You need to enable Secure Boot and TPM 2.0 to install Windows 11. Otherwise the setup program will report that your hardware is not compatible. In this post, we will see how it can be done.
In late 2021, Microsoft plans to launch Windows 11 as a free update for all Windows 10 users. If you do not intend to buy a new computer running Windows 11 out of the box, you may want to double-check your PC specs and ensure it can run the latest OS from Microsoft. Even if you have a modern, powerful gaming or workstation computer, there is one thing you need to do before upgrading to Windows 11.
Windows 11 now lists TPM 2.0, Secure Boot, and UEFI mode as mandatory options to run it. While modern motherboards support all three of those, for some reason, manufacturers ship their products with TPM and Secure Boot disabled by default. Microsoft has made a new tool for checking Windows 11 compatibility. If Trusted Platform Module and Secure Boot are disabled on your machine, the compatibility check tool will tell your PC is not eligible to run Windows 11, even with the newest hardware.
How to Enable Secure Boot and TPM 2.0 to install Windows 11
Disclaimer: We cannot list all BIOS/UEFI versions in the article. Vendors equip their motherboards with different BIOS versions, UI, layouts, and capabilities. In this article, we provide you with general terminology and an idea of what to look for to enable Secure Boot and TMP 2.0 to install Windows 11. Also, we assume you know how to enter BIOS in Windows 10. If you do not know, do the following:
- Press Win + I to open Windows Settings.
- Go to Update and Security > Recovery.
- Find the Advanced Startup section and click Restart now.
- On the next Choose an option screen with a blue background, select Troubleshoot.
- Click Advanced Options.
- Click UEFI Firmware Settings.
- Click Restart.
Tip: Check out the related tutorials:
- Boot Windows 10 into Advanced Startup Options quickly
- Make shortcut to Advanced Startup options in Windows 10
The procedure above is universal for all modern computers with UEFI. You cannot install Windows 11 on a PC that does not support UEFI. Also, make sure BIOS runs in UEFI mode with CSM Mode disabled.
How to check whether my PC has TPM 2.0 and Secure Boot enabled
There is no need to enter UEFI/BIOS to check whether your computer has TPM 2.0 and Secure Boot enabled. Windows 10 has a built-in system information tool that shows you all the data you need.
- Press Win + R and enter the
- In a new window, click System Summary.
- Find the Secure Boot State line and make sure it is On.
- Next, expand Hardware Resources and click Memory.
- Find the Trusted Platform Module 2.0 State in the list of strings. Make sure its status is OK.
- Alternatively, open Device Manager and expand the Security Devices
- If you have TPM 2.0 enabled, Device Manager will list Trusted Platform Module 2.0 in the Security Devices group.
Also, check out the post Find if your Windows 10 device has TPM (Trusted Platform Module).
Enable Secure Boot to install Windows 11
Enabling Secure Boot on Intel and AMD-based PCs is an identical procedure. You need to find a section that manages boot settings, such as boot priority, CSM Mode, boot override, etc. Find the Boot section or Boot Settings, and then look for the Secure Boot option. The Boot section is one of the most popular settings in BIOS, so manufacturers tend to place it on a visible spot in the BIOS's main menu.
Make sure System mode set to User and Secure Boot is enabled.
If there is no explicit Secure Boot on/off option, look for the OS Type toggle.
Select Windows UEFI Mode.
Restart your computer. It should boot as usual, without any hiccups or issues.
Enable TPM 2.0 on an Intel-based PC
To enable Trusted Platform Module 2.0 on an Intel-based PC, you need to find the Intel PTT option. It is not a popular setting, so look for it in the Advanced section or a similar list of additional options (Security may also do the trick.)
Tip: Manufacturers nowadays offer two UEFI modes: simplified and advanced or "pro." Make sure you have "advanced" mode enabled with all the features and settings available.
In the above screenshot, you can see that Intel PTT sits in the PCH-FW Configuration section. If you cannot find Intel PTT TMP 2.0 option, refer to your motherboard's user manual or use the search option in BIOS/UEFI.
Enable TPM 2.0 on an AMD-based PC
The same idea goes for AMD. To enable TPM 2.0 on an AMD-based motherboard, find the AMD fTPM option. On a screenshot below, AMD fTPM sits in the Trusted Computing section on the Security tab.
Select Security Device Support - Enable and AMD fTPM - AMD CPU fTPM.
That is it. Now your PC is eligible to upgrade to Windows 11 when it comes out later this year.
Winaero greatly relies on your support. You can help the site keep bringing you interesting and useful content and software by using these options: