, the Windows Hello PIN and the certificate store are bound to it. Clearing the chip destroys those secrets, which is exactly the point before the machine leaves the house.

⚠ warningAn encrypted drive whose key is destroyed is unrecoverable. Move anything you still need off the machine before this step.
04

Unlink the device from your account

A sold machine keeps appearing in the account device list and can be reactivated with Find my device. Remove it there before the reset, not after.

account.microsoft.com > Devices > Remove device
05

Reset with clean data

The reset reinstalls Windows and offers two levels: quick erase marks the blocks free, clean data overwrites them. On an SSD clean data also triggers a proper block erase, which is what makes recovery impractical.

Settings > System > Recovery > Reset this PC > Remove everything > Clean data
⚠ warningClean data takes hours and must not be interrupted. A laptop running on battery during the image phase produces a bricked install, not a clean one.
06

Clear the TPM after the reset

The reset does not always clear the chip. Opening the management console and clearing it removes ownership and the secrets in one go; the next owner takes ownership at first setup.

tpm.msc > Clear TPM
⚠ warningDo not do this before a driven encryption is turned off. Clear first and the data on that disk is gone for good.
Troubleshooting

Common issues

The TPM is not visible at all

Disabled in the firmware, or the platform module (PTT/fTPM) is switched off. Look under Security in the BIOS before assuming a defective chip.

Clear TPM fails with access denied

The console is not elevated, or a management policy blocks it. Clear it from the firmware setup then.

Setup still complains about the TPM

The chip reports 1.2 or is not ready. Update the firmware, then check the version again.

The device is still listed in the account

Removal is delayed. The device entry disappears after the next sign-in from another machine.

FAQ

Frequently asked

Does clearing the TPM delete files?

It deletes keys. Files protected by those keys become unreadable, everything else stays.

Do I need an owner password?

No. Modern Windows owns the chip itself; the legacy owner password only exists on older firmware.

How to undo this

Clearing is one-way. The next Windows setup takes ownership again and generates fresh keys, but the old Hello PIN and old encryption keys cannot be restored.

Changelog · 1 entry
  1. 2026-10-31
    First version
Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress