This PC Can't Run Windows 11? How to Fix the TPM and Secure Boot Errors

You went to upgrade a working Windows 10 machine to Windows 11 — for free — and instead got "This PC doesn't meet the minimum system requirements for running Windows 11." It feels like a wall, and the internet is full of scary registry hacks and "force install" tricks. Take a breath: for most people the block is one of two security features — TPM 2.0 or Secure Boot — that are present on the PC but simply switched off in its firmware. Turning them on is free, takes a few minutes, and is exactly what Microsoft intends. This is the year to sort it, too: Microsoft ended free support for Windows 10 on October 14, 2025, and the free one-year security bridge (ESU) closes on October 13, 2026, so drifting on an unpatched Windows 10 isn't a great place to sit.

The honest catch is that one requirement — a supported processor — can't be switched on. So this guide does two things: finds the exact reason your PC is blocked, walks you through fixing the ones that are fixable, and tells you straight what your real options are if it turns out to be the CPU.

First: find the exact reason — don't guess

The single most useful step is to stop guessing and get the specific reason your PC fails. Microsoft's free PC Health Check app does exactly that: install it, open it, and click "Check now" under the Windows 11 banner. Instead of a vague "not compatible," it names the precise requirement that isn't met — "TPM 2.0 must be supported and enabled," "The PC must support Secure Boot," "The processor isn't currently supported," and so on. That one line decides everything that follows, because a TPM or Secure Boot message is usually a two-minute fix, while a processor message is a different conversation entirely.

It helps to know what the full list even is. Windows 11's official minimums are: a compatible 64-bit processor (1 GHz or faster, 2+ cores) that's on Microsoft's supported list, 4 GB of RAM, 64 GB of storage, firmware that is UEFI and Secure Boot capable, TPM 2.0, and a DirectX 12-capable graphics chip. Most machines from roughly 2018 onward tick every box — the two that trip people are almost always TPM and Secure Boot, and both are usually just turned off.

Fix #1: turn on TPM 2.0 (it's probably already there)

TPM stands for Trusted Platform Module — a small security chip Windows 11 uses to protect things like sign-in and encryption. Here's the part that saves most people a panic: the vast majority of PCs from the last several years already have TPM 2.0 built into the processor, it's just disabled out of the box. So before anything drastic, check what you actually have. Press Windows key + R, type tpm.msc, and press Enter. If it says "The TPM is ready for use" and shows Specification Version 2.0, you're done — TPM isn't your problem. If it says "Compatible TPM cannot be found," it's almost certainly present but switched off in the firmware.

To turn it on, you go into the PC's firmware (BIOS/UEFI) settings — the easiest way in from Windows is Settings → System → Recovery → Restart now next to "Advanced startup," then Troubleshoot → Advanced options → UEFI Firmware Settings. Inside, look under a Security or Advanced tab for a setting called TPM, "Security Device," or the maker's brand name for it: on Intel systems it's often "Intel PTT" (Platform Trust Technology), and on AMD systems it's "AMD fTPM" or "AMD CPU fTPM." Set it to Enabled, then save and exit (usually F10). Back in Windows, run tpm.msc again to confirm it now reads 2.0. If the firmware menus look unfamiliar, this is a fine moment to have a person do it — a wrong setting elsewhere in BIOS can cause other headaches.

Fix #2: turn on Secure Boot

Secure Boot is a firmware feature that stops malicious code from loading before Windows even starts. To check whether it's on, press Windows key + R, type msinfo32, press Enter, and look at "Secure Boot State" — On, Off, or Unsupported. If it's Off, you enable it in the same firmware settings as above: find "Secure Boot" (usually under a Boot, Security, or Authentication tab), set it to Enabled, save, and exit.

