Windows 11 System Requirements: TPM 2.0, Secure Boot, and Compatibility Checks

Windows 11 setup stops at “This PC can’t run Windows 11” when one of a handful of firmware or hardware checks fails. TPM 2.0, UEFI with Secure Boot capability, and a supported 64-bit CPU cause most failures. Often the feature exists but is disabled in firmware. This guide shows how to read your actual state with PowerShell, fix what is fixable, and tell when the hardware has to change. The baseline is unchanged through the 24H2, 25H2, and 26H2 releases.

Quick Takeaways

• TPM 2.0 is mandatory. TPM 1.2 does not pass, and fTPM/PTT counts as long as it is enabled in firmware.
• UEFI Secure Boot capability is required. Secure Boot only needs to be capable, and you should still enable it.
• Legacy BIOS/CSM boot fails. The system disk must be GPT, not MBR, for the in-place conversion path to work.
• Unsupported CPUs cannot be fixed in firmware. Check the CPU against Microsoft’s supported list before touching BIOS settings.

Minimum Requirements at a Glance

Windows 10 support ended on October 14, 2025. Unsupported machines now run without regular security patches unless they are enrolled in Extended Security Updates, so the compatibility check is not optional housekeeping.

Conceptual Overview: Why These Checks Exist

What the TPM Does

The Trusted Platform Module is a hardware or firmware-backed secure enclave. It stores keys, measures boot components into PCR registers, and releases secrets only when the measured boot state matches. Windows relies on it for:

• BitLocker and Device Encryption key sealing
• Windows Hello credential protection
• Measured boot and device health attestation
• Virtualization-based security features

TPM 2.0 replaced 1.2 with modern algorithms (SHA-256, ECC) and a more flexible command set. That is why 1.2 modules do not qualify.

Discrete vs. Firmware TPM

What Secure Boot Does

Secure Boot is a UEFI feature that checks the digital signature of each boot component (bootloader, drivers, option ROMs) against keys stored in firmware (PK, KEK, db, dbx). Unsigned or revoked code does not load. It blocks bootkits that run before the OS.

Prerequisites

• An Administrator account.
• A full backup and your BitLocker recovery key if drive encryption is active. Changing TPM or Secure Boot state can trigger a recovery prompt.
• Access to the firmware setup key (F2, Del, F10, or Esc, depending on vendor).

Step-by-Step Compatibility Checks

Step 1: Run PC Health Check

Use Microsoft’s PC Health Check app for a first pass. It names the failing component but not always the fix. Continue with the manual checks below to confirm.

Step 2: Verify TPM Status

Open an elevated PowerShell window and run:

Get-Tpm

Look for these values:

• TpmPresent: True means a TPM is detected.
• TpmReady: True means it is initialized and usable.
• ManufacturerVersion helps identify firmware level.

To confirm the specification version, use:

(Get-CimInstance -Namespace root\cimv2\Security\MicrosoftTpm -ClassName Win32_Tpm).SpecVersion

The output starts with 2.0 on a compliant device. A value beginning with 1.2 fails the requirement. You can also run tpm.msc and check the Specification Version field.

Step 3: Verify UEFI and Secure Boot State

Confirm-SecureBootUEFI

• True: Secure Boot is enabled.
• False: Secure Boot is supported but off.
• Error “Cmdlet not supported on this platform”: the machine is booted in Legacy BIOS mode.

You can also run msinfo32 and check two fields:

Step 4: Check Disk Partition Style

Get-Disk | Select-Object Number, FriendlyName, PartitionStyle

The system disk must show GPT. An MBR disk needs conversion before UEFI boot works (see the troubleshooting section).

Step 5: Check CPU, RAM, and Storage

Get-CimInstance Win32_Processor | Select-Object Name, NumberOfCores, MaxClockSpeed
Get-CimInstance Win32_ComputerSystem | Select-Object @{n='RAM_GB';e={[math]::Round($_.TotalPhysicalMemory/1GB,1)}}
Get-Volume -DriveLetter C | Select-Object @{n='Size_GB';e={[math]::Round($_.Size/1GB)}}

• Get-CimInstance Win32_Processor reads the CPU model; compare it with Microsoft’s supported processor lists.
• TotalPhysicalMemory is converted to GB.
• Get-Volume reports the system volume size.

Newer feature updates also expect CPU instruction support for SSE4.2 and POPCNT. Very old CPUs without them cannot run current builds even if every firmware setting is correct.

Step 6: Combined Readiness Script

Save this as Check-Win11.ps1 and run it from an elevated prompt:

$tpm = Get-Tpm
$spec = (Get-CimInstance -Namespace root\cimv2\Security\MicrosoftTpm -ClassName Win32_Tpm -ErrorAction SilentlyContinue).SpecVersion
try { $sb = Confirm-SecureBootUEFI } catch { $sb = "Legacy BIOS / Unsupported" }
$disk = (Get-Disk | Where-Object IsBoot).PartitionStyle
$ram  = [math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory/1GB,1)
$size = [math]::Round((Get-Volume -DriveLetter C).Size/1GB)

[PSCustomObject]@{
  TPM_Present   = $tpm.TpmPresent
  TPM_Ready     = $tpm.TpmReady
  TPM_Spec      = $spec
  SecureBoot    = $sb
  BootDiskStyle = $disk
  RAM_GB        = $ram
  SystemDisk_GB = $size
} | Format-List

Run it with powershell -ExecutionPolicy Bypass -File .\Check-Win11.ps1 if script execution is blocked.

