You can force Windows 11 onto a PC that fails the TPM 2.0, Secure Boot, or CPU-generation check. Microsoft’s installer lets you skip those checks, and the bypass still works on current builds. The catch is the support status. Microsoft says such a device gets no support and carries compatibility risk, and update delivery is not guaranteed. Decide whether the trade is worth it before you touch the registry.
Quick Takeaways
- Bypasses work, but only for soft checks. TPM 2.0, Secure Boot, RAM, storage, and CPU-model checks can be skipped. The CPU instruction requirement (POPCNT plus SSE4.2 on Intel, SSE4a on AMD) for 24H2 and later cannot.
- You lose the support guarantee. Cumulative and feature updates may stall at any time, and drivers for old hardware may never arrive.
- Windows 10 is a legitimate fallback. Consumer ESU now runs through October 12, 2027, so you have time to plan.
- Check the fixable cause first. Many “unsupported” PCs only need fTPM/PTT enabled in UEFI and an MBR2GPT conversion.
| Option | Cost | Security Updates | Risk Level | Best For |
|---|---|---|---|---|
| Fix the blocker (fTPM, UEFI, GPT) | Free | Full, supported | Low | PCs from roughly 2016 onward |
| Bypass install (registry/Rufus) | Free | Not guaranteed | Medium–High | Secondary or lab machines |
| Stay on Windows 10 + ESU | Free to ~$30 | Security only, to Oct 2027 | Medium | Buying time |
| Linux or ChromeOS Flex | Free | Full, distro-supported | Low | Old hardware, daily browsing |
| Replace the hardware | $$$ | Full, supported | Lowest | Business and primary machines |
Prerequisites: Find Out Why Your PC Fails
Run the checks before you commit to a bypass. Open an elevated PowerShell window.
# TPM presence and version
Get-Tpm
# Secure Boot state (throws an error on legacy BIOS)
Confirm-SecureBootUEFI
# Partition style: GPT is required for UEFI boot
Get-Disk | Select-Object Number, FriendlyName, PartitionStyle
# Firmware mode and CPU name
Get-ComputerInfo -Property BiosFirmwareType, CsProcessors
Get-TpmreportsTpmPresentandTpmReady. Usetpm.mscto read the spec version.Confirm-SecureBootUEFIreturnsTrueorFalse. An error means the machine boots in legacy BIOS mode.BiosFirmwareTypereturnsUefiorBios.
Then confirm the CPU supports the instruction set that every build since 24H2 needs. Download Coreinfo from Sysinternals and run:
coreinfo64.exe -f | findstr /i "POPCNT SSE4.2"
A * means the feature is present and a - means it is missing. On Linux, run grep -o -w -E 'popcnt|sse4_2' /proc/cpuinfo | sort -u.
If POPCNT or SSE4.2 shows -, stop here. No installer flag fixes a missing CPU instruction, and the OS fails to boot.
Conceptual Overview: What the Installer Actually Checks
Windows Setup runs a compatibility gate through appraiserres.dll before it copies files. The gate tests six items:
| Check | Official Requirement | Bypassable? |
|---|---|---|
| TPM | 2.0 | Yes |
| Secure Boot | Enabled, UEFI | Yes |
| RAM | 4 GB | Yes |
| Storage | 64 GB | Yes |
| CPU model | Approved list (8th-gen Intel, Ryzen 2000+) | Yes |
| CPU instructions | POPCNT + SSE4.2 / SSE4a (24H2+) | No |
The bypasses change what Setup tests. They do not change the hardware. A PC with no TPM still has no TPM after install, so BitLocker device encryption, Windows Hello with hardware-backed keys, and Credential Guard lose their hardware root of trust.
