Can Your PC Run Windows 11? Safe Upgrades and Risks

Fourteen years after Windows 10 first shipped and exactly on schedule, Microsoft pulled the plug on mainstream support for Windows 10 on October 14, 2025 — and that has a lot of users suddenly asking whether their machines can actually be upgraded to Windows 11 despite a “This PC can’t run Windows 11” warning. The short answer: many machines flagged as incompatible are fixable without replacing major hardware, but the path matters — some fixes are safe and supported, and others are unofficial workarounds that carry real security and update risks. This feature walks through what’s blocking upgrades, the quick checks and firmware toggles that resolve most cases, the registry and installer workarounds enthusiasts use, and the trade‑offs you need to understand before you proceed. The original CNET-style how‑to that kicked this discussion off is useful background and demonstrates the exact checks and BIOS settings involved.

Background / Overview​

Microsoft’s public compatibility floor for Windows 11 is deliberate: the platform expects a modern firmware and security baseline (UEFI + Secure Boot, a Trusted Platform Module — TPM — version 2.0, and a supported 64‑bit CPU), along with minimum RAM and storage numbers. Those checks are enforced both in the automatic Windows Update rollout and in the Windows 11 setup flow. If any of those items is missing or disabled, Microsoft’s PC Health Check (PC Integrity) will show which requirement is blocking the upgrade. Microsoft’s official system requirements and the end‑of‑support timeline for Windows 10 are documented on its support pages; Windows 10’s mainstream support ended on October 14, 2025, and Microsoft offers a one‑year consumer Extended Security Updates (ESU) bridge through October 13, 2026 for those who need time to upgrade.
At the same time, the practical reality is that many “incompatible” flags are firmware or configuration issues — not missing physical chips. On the majority of desktop and laptop PCs sold in the past five to eight years you’ll find firmware TPM (fTPM), Secure Boot capability, and UEFI support already present but sometimes disabled by default. Enabling them in UEFI/BIOS and ensuring the system disk uses GPT rather than MBR will resolve the incompatibility in many cases. Multiple vendor guides and community testing confirm this.
That said, there are two clearly different categories of fixes:

• Supported configuration changes that Microsoft anticipates you may need to make (enable fTPM/PTT, switch to UEFI, enable Secure Boot).
• Unsupported workarounds (registry keys or third‑party installer tweaks) that bypass Microsoft’s checks and let Windows 11 install on hardware Microsoft says is unsupported.

This article explains both, leans on authoritative verification for the technical facts, and flags the risks and future‑update uncertainty tied to unsupported installs.

---

Why Windows 10 Reports “Incompatible”​

The compatibility checklist — the facts​

Microsoft’s published Windows 11 system requirements include:

• A compatible 64‑bit processor (1 GHz or faster, 2+ cores) that appears on Microsoft’s supported CPU list.
• 4 GB of RAM minimum and 64 GB of storage minimum.
• System firmware: UEFI with Secure Boot capability.
• Trusted Platform Module (TPM) version 2.0 (discrete TPM or firmware TPM, often called fTPM/PTT).
• Graphics: DirectX 12 / WDDM 2.x driver and a display of 720p or higher.

These are not rumor — they are the baseline Microsoft publishes and enforces. If PC Health Check reports a failure, it will list which of these items is blocking the upgrade.

Common blocking conditions​

• Secure Boot disabled or the system still in legacy BIOS/CSM mode. Secure Boot requires UEFI/GPT; legacy BIOS/MBR installs block or confuse the installer.
• TPM disabled or not provisioned. