How to Enable TPM 2.0 and Secure Boot for Windows 11

•
Ankit Kumar
Windows 11SystemTroubleshootingHardware

The Problem

Setup or PC Health Check says the machine does not meet Windows 11 requirements—almost always TPM 2.0 or Secure Boot disabled in firmware. Most boards from 2016 onwards support both; they simply ship switched off on custom builds, or get switched off by a BIOS reset or a CMOS battery change.

Do This First: Suspend BitLocker

Changing TPM or Secure Boot settings alters the measurements BitLocker seals its key against. The next boot will demand your 48-digit recovery key.

  1. Open Terminal (Admin) and run:
manage-bde -protectors -disable C: -RebootCount 2
  1. Or use the GUI: Control Panel → BitLocker Drive Encryption → Suspend protection.
  2. Note your recovery key from account.microsoft.com/devices/recoverykey regardless.

If you skip this and get locked out, see fix the BitLocker recovery key loop.

Step 1: Check What Windows Currently Sees

  • Press Win + R, type tpm.msc. You want Status: The TPM is ready for use and Specification version: 2.0.
  • Press Win + R, type msinfo32. Check Secure Boot State is On and BIOS Mode is UEFI.

If tpm.msc reports "Compatible TPM cannot be found", the chip exists on most modern systems but is disabled in firmware—that is what Step 2 fixes. If BIOS Mode says Legacy, see Step 4.

Step 2: Enable the TPM in Firmware

Restart and enter setup: tap Del, F2, F10, or Esc at power-on depending on the brand. Full details: how to enter BIOS or UEFI settings.

The setting is rarely called "TPM". Look for the vendor's name for it:

| Platform | Setting name | Usually found under | |---|---|---| | Intel | Intel Platform Trust Technology (PTT) | Advanced → PCH-FW Configuration, or Security | | AMD | AMD fTPM / AMD CPU fTPM | Advanced → AMD CBS → Trusted Computing, or Security | | Dell | TPM 2.0 Security → TPM On | Security | | HP | TPM Device / TPM State | Security → TPM Embedded Security | | Lenovo | Security Chip | Security |

Set it to Enabled, and if there is a separate TPM State, set that to Activated. Press F10 to save and exit.

Step 3: Enable Secure Boot

  1. In firmware, go to Boot or Security → Secure Boot.
  2. If the option is greyed out, set OS Type to Windows UEFI Mode first, or disable CSM / Legacy Support—Secure Boot cannot be enabled while CSM is on.
  3. If it still refuses, choose Restore Factory Keys or Install default Secure Boot keys, then enable it.
  4. Save and exit.

Step 4: If BIOS Mode Says Legacy (MBR)

Windows 11 requires UEFI with a GPT disk. A system installed in Legacy/MBR mode must be converted before Secure Boot will work at all.

Back up first, then from an elevated prompt inside Windows:

mbr2gpt /validate /allowFullOS

If validation passes:

mbr2gpt /convert /allowFullOS

Then reboot into firmware, disable CSM, set boot mode to UEFI, and enable Secure Boot. If validation fails—more than three primary partitions, or a non-standard layout—a clean install with GPT partitioning is the reliable route: how to do a clean install of Windows 11.

Step 5: Verify and Retry the Upgrade

  1. Back in Windows, re-check tpm.msc and msinfo32.
  2. Open Windows Security → Device security and confirm both Security processor and Secure boot appear as on.
  3. Run PC Health Check again, then Settings → Windows Update.

If It Still Fails

PC Health Check reports the first thing that fails, so a second blocker can appear once you clear the first:

  • CPU not on the supported list — Intel 8th generation or newer, AMD Ryzen 2000 or newer. Not fixable in firmware.
  • Less than 4 GB RAM or 64 GB storage.
  • No UEFI firmware at all on genuinely old hardware.

Options from there: Windows 10 end of support: what to do now, or weigh the trade-offs in install Windows 11 on an unsupported PC.

Laptops

Corporate fleet machines sometimes ship with the TPM off for imaging. Consumer models almost always have PTT or fTPM available. If tpm.msc stays empty after enabling it, install the latest BIOS update from the manufacturer before concluding the chip is faulty—several vendors shipped firmware where fTPM was hidden until a later revision.

Some AMD boards had a well-documented fTPM stuttering bug; the fix was a BIOS update, not disabling fTPM.

What Not to Do

  • Don't use registry bypasses for a daily-driver PC. You lose the security guarantees the requirement exists for, and Microsoft states such installs are not entitled to updates.
  • Don't clear the TPM unless you know what is sealed to it. Clearing it destroys BitLocker keys and Windows Hello enrolments.
  • Don't update the BIOS on battery power or during a storm. A failed flash is a motherboard replacement.

While You Are in Firmware

Two other settings live in the same menus and are worth setting on the same visit: hardware virtualization, needed by WSL, Docker, and virtual machines (how to enable virtualization (VT-x / AMD-V)), and the boot order, which controls whether a dual-boot menu appears.

Secure Boot and the TPM are also the foundation for the protections worth turning on next: Core Isolation and Memory Integrity, and Credential Guard on Windows 11 Pro.

Related guides