Sometimes Secure Boot is greyed out and won't switch on. That's the sign of an older setup: the PC is running in "Legacy" BIOS mode with an MBR-style disk, and Secure Boot only works in the newer UEFI mode. Converting an existing Windows install from Legacy/MBR to UEFI/GPT is possible without wiping it (Windows has a built-in tool called mbr2gpt), but it is genuinely the one step here where a mistake can leave the machine unbootable — and it requires turning BitLocker off first, having your recovery key handy, and flipping the firmware from Legacy to UEFI at exactly the right moment. Before you touch any of that, make a full backup, and honestly, this is the point to bring it to us rather than follow a forum thread. It's a routine job with the right prep and a nasty one without it.

When it's really the processor (the one you can't flip)

If PC Health Check says the processor isn't supported, no firmware switch will change that — this is the requirement that genuinely blocks older machines. Microsoft's supported list starts at Intel 8th-generation Core chips (2017-2018 era) and AMD Ryzen 2000-series or newer; a perfectly good 6th- or 7th-gen Intel laptop or a first-gen Ryzen simply isn't on it, TPM and Secure Boot or not. That's not something wrong with your PC — it's Microsoft drawing a hardware line.

Two of the other requirements are fixable even though they aren't settings: if you're short on RAM (under 4 GB) or storage (under 64 GB free), adding memory or freeing up / upgrading the drive can get you over the bar on a machine that's otherwise supported — often a cheap upgrade on a desktop or an older laptop. But a genuinely unsupported CPU is the honest end of the road for a free, supported upgrade, and it's worth knowing that before you sink time into workarounds.

"But I've seen ways to force it on anyway"

You have, and they exist — a registry tweak (adding a value called AllowUpgradesWithUnsupportedTPMOrCPU) or tools like Rufus that build install media which skips the checks. It's important to separate two very different things here. Enabling TPM and Secure Boot in your firmware, as above, is legitimate — you're turning on hardware you already have. Bypassing the checks to install Windows 11 on hardware Microsoft doesn't support is a different bargain, and Microsoft spells out the terms itself.

When you go that route, Windows shows a disclaimer that your PC "will no longer be supported and won't be entitled to receive updates." In Microsoft's own words, these devices aren't guaranteed to get updates — including security updates — a watermark appears on the desktop, and any damage from the incompatibility isn't covered under the manufacturer's warranty. It can work, and some people run it happily, but you're trading away the exact thing you were trying to protect by leaving Windows 10 — a steady stream of security patches. Go in with eyes open, not because a video made it look free of downsides.

So what should you actually do?

Work it in this order. Run PC Health Check to get the specific reason. If it's TPM or Secure Boot, turn them on in the firmware — that's the happy ending most people get, and the upgrade to Windows 11 goes through for free. If it's RAM or storage on an otherwise-supported machine, a small upgrade fixes it. If it's the processor, the switch you're looking for doesn't exist, and forcing it means running unsupported.

For a truly unsupported PC you have three sensible paths, and none of them is "stay on unpatched Windows 10 forever." You can enroll in Microsoft's free ESU bridge to keep getting security updates through October 13, 2026 while you plan (see our Windows 10 guide for how). You can move to a new machine — a good moment to make sure you get an SSD and enough memory. Or, if the PC is only used for web and email, a lightweight system like ChromeOS Flex or a friendly Linux keeps the hardware useful and secure well past what Windows 11 would allow. The wrong move is doing nothing.

How we can help

Most "This PC can't run Windows 11" blocks are a five-minute fix once you know which setting to flip — but the firmware menus are unfamiliar territory for a lot of people, and the Legacy-to-UEFI conversion is one you really don't want to get wrong without a backup. That's the kind of thing we do all day.

We help folks across Southern California and the Coachella Valley check whether a PC can upgrade for free, turn on TPM and Secure Boot safely, handle the UEFI conversion with your data backed up first, and — when the processor simply won't qualify — lay out the honest options: the free security bridge, the right new machine, or a lightweight OS on the old one. We don't sell hardware or "PC fixer" downloads, so the advice stays independent about which path actually fits your computer.