# How to Enable TPM 2.0 and Secure Boot for Windows 11

URL: https://www.mytechnician.tech/tips/enable-tpm-secure-boot-windows-11-upgrade/
Published: 2026-05-19 | Updated: 2026-08-10 | Author: Ankit Kumar
Tags: Windows 11, System, Troubleshooting, Hardware
Summary: PC Health Check failed for the Windows 11 upgrade? Turn on TPM 2.0, Secure Boot, and UEFI in your BIOS so the install completes on supported hardware.
Recommended app: Ultimate PC Repair Tool — https://www.mytechnician.tech/apps/my-technician/ (Microsoft Store: https://apps.microsoft.com/detail/9PH863L9C6HC?hl=en-us&cid=mytechnician-web). Optional; every step below uses built-in Windows tools.

## The Problem
Setup or PC Health Check says the machine does not meet Windows 11 requirements—almost always **TPM 2.0** or **Secure Boot** disabled in firmware. Most boards from 2016 onwards support both; they simply ship switched off on custom builds, or get switched off by a BIOS reset or a CMOS battery change.

## Do This First: Suspend BitLocker
Changing TPM or Secure Boot settings alters the measurements BitLocker seals its key against. The next boot will demand your 48-digit recovery key.

1. Open **Terminal (Admin)** and run:

```cmd
manage-bde -protectors -disable C: -RebootCount 2
```

2. Or use the GUI: **Control Panel** → **BitLocker Drive Encryption** → **Suspend protection**.
3. Note your recovery key from `account.microsoft.com/devices/recoverykey` regardless.

If you skip this and get locked out, see [fix the BitLocker recovery key loop](https://www.mytechnician.tech/tips/fix-bitlocker-recovery-key-loop-windows-11/).

## Step 1: Check What Windows Currently Sees
* Press `Win + R`, type `tpm.msc`. You want **Status: The TPM is ready for use** and **Specification version: 2.0**.
* Press `Win + R`, type `msinfo32`. Check **Secure Boot State** is **On** and **BIOS Mode** is **UEFI**.

If `tpm.msc` reports *"Compatible TPM cannot be found"*, the chip exists on most modern systems but is disabled in firmware—that is what Step 2 fixes. If **BIOS Mode** says **Legacy**, see Step 4.

## Step 2: Enable the TPM in Firmware
Restart and enter setup: tap **Del**, **F2**, **F10**, or **Esc** at power-on depending on the brand. Full details: [how to enter BIOS or UEFI settings](https://www.mytechnician.tech/tips/how-to-enter-bios-uefi-windows-11/).

The setting is rarely called "TPM". Look for the vendor's name for it:

| Platform | Setting name | Usually found under |
|---|---|---|
| Intel | **Intel Platform Trust Technology (PTT)** | Advanced → PCH-FW Configuration, or Security |
| AMD | **AMD fTPM** / **AMD CPU fTPM** | Advanced → AMD CBS → Trusted Computing, or Security |
| Dell | **TPM 2.0 Security** → **TPM On** | Security |
| HP | **TPM Device** / **TPM State** | Security → TPM Embedded Security |
| Lenovo | **Security Chip** | Security |

Set it to **Enabled**, and if there is a separate **TPM State**, set that to **Activated**. Press **F10** to save and exit.

## Step 3: Enable Secure Boot
1. In firmware, go to **Boot** or **Security** → **Secure Boot**.
2. If the option is greyed out, set **OS Type** to **Windows UEFI Mode** first, or disable **CSM / Legacy Support**—Secure Boot cannot be enabled while CSM is on.
3. If it still refuses, choose **Restore Factory Keys** or **Install default Secure Boot keys**, then enable it.
4. Save and exit.

## Step 4: If BIOS Mode Says Legacy (MBR)
Windows 11 requires **UEFI with a GPT disk**. A system installed in Legacy/MBR mode must be converted before Secure Boot will work at all.

Back up first, then from an elevated prompt inside Windows:

```cmd
mbr2gpt /validate /allowFullOS
```

If validation passes:

```cmd
mbr2gpt /convert /allowFullOS
```

Then reboot into firmware, disable CSM, set boot mode to UEFI, and enable Secure Boot. If validation fails—more than three primary partitions, or a non-standard layout—a clean install with GPT partitioning is the reliable route: [how to do a clean install of Windows 11](https://www.mytechnician.tech/tips/how-to-clean-install-windows-11/).

## Step 5: Verify and Retry the Upgrade
1. Back in Windows, re-check `tpm.msc` and `msinfo32`.
2. Open **Windows Security** → **Device security** and confirm both **Security processor** and **Secure boot** appear as on.
3. Run **PC Health Check** again, then **Settings** → **Windows Update**.

## If It Still Fails
PC Health Check reports the *first* thing that fails, so a second blocker can appear once you clear the first:

* **CPU not on the supported list** — Intel 8th generation or newer, AMD Ryzen 2000 or newer. Not fixable in firmware.
* **Less than 4 GB RAM or 64 GB storage.**
* **No UEFI firmware at all** on genuinely old hardware.

Options from there: [Windows 10 end of support: what to do now](https://www.mytechnician.tech/tips/windows-10-end-of-support-what-to-do/), or weigh the trade-offs in [install Windows 11 on an unsupported PC](https://www.mytechnician.tech/tips/install-windows-11-on-unsupported-pc/).

## Laptops
Corporate fleet machines sometimes ship with the TPM off for imaging. Consumer models almost always have PTT or fTPM available. If `tpm.msc` stays empty after enabling it, install the latest BIOS update from the manufacturer before concluding the chip is faulty—several vendors shipped firmware where fTPM was hidden until a later revision.

Some AMD boards had a well-documented fTPM stuttering bug; the fix was a BIOS update, not disabling fTPM.

## What Not to Do
* **Don't use registry bypasses for a daily-driver PC.** You lose the security guarantees the requirement exists for, and Microsoft states such installs are not entitled to updates.
* **Don't clear the TPM** unless you know what is sealed to it. Clearing it destroys BitLocker keys and Windows Hello enrolments.
* **Don't update the BIOS on battery power** or during a storm. A failed flash is a motherboard replacement.

## While You Are in Firmware
Two other settings live in the same menus and are worth setting on the same visit: hardware virtualization, needed by WSL, Docker, and virtual machines ([how to enable virtualization (VT-x / AMD-V)](https://www.mytechnician.tech/tips/how-to-enable-virtualization-vt-x-amd-v-bios/)), and the boot order, which controls whether a [dual-boot menu appears](https://www.mytechnician.tech/tips/fix-dual-boot-menu-missing-windows-11/).

Secure Boot and the TPM are also the foundation for the protections worth turning on next: [Core Isolation and Memory Integrity](https://www.mytechnician.tech/tips/enable-core-isolation-memory-integrity-windows-11/), and [Credential Guard](https://www.mytechnician.tech/tips/enable-lsa-protection-credential-guard-windows-11/) on Windows 11 Pro.

---
Source: https://www.mytechnician.tech/tips/enable-tpm-secure-boot-windows-11-upgrade/ — My Technician, free Windows 10/11 troubleshooting guides.
Related tool: Ultimate PC Repair Tool (Ultimate PC Repair Tool is a Windows diagnostic and repair toolkit with system analysis, automated troubleshooting, and hardware checks for Windows 10/11.) — https://www.mytechnician.tech/apps/my-technician/
More guides: https://www.mytechnician.tech/llms.txt