Enabling TPM 2.0 and Secure Boot in Firmware

Reach the Firmware Interface

From Windows, hold Shift and choose Restart, then go to Troubleshoot > Advanced options > UEFI Firmware Settings. Or press the vendor key at power-on.

Enable the TPM

Menu names vary by vendor:

Set the TPM to Enabled and the device type to Firmware TPM (or Discrete, if present).

Enable Secure Boot

1. Set boot mode to UEFI and disable CSM (Compatibility Support Module).
2. Open the Secure Boot menu.
3. Set Secure Boot to Enabled.
4. If the option is greyed out, choose Restore Factory Keys or Install Default Secure Boot Keys first.
5. Save and exit (F10).

Practical Troubleshooting and Real-World Scenarios

Scenario 1: Secure Boot Greyed Out Because the Disk Is MBR

The machine boots Legacy mode on an MBR disk. Convert in place without data loss using Microsoft’s tool, from an elevated prompt:

mbr2gpt /validate /allowFullOS
mbr2gpt /convert /allowFullOS

• /validate tests whether the disk layout can be converted.
• /convert rewrites the partition table to GPT and adds an EFI System Partition.
• /allowFullOS allows the run from within Windows instead of Windows PE.

Then reboot into firmware, switch the boot mode from Legacy/CSM to UEFI, and enable Secure Boot. Do not switch the boot mode before converting, or the system will not boot.

Scenario 2: TPM Shows “Not Detected” on a 2017+ PC

Most machines from roughly 2016 onward ship with a firmware TPM that is simply switched off. Enable PTT or fTPM in BIOS as shown above. If the option is missing, update the BIOS from the vendor’s support page. Some older boards need a firmware update before the setting appears.

Scenario 3: TPM 1.2 Only

Check the vendor support page for a model-specific TPM firmware conversion or a plug-in TPM 2.0 header module. Some boards support conversion; many do not. If neither exists, the device fails the requirement.

Scenario 4: CPU Not Supported

Firmware changes cannot fix this. The practical options are replacing the CPU (if the socket and BIOS allow), replacing the machine, or staying on an unsupported OS with the security risk that implies.

Scenario 5: BitLocker Recovery Prompt After Changing Settings

Changing TPM or Secure Boot state alters PCR measurements, so BitLocker may ask for the recovery key at next boot. Suspend protection first:

Suspend-BitLocker -MountPoint "C:" -RebootCount 1

• -MountPoint selects the drive.
• -RebootCount 1 keeps protection suspended for one restart, then resumes automatically.

Back up your key beforehand with manage-bde -protectors -get C:.

Scenario 6: Dual-Boot with Linux

Most mainstream distributions boot under Secure Boot using the Microsoft-signed shim. Custom kernels or out-of-tree drivers (such as some GPU or ZFS modules) need MOK enrollment (mokutil --import) or Secure Boot disabled. Confirm the distribution’s Secure Boot support before enabling it on a dual-boot machine.

Scenario 7: Bootable Media and Virtual Machines

Virtual machines need virtual TPM and UEFI firmware:

Bypass Methods and Their Trade-Offs

Registry-based bypasses (such as the LabConfig keys BypassTPMCheck and BypassSecureBootCheck under HKLM\SYSTEM\Setup) can let setup proceed on unsupported hardware. Treat them as a last resort.

Microsoft does not guarantee updates on unsupported devices, and some vendors, including Dell, state they do not provide Windows 11 drivers or support for such devices. For any production or business machine, replace the hardware instead.

Verification After Changes

Re-run Check-Win11.ps1, then confirm:

• Get-Tpm returns TpmPresent: True and TpmReady: True.
• Confirm-SecureBootUEFI returns True.
• msinfo32 shows BIOS Mode: UEFI.
• PC Health Check reports the device as eligible.

Then go to Settings > Windows Update and look for the Windows 11 upgrade offer.

Strategic FAQ

Does Windows 11 require Secure Boot to be enabled?

Setup requires Secure Boot capability: UEFI firmware that supports it. It does not strictly need the feature switched on to install. Enable it anyway, because it protects the boot chain and some games with kernel-level anti-cheat require it.

Can I run Windows 11 with TPM 1.2?

Not as a supported install. Windows 11 requires TPM 2.0. Check your vendor for a TPM firmware conversion or a TPM 2.0 module. Without one, the device is unsupported.

How do I check whether my PC has TPM 2.0?

Press Win + R, run tpm.msc, and read Specification Version. Or run Get-Tpm in an elevated PowerShell window. If no TPM appears, check the BIOS for Intel PTT or AMD fTPM.

Will Windows 11 26H2 raise the hardware requirements?

No. 26H2 keeps the same minimums as 24H2 and 25H2: TPM 2.0, Secure Boot capability, UEFI, 4 GB RAM, 64 GB storage, and a compatible 64-bit CPU. A PC that runs 25H2 can install it.