+
+ | Name |
+ AzStackHci_Hardware_Test_Tpm_Version (aggregated as AzStackHci_Hardware_TpmVersion) |
+
+
+ | Display name |
+ TPM Version (the aggregated name shown in the portal). The per-machine result JSON and event log carry the verbose form Test TPM Version <machine>; both refer to this same check. |
+
+
+ | Validator / test |
+ Test-TpmVersion (run with Invoke-AzStackHciHardwareValidation) |
+
+
+ | Component |
+ Hardware (Environment Validator / Environment Checker) |
+
+
+ | Severity |
+ Critical: this validator blocks deployment until the machine's TPM reports specification version 2.0. |
+
+
+ | Requirement |
+ Each machine must have a TPM that reports specification version 2.0 (TPM 2.0) before deployment. |
+
+
+ | Applicable Scenarios |
+ Deployment and Add Node (pre-deployment readiness validation). |
+
+
+ | Affected Versions |
+ Azure Local, version 23H2 and later. |
+
+
+
+## Overview
+
+This validator checks that each Azure Local machine has a **Trusted Platform Module (TPM)
+that reports specification version 2.0**. TPM 2.0 is part of the Azure Local hardware
+security baseline: it is the hardware root of trust that backs measured boot, BitLocker
+key protection, and the platform's attestation and secured-core features. The check fails
+when a TPM is present but reports a specification version other than 2.0 (for example a
+module in TPM 1.2 mode).
+
+It runs by reading the `Win32_Tpm` instance from each machine
+(`Get-CimInstance -Namespace root/cimv2/Security/MicrosoftTpm -ClassName Win32_Tpm`) and
+comparing the **first segment of the reported `SpecVersion`** to `2.0`. A machine whose
+TPM reports `2.0` is a **SUCCESS**; a machine whose TPM reports a different version (such
+as `1.2`) is a **FAILURE**.
+
+> **Important coverage note.** This check evaluates the TPM **version** only. If no TPM is
+> present at all, `Win32_Tpm` returns nothing and this specific check does not raise a
+> failure. Whether the TPM is **present and enabled** is covered by the companion check
+> `AzStackHci_Hardware_TpmProperties` (`Test-TpmProperties`), which fails when a TPM is
+> missing or disabled. If you are investigating a TPM problem, check both.
+
+While this check is failing, deployment is blocked at the Hardware validation stage and
+the machine cannot proceed. Unlike a software setting, the fix is a **firmware and
+hardware** change that is specific to your server model, and on some platforms it is
+limited, irreversible, or not possible at all (see [How to fix it](#how-to-fix-it)).
+
+This check runs during **pre-deployment validation** (the Deployment and Add Node readiness
+checks), so the machine it evaluates is normally a **host being validated to become a cluster
+node**, not an existing cluster member. The remediation is usually short (set the TPM to 2.0
+in firmware and re-validate), but two cautions apply: a host being vetted may have been
+**recycled from another project and could already have BitLocker enabled**, and the
+cluster-drain precaution is needed only if the machine is already a live, deployed member.
+
+## Where this failure appears
+
+You can see this failure in two places, the Azure portal and the machine itself. Both
+show the same underlying result.
+
+### In the Azure portal
+
+This check runs during the deployment validation step. When you deploy Azure Local from
+the portal (or with a deployment template), the **Validation** phase runs the
+environment checks and lists any that fail:
+
+1. Open the Azure Local deployment for your cluster and go to its **Validation**
+ results (the deployment surfaces these before it proceeds to apply).
+2. In the list of checks, this one appears under its display name, **TPM Version**, with
+ a **Critical** severity.
+3. Select the failing check to see the per-machine detail, which names the machine whose
+ TPM is not reporting version 2.0.
+
+### On the machine
+
+Two on-box sources carry the result.
+
+**Run the single validator (fastest).** The Environment Checker module ships on every
+Azure Local machine, so you can run this one Hardware check directly and read the result
+in a few seconds. Use `-Include Test-TpmVersion` to run only this check, so you do not
+have to run the full Hardware validation suite:
+
+```powershell
+$r = Invoke-AzStackHciHardwareValidation -Include Test-TpmVersion -PassThru
+$r | Select-Object Name, Status, Severity
+$r.AdditionalData.Detail
+```
+
+You can also read the underlying values directly:
+
+```powershell
+# Presence / enabled state (covered by Test-TpmProperties, shown here for context).
+Get-Tpm | Select-Object TpmPresent, TpmReady, TpmEnabled
+
+# The version this check evaluates. It compares the FIRST comma-separated segment
+# of SpecVersion to '2.0' (for example "2.0, 0, 1.59" passes; "1.2, ..." fails).
+(Get-CimInstance -Namespace 'root/cimv2/Security/MicrosoftTpm' -ClassName Win32_Tpm).SpecVersion
+```
+
+A machine whose TPM reports a non-2.0 version returns `Status` of `FAILURE` and a detail
+line of the form:
+
+```
+Machine: AzL-Node-01, Class: Tpm, Manufacturer ID: 1314145024 Tpm version is 1.2. Expected 2.0
+```
+
+**Event log (per machine).** The Environment Checker writes every check result to the
+**AzStackHciEnvironmentChecker** event log, located at
+`C:\Windows\System32\winevt\Logs\AzStackHciEnvironmentChecker.evtx`. Each result is the
+JSON body of an **Event ID 17205** entry. To read this check's most recent result on a
+machine:
+
+```powershell
+Get-WinEvent -LogName AzStackHciEnvironmentChecker -FilterXPath '*[System[(EventID=17205)]]' -MaxEvents 2000 |
+ Where-Object { $_.Message -match 'AzStackHci_Hardware_Test_Tpm_Version' } |
+ Select-Object -First 1 -ExpandProperty Message
+```
+
+In both sources the result for this check looks like this:
+
+```json
+{
+ "Name": "AzStackHci_Hardware_Test_Tpm_Version",
+ "Title": "Test TPM Version",
+ "DisplayName": "Test TPM Version AzL-Node-01",
+ "Severity": "Critical",
+ "Status": "FAILURE",
+ "Description": "Checking TPM for desired version (2.0)",
+ "TargetResourceName": "Machine: AzL-Node-01, Class: Tpm, Manufacturer ID: 1314145024",
+ "Remediation": "https://aka.ms/hci-envch",
+ "AdditionalData": {
+ "Source": "Version",
+ "Resource": "1.2",
+ "Detail": "Machine: AzL-Node-01, Class: Tpm, Manufacturer ID: 1314145024 Tpm version is 1.2. Expected 2.0",
+ "Status": "FAILURE"
+ }
+}
+```
+
+> **A note on names across surfaces.** The portal shows the aggregated display name
+> **TPM Version**, while the per-machine result JSON and the event log carry the verbose form
+> **Test TPM Version `