TPM and Secure Boot Are Often Settings; the CPU Is Not

When Windows says “This PC can’t run Windows 11”, Microsoft’s free PC Health Check app names the requirement it failed, and the three Microsoft’s own pages single out are the processor, TPM 2.0 and UEFI with Secure Boot capability. The TPM and Secure Boot checks often fail because of a firmware setting you can change; Microsoft calls the processor “a main determining factor” and says it cannot be upgraded.

Find out which check failed

Install PC Health Check from aka.ms/GetPCHealthCheckApp and select Check now. Microsoft says it explains why the PC is or is not eligible, and what you can do about it. Settings › Update & Security › Windows Update gives the same verdict with less detail.

PC Health Check does not test the graphics card or display, which Microsoft says most compatible PCs meet anyway. The PC also needs Windows 10 version 2004 or later to upgrade through Windows Update.

Requirement	How to check	Can you change it?
Processor on Microsoft’s list	PC Health Check	No. Microsoft says it is not upgradable
TPM 2.0	Windows Security, or tpm.msc	Often: switched off in firmware. A TPM below 2.0 does not qualify
UEFI, Secure Boot capable	PC Health Check	Usually: a firmware boot-mode setting
4GB RAM, 64GB storage	Settings › System › About	Sometimes, Microsoft says, by upgrading parts
DirectX 12 graphics, 720p screen over 9 inches	Not checked by PC Health Check	Rarely an issue, per Microsoft

If RAM is the problem, this check shows whether your laptop can take more.

TPM 2.0: often present but switched off

Microsoft’s TPM article says retail motherboards bought by people building their own PC ship with TPM turned off by default, “even though it is almost always available to be enabled”. A TPM that is off looks like a TPM that is missing.

Check it, either way:

1. Open Settings › Update & Security › Windows Security › Device Security. If there is no Security processor section, the TPM may be disabled. If there is, select Security processor details and read Specification version.
2. Or press Windows+R, type tpm.msc and select OK. “Compatible TPM cannot be found” may mean a disabled TPM. If it reports the TPM is ready, read Specification Version under TPM Manufacturer Information.

A version below 2.0 does not meet the requirement, Microsoft says.

Switch it on:

1. Go to Settings › Update & Security › Recovery and select Restart now under Advanced startup.
2. Choose Troubleshoot › Advanced options › UEFI Firmware Settings › Restart.
3. Look in a menu labelled Advanced, Security or Trusted Computing.
4. Enable the option, which Microsoft says may be called Security Device, Security Device Support, TPM State, AMD fTPM switch, AMD PSP fTPM, Intel PTT or Intel Platform Trust Technology.

Menus vary by maker. Microsoft points to Asus, Dell, HP, Lenovo and Surface support pages for model-specific steps.

Secure Boot: the requirement is UEFI mode

Microsoft’s Secure Boot article says the upgrade needs only that the PC be “Secure Boot capable by having UEFI/BIOS enabled”. In practice that means the firmware must boot in UEFI mode, not Legacy BIOS, which some menus call CSM. Turning Secure Boot itself on is recommended, not required.

The firmware menu is reached the same way as for the TPM. Where both UEFI and Legacy/CSM are enabled, Microsoft says to make UEFI the first or only option.

Check the disk before you switch. Microsoft’s deployment documentation says an installed copy of Windows boots in the mode it was installed with, and that switching modes afterwards may need its MBR2GPT tool.

1. Right-click Start and open Disk Management.
2. Right-click the system disk, choose Properties, then the Volumes tab.
3. Read Partition style. GPT is the style UEFI boots from. MBR means the disk needs converting first.

MBR2GPT ships in Windows and, per Microsoft, converts a system disk from MBR to GPT without deleting data; after it runs, the firmware has to be set to UEFI. If BitLocker is on, Microsoft says protection must be suspended for the conversion.

The processor: hardware you cannot switch on

Microsoft’s requirement is a 1GHz-or-faster chip with two or more cores that appears on its approved list. Its original Windows 11 lists start at Intel’s 8th-generation Core processors and AMD’s Ryzen 2000 series. A handful of other chips appear too, such as Intel’s Core 7000X series, so look up yours if it is close to the line.

Microsoft writes those lists for manufacturers building new PCs, and says newer chips meeting the same principles count as supported even before they are added. Lists for later versions can be shorter: the 25H2 AMD list no longer includes the Ryzen 2000 series. For an existing PC, Microsoft’s own processor page sends owners to PC Health Check rather than the lists.

After changing any setting, Microsoft says to wait until Windows Update reports that Windows 11 is ready for your device before upgrading.

What Microsoft says about installing anyway

Microsoft does not recommend installing Windows 11 on a PC that fails the requirements. Its support page says such a PC “won’t receive support from Microsoft” and is not guaranteed updates, “including but not limited to security updates”. The disclaimer you must accept adds that damage caused by incompatibility is not covered by the maker’s warranty.

Windows marks an unsupported install with a desktop watermark and may show a notice in Settings. To undo it, Settings › System › Recovery › Go back returns the PC to Windows 10, but only for 10 days after the upgrade.

That page, last updated December 2024, still recommends returning to Windows 10. Windows 10 no longer gets free updates, so a PC that cannot run Windows 11 needs Extended Security Updates, which now run to October 2027, or a replacement. If it can upgrade, remember each Windows 11 version has its own end date: 24H2 on Home and Pro stops getting updates on 13 October.

Questions people ask

Why does it say this PC can’t run Windows 11?

The PC failed at least one of Microsoft’s minimum requirements. The three Microsoft’s pages single out are the processor, TPM 2.0 and UEFI with Secure Boot capability. Microsoft’s free PC Health Check app names which one failed.

How do I enable TPM 2.0?

Open Settings › Update & Security › Recovery, choose Restart now under Advanced startup, then Troubleshoot › Advanced options › UEFI Firmware Settings. Look under Advanced, Security or Trusted Computing for an option such as Intel PTT, AMD fTPM, TPM State or Security Device.

How do I check if my PC has TPM 2.0?

Press Windows+R, type tpm.msc and press Enter. If it says the TPM is ready, read Specification Version: it must be 2.0. Microsoft says “Compatible TPM cannot be found” may mean a TPM that is switched off in firmware.

Does Secure Boot have to be turned on for Windows 11?

No. Microsoft’s requirement is that the PC be Secure Boot capable, which means running in UEFI mode rather than Legacy or CSM. Microsoft suggests turning Secure Boot on for better security, but the upgrade does not demand it.

Can I fix “Windows 11 CPU not supported”?

Not with a setting. Microsoft calls the processor a main determining factor and says its speed and core count are not upgradable. Microsoft’s lists start at Intel 8th-generation Core and AMD Ryzen 2000; for most older chips the options are a new PC or staying on Windows 10 with Extended Security Updates.

Can I install Windows 11 on an unsupported PC?

Microsoft advises against it. Its support page says such a PC is unsupported, is not guaranteed updates including security updates, and that damage from incompatibility is not covered by the maker’s warranty. Windows also adds a desktop watermark.