Windows 11 won’t install without TPM 2.0, and that single requirement blocks more upgrades than anything else except the CPU list. The good news is that most PCs from the last several years already have TPM 2.0 — it’s just switched off in firmware. Turning it on is usually a two-minute job, not a hardware purchase.
This guide shows how to confirm whether your machine has TPM 2.0, how to enable it in firmware (it’s almost never labelled “TPM”), and how to handle Secure Boot, which Windows 11 also requires. It also covers the one mistake that turns a quick setting change into a lockout: forgetting about BitLocker before you touch firmware.
Step 1: Check whether you already have TPM 2.0
Before changing anything, find out what’s actually there. Windows tells you in two ways.
The quickest is the TPM management console. Press Win + R, type tpm.msc, and press Enter:
Win + R → tpm.mscLook at two things in that window:
- Status — “The TPM is ready for use” means it’s already on.
- TPM Manufacturer Information → Specification Version — you want 2.0.
If you’d rather use PowerShell, open it as administrator and run:
Get-TpmGet-Tpm returns a few useful fields at once: TpmPresent, TpmReady, and TpmEnabled. If TpmPresent is True but TpmReady or TpmEnabled is False, the hardware is there and just needs enabling.
Step 2: Understand PTT and fTPM
Here’s the part that confuses people. Most modern PCs don’t have a separate physical TPM chip. Instead, the TPM 2.0 functionality is built into the CPU as firmware TPM, and each vendor gives it a different name:
What TPM is called in your firmware
| Intel platforms | PTT — Platform Trust Technology |
|---|---|
| AMD platforms | fTPM — firmware TPM |
| Some boards (either vendor) | 'Security Device Support' or 'TPM Device' |
This is why searching firmware menus for the word “TPM” often turns up nothing. You’re looking for PTT on Intel and fTPM on AMD. Both deliver TPM 2.0; enabling one of them is what satisfies the Windows 11 check on the overwhelming majority of machines.
Step 3: Enable TPM in firmware
Now into the firmware itself. The menu names vary by manufacturer, so treat these as the pattern rather than exact labels.
- Restart the PC and enter firmware setup. The key is usually
Del,F2,F10, orEscduring boot — the startup screen tells you which. - Find the relevant setting. It tends to live under Security, Advanced, or Trusted Computing:
- On Intel, enable PTT (Platform Trust Technology).
- On AMD, enable fTPM (or “AMD fTPM switch”).
- Set it to Enabled.
- Save and exit (often
F10).
Boot back into Windows, run tpm.msc again, and you should now see TPM 2.0 ready for use. If you’re chasing a Windows 11 upgrade specifically, re-run PC Health Check at this point — a lot of “incompatible” results turn green here.
Step 4: Enable Secure Boot too
TPM 2.0 is only half of what Windows 11 wants. Secure Boot is a separate requirement, and it’s worth doing in the same firmware session so you’re not rebooting twice.
- Still in firmware, find Secure Boot — usually under Boot or Security.
- Set it to Enabled.
- Save and exit.
Back in Windows, confirm it’s on. Open System Information with Win + R → msinfo32 and check the System Summary:
Win + R → msinfo32Two lines matter: Secure Boot State should read On, and BIOS Mode should read UEFI.
When TPM is on but Windows 11 still refuses
Enabling TPM 2.0 doesn’t always clear the upgrade check, and that’s expected — it’s one of three gates. If PC Health Check still fails afterwards, work through what’s left:
If the Windows 11 check still fails
- Confirm tpm.msc actually shows Specification Version 2.0 (not 1.2)
- Check Secure Boot State reads On in msinfo32 — it's a separate requirement
- Read the exact failure reason in PC Health Check, not just pass/fail
- If it names the processor, that's the CPU list — no firmware setting fixes it
The CPU is the one wall you can’t get around with settings. Microsoft’s supported-processor list is fixed, so an older-but-fast chip can be excluded even with TPM 2.0 and Secure Boot both on. If that’s your situation, your options are the unsupported-PC route (with its update caveats) or planning a hardware move — both covered in our guide on upgrading from Windows 10 to Windows 11. With Windows 10 support already ended, it’s worth deciding sooner rather than later.
A note on clearing the TPM
You’ll sometimes see advice to “clear the TPM” to fix problems. Be careful with that. Clearing the TPM wipes the keys stored in it, and if BitLocker or other features depend on those keys, you can lose access to encrypted data without the recovery key. It’s occasionally necessary, but it’s not a casual troubleshooting step — treat it as a last resort and make sure your BitLocker recovery key is in hand first.
Wrapping up
For most PCs, “enabling TPM 2.0” really means flipping on Intel PTT or AMD fTPM in firmware — the chip is already there, just dormant. Check first with tpm.msc or Get-Tpm, enable the firmware setting, turn on Secure Boot in the same session, and confirm both in Windows afterward.
The one habit that saves grief: deal with BitLocker before you go anywhere near firmware. Suspend it or have the recovery key ready, and a five-minute settings change won’t turn into a lockout. If TPM and Secure Boot are both on and Windows 11 still says no, the blocker is the CPU list, and that’s a different decision entirely.