The Real Risks
| Risk | What Happens | Severity |
|---|---|---|
| Update delivery | Cumulative updates may arrive, but feature updates can be withheld. Microsoft reserves the right to stop updates. | High |
| No support | Microsoft support will decline cases on ineligible hardware. | Medium |
| Driver gaps | Vendors stop shipping chipset, GPU, and storage drivers for old platforms. Expect black screens or 0x0000007B stop codes after updates. | Medium–High |
| Reduced security baseline | No TPM-backed encryption. No VBS/HVCI on CPUs without virtualization features. | High |
| Tooling malware risk | Third-party “bypass” utilities such as Flyby11 have been flagged by Microsoft Defender. Patched ISOs from unknown sources can carry backdoors. | High |
| Policy reversal | Microsoft removed the registry how-to from its own support page in January 2025 and now advises rolling back to Windows 10. | Medium |
Microsoft’s warning is plain: ineligible hardware gets no support, and you accept the compatibility risk. Treat any bypass as a lab setup unless you can afford to reinstall.
One more timing issue matters now. Windows 11 24H2 Home and Pro reached end of service on October 13, 2026. On unsupported hardware, the move to 25H2 may not show up in Windows Update. You can end up doing a manual in-place upgrade from an ISO.
Step-by-Step: Bypass Methods
Use only ISOs downloaded from Microsoft. Verify the hash before you use it:
Get-FileHash -Algorithm SHA256 "$env:USERPROFILE\Downloads\Win11_25H2_English_x64.iso"
Compare the output against the SHA-256 value shown on Microsoft’s download page.
Method 1: Registry Bypass During Clean Install
Boot the installer USB. At the first Setup screen, press Shift+F10 to open a command prompt, then run the following.
reg add HKLM\SYSTEM\Setup\LabConfig /v BypassTPMCheck /t REG_DWORD /d 1 /f
reg add HKLM\SYSTEM\Setup\LabConfig /v BypassSecureBootCheck /t REG_DWORD /d 1 /f
reg add HKLM\SYSTEM\Setup\LabConfig /v BypassRAMCheck /t REG_DWORD /d 1 /f
reg add HKLM\SYSTEM\Setup\LabConfig /v BypassStorageCheck /t REG_DWORD /d 1 /f
reg add HKLM\SYSTEM\Setup\LabConfig /v BypassCPUCheck /t REG_DWORD /d 1 /f
/vnames the value./t REG_DWORDsets the data type./d 1turns the bypass on./foverwrites without a prompt.
Close the prompt, go back one screen, and click Install now again. The checks are skipped.
Method 2: In-Place Upgrade From Windows 10
Microsoft’s own unsupported-upgrade value only relaxes the TPM and CPU checks. It still expects a TPM 1.2 chip at minimum.
reg add HKLM\SYSTEM\Setup\MoSetup /v AllowUpgradesWithUnsupportedTPMOrCPU /t REG_DWORD /d 1 /f
Mount the ISO and run setup.exe. On 24H2 and later media, the in-place upgrade may still block you. Many users report that launching setup in server mode skips the compatibility gate:
setup.exe /product server
The /product server switch makes Setup evaluate the media as a server SKU. It still installs Windows 11 and keeps your files and apps if you choose that option.
Method 3: Rufus Custom USB
Rufus builds a normal installer USB and writes the bypass options into it.
- Start Rufus and select your USB drive.
- Choose the official ISO under Boot selection.
- Click START.
- In the customization dialog, tick Remove requirement for 4GB+ RAM, Secure Boot and TPM 2.0.
- Optionally tick Remove requirement for an online Microsoft account.
- Boot the target PC from the USB.
Rufus cannot bypass the POPCNT/SSE4.2 requirement. That limit comes from the OS code, not from the installer check.
Verification
After the first boot, confirm what you built:
# OS version and build
winver
# Which bypass keys remain from setup (they live in the installer image, not the installed OS)
reg query HKLM\SYSTEM\Setup\LabConfig
# Installed updates
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5
# Check Windows Update service state
Get-Service wuauserv, UsoSvc | Select-Object Name, Status
Run Windows Update manually after install and again after a week. A missing cumulative update on a fully patched Patch Tuesday cycle is your first sign the device is being quietly excluded.
Safer Options
Option 1: Fix the Actual Blocker
Many failures come from firmware settings, not missing chips. Enter UEFI setup and look for:
- Intel PTT (Platform Trust Technology) on Intel boards from roughly 4th-gen onward.
- AMD fTPM on Ryzen boards.
- Secure Boot and CSM settings. Disable CSM to run native UEFI.
