# Devices with critical credentials should be protected by TPM
Devices shown in the output are devices where a TPM (Trusted Platform Module) is not enabled, but contains credentials of critical accounts.
Source: https://maester.dev/docs/tests/MT.1088
Part of Maester · Defender · Exposure Management · All checks
```powershell title="Run this check"
Invoke-Maester -TestId MT.1088
```
## Overview
Devices shown in the output are devices where a TPM (Trusted Platform Module) is not enabled, but contains credentials of critical accounts. When critical credentials are stored on devices without a TPM enabled, it is more easy for adversaries to steal those credentials when the device is compromised.
### How to fix
Investigate the related devices and the steps that need to be taken in order to enable TPM support. This varies depending on operating system, hardware, and device. For more detailed results, you can [manually run the following query in advanced hunting](https://github.com/HybridBrothers/Hunting-Queries-Detection-Rules/blob/main/Exposure%20Management/HuntCriticalCredentialsOnNonTpmDevices.md).
## Details
Every attribute of this check
| Field | Value |
| --- | --- |
| Test ID | MT.1088 |
| Severity | Medium |
| Suite | Maester |
| Product | Defender |
| Feature | Exposure Management |
| Area | Devices and endpoints |
| Resource type | Device |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1552.004 Private Keys |
| PowerShell test | [Test-MtXspmCriticalCredentialsOnNonTpmProtectedDevices](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1088.ps1) |
| Services | Graph |
| Long running | Yes |
## Source
- Test: [`tests/maester/xspm/Test.MT.1088.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1088.ps1)
- Documentation: [`tests/maester/xspm/Test.MT.1088.md`](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1088.md)
