> I don't know enough about TPMs to know what stops an attacker from installing an OS on another hard drive on the same motherboard and using that to access the

> I don't know enough about TPMs to know what stops an attacker from installing an OS on another hard drive on the same motherboard and using that to access the TPM The TPM cannot prevent that, you need secure boot. That will prevent the machine to boot into another operating system. But only if you delete Microsoft's public keys from your machine. Otherwise the thief can boot Windows and all Linux distros that have a Microsoft-signed shim. Deleting Microsoft's key on a machine that is supposed to run Windows as dual boot would mean that you need to sign Windows yourself. Probably doable, but yet more hassle. So probably disk encryption with TPM, i.e. no manual disk password raises the bar enough for the average thief bringing the device to a dodgy backyard shop. But not for a somewhat dedicated attacker. No state level resources needed here at all. Given enough time I might succeed, and I have zero practical experience which such attacks, I am just a normal software developer (having worked a bit with system boot, but not a whole lot).