- Status
- Offline
- Joined
- Mar 3, 2026
- Messages
- 635
- Reaction score
- 457
Stop messing with Linux flashing methods or BIOS downgrades for a second. If you're on the AM5 platform, there's a much cleaner way to handle TPM-based hardware bans that seems to have flown under the radar.
Most AM5 CPUs actually house two separate security processors: the standard AMD ASP fTPM and the newer Microsoft Pluton. While the AMD ASP identity is usually static and baked-in, the Pluton implementation behaves like a burner phone for your HWID.
The Method
Testing on a Gigabyte B850 Eagle shows that you can force a refresh of your TPM Endorsement Key simply by toggling between these processors in the BIOS. Unlike the ASP, Pluton generates a completely fresh, fully functional identity every time it's re-activated.
How to rotate your TPM identity:
Notes & Troubleshooting
I'm curious if this is a standard AMD implementation across all AM5 vendors or if Gigabyte just has a loose implementation. If you're on ASUS, MSI, or ASRock AM5 boards, check your BIOS settings and report back if Pluton is available.
Anyone tested this on the latest Vanguard update yet?
Most AM5 CPUs actually house two separate security processors: the standard AMD ASP fTPM and the newer Microsoft Pluton. While the AMD ASP identity is usually static and baked-in, the Pluton implementation behaves like a burner phone for your HWID.
The Method
Testing on a Gigabyte B850 Eagle shows that you can force a refresh of your TPM Endorsement Key simply by toggling between these processors in the BIOS. Unlike the ASP, Pluton generates a completely fresh, fully functional identity every time it's re-activated.
How to rotate your TPM identity:
- Enter your BIOS and navigate to Advanced Mode.
- Head to Miscellaneous (this may vary slightly by vendor, but look for CPU features).
- Find Trusted Platform Module (TPM).
- By default, it’s usually set to "Auto" or "AMD ASP". Flip this to Microsoft Pluton.
- Save and exit.
The AMD ASP identity returns the same ID regardless of shifts, but Microsoft Pluton seems to re-provision the identity upon activation. This gives you a clean set of TPM keys for banevading whenever you get flagged by Vanguard or EAC. It's essentially a hardware-level spoofer that doesn't require third-party drivers or risky firmware modifications.
Notes & Troubleshooting
- Tested and confirmed on Gigabyte AM5 boards.
- The identity change persists until you swap it back or reset, but re-toggling generates a new EK.
- Verify your EK via
in PowerShell before and after the swap.Code:
get-tpm
I'm curious if this is a standard AMD implementation across all AM5 vendors or if Gigabyte just has a loose implementation. If you're on ASUS, MSI, or ASRock AM5 boards, check your BIOS settings and report back if Pluton is available.
Anyone tested this on the latest Vanguard update yet?