If the disk is MBR, convert it without reinstalling:
mbr2gpt /validate /disk:0 /allowFullOS
mbr2gpt /convert /disk:0 /allowFullOS
/validatechecks that the layout can convert./convertrewrites the partition table to GPT and adds an EFI System Partition./allowFullOSpermits the run from inside Windows.
Reboot into UEFI, switch from legacy to UEFI boot, and re-run PC Health Check.
Option 2: Stay on Windows 10 With ESU
Microsoft extended consumer Extended Security Updates to October 12, 2027. Enroll under Settings > Windows Update. ESU delivers critical and important security fixes only, with no features and no technical support. It is the best option for a primary machine that cannot meet the requirements.
Option 3: Switch Operating Systems
| Option | Resource Use | Hardware Floor | Enterprise Support | Ease of Management |
|---|---|---|---|---|
| Ubuntu LTS / Linux Mint | Low–Medium | 64-bit, 4 GB RAM comfortable | Canonical (paid), community | Easy |
| ChromeOS Flex | Low | 64-bit Intel/AMD, 4 GB RAM | Google (Chrome Enterprise) | Very easy, cloud-managed |
| Windows 10 IoT Enterprise LTSC 2021 | Medium | Windows 10 hardware | Long lifecycle, volume licensing | Moderate |
Linux and ChromeOS Flex run well on hardware that Windows 11 rejects, and both keep receiving security updates.
Practical Troubleshooting
Scenario 1: Setup Says “This PC Can’t Run Windows 11” Even After the Registry Edit
You edited the wrong hive or set the key after Setup had already scanned the machine.
- Close Setup.
- Re-open the command prompt with Shift+F10.
- Run
reg query HKLM\SYSTEM\Setup\LabConfigto confirm the values exist. - Click Install now again from the first screen.
If you are upgrading from inside Windows, use setup.exe /product server instead.
Scenario 2: Boot Loop or INACCESSIBLE_BOOT_DEVICE After Install
This usually means a storage controller driver is missing or the firmware mode changed.
- Boot into WinRE (hold Shift while selecting Restart, or force three failed boots).
- Open Troubleshoot > Advanced options > Command Prompt.
- Load the vendor storage driver:
drvload X:\drivers\iaStorVD.inf. - Run
bcdboot C:\Windows /s S: /f UEFI, whereS:is the EFI System Partition.
Scenario 3: Windows Update Fails With 0x80070002 or Stalls at a Percentage
net stop wuauserv
net stop bits
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
net start bits
net start wuauserv
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow
ren ... SoftwareDistributionresets the update download cache.DISM /RestoreHealthrepairs the component store.sfc /scannowrepairs protected system files.
If the feature update still fails, download the 25H2 ISO and run setup.exe from inside Windows with /product server.
Scenario 4: You Want Out
Roll back inside the 10-day window: Settings > System > Recovery > Go back. After that window, a rollback needs a fresh Windows 10 install. Take a full image before you start:
wbadmin start backup -backupTarget:E: -include:C: -allCritical -quiet
-backupTargetis the external drive.-allCriticalincludes every volume needed to boot.-quietskips the confirmation prompt.
FAQ
Is it legal to install Windows 11 on unsupported hardware?
Yes, if you use official Microsoft media and a valid license. Microsoft does not forbid it. It only declines support and does not guarantee updates.
Will I still get security updates on unsupported hardware?
Possibly, but there is no guarantee. Many users report that monthly cumulative updates keep arriving, while feature updates can be withheld. Microsoft reserves the right to stop delivering updates to ineligible devices at any time.
Can I install Windows 11 without TPM 2.0?
Yes. The LabConfig registry keys and the Rufus bypass option both remove the TPM 2.0 check. The OS then runs without hardware-backed encryption and key storage. Your CPU must still support POPCNT and SSE4.2 (or SSE4a on AMD).
What is the safest alternative if my PC is not compatible?
Stay on Windows 10 with consumer ESU, which covers security updates through October 12, 2027. For a longer horizon, move the machine to Linux or ChromeOS Flex, or replace it with hardware that meets the requirements.
