Windows 11 Says Your PC Isn't Ready? How to Check and Turn On TPM 2.0 and Secure Boot
Note: Some future links on this site may be affiliate links. We never claim hands-on testing; guides are researched from the public sources listed in each article.
How we wrote this: A summary of Microsoft Support's pages on enabling TPM 2.0, Windows 11 and Secure Boot, the PC Health Check app and Windows 11 system requirements, plus Microsoft Learn's MBR2GPT page (linked below), checked October 29, 2026. Firmware menus differ by manufacturer; if you're unsure, use your PC maker's support pages.
A common surprise when moving off Windows 10 is a "this PC doesn't meet the requirements" message on a computer that seems perfectly fine. Often the hardware is capable and two settings are simply off: TPM 2.0 and UEFI with Secure Boot. (For the bigger decision of upgrading, buying new or staying put, see Windows 10 end of support: your options.)
Why Windows 11 wants these
Microsoft's requirements list TPM version 2.0 and UEFI, Secure Boot capable firmware, alongside the processor, 4 GB of memory and 64 GB of storage. Microsoft says TPM 2.0 is a building block for security features such as Windows Hello and BitLocker (see turning on disk encryption). Secure Boot helps stop malicious software from loading during startup by allowing only trusted, digitally signed software to run.
Microsoft says most PCs shipped in the last five years can run TPM 2.0, but some aren't set up to. It specifically notes that most retail motherboards used in self-built PCs ship with TPM turned off even though it's almost always available.
Note: the processor requirement is different. Microsoft says clock speed and core count are built into the chip and can't be upgraded. If your CPU isn't on Microsoft's approved list, these settings won't fix that.
Step 1: Ask PC Health Check what's wrong
Microsoft's PC Health Check app runs an eligibility check and tells you why a device is or isn't eligible. Search for "PC Health Check" on the taskbar; if it isn't installed, Microsoft links to a download. Select Check now. If only TPM or Secure Boot is flagged, keep reading.
Step 2: Check your TPM
Microsoft gives two ways:
Option 1: Windows Security Go to Settings > Update & Security > Windows Security > Device security.
- No Security processor section? Your PC may have a TPM that's disabled.
- If you see Security processor details, open it and check that the Specification version is 2.0. Below 2.0 doesn't meet the requirement.
Option 2: tpm.msc
Press Windows key + R, type tpm.msc and select OK.
- "Compatible TPM cannot be found" means the TPM may be disabled.
- If it says the TPM is ready, check Specification Version under TPM Manufacturer Information.
Step 3: Get into your firmware (UEFI) settings
TPM and Secure Boot are firmware settings, not Windows settings. Microsoft's route from Windows:
- Save your work.
- Open Settings > Update & Security > Recovery (on Windows 11: Settings > System > Recovery) and select Restart now under Advanced startup.
- Choose Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.
Step 4: Turn on the TPM
Microsoft says the TPM option is sometimes in a submenu labeled Advanced, Security or Trusted Computing, and may be called:
| You might see | Typically on |
|---|---|
| Intel PTT / Intel Platform Trust Technology | Intel systems |
| AMD fTPM switch / AMD PSP fTPM | AMD systems |
| Security Device, Security Device Support, TPM State | Various makers |
Enable it, save and exit, then repeat Step 2 to confirm version 2.0.
Step 5: UEFI mode and Secure Boot
Microsoft's Secure Boot page says that to change these settings you may need to switch the boot mode from Legacy BIOS (also called CSM) to UEFI. If both are offered, choose UEFI as the first or only option.
Two cautions:
- For the upgrade itself, Microsoft only requires the PC to be Secure Boot capable (UEFI enabled). It suggests also turning Secure Boot on for better security.
- Check how your system disk is set up before you flip the switch. A Windows install on an older MBR-style disk is set up for Legacy boot. Microsoft's MBR2GPT tool converts a system disk to the GPT style without deleting data, and its documentation says the firmware must then be reconfigured to boot in UEFI mode. Do the conversion and the firmware change as a pair, following Microsoft's or your PC maker's instructions, and back up first.
Microsoft also notes it is updating Secure Boot certificates originally issued in 2011, which begin expiring in June 2026; on a supported version of Windows that update happens automatically.
Step 6: Re-check, then wait for Windows Update
Run PC Health Check again. Microsoft's advice after changing hardware settings: wait to upgrade until Windows Update tells you Windows 11 is ready for your device. The upgrade through Windows Update needs Windows 10 version 2004 or later. If your PC is managed by an employer's IT team, ask them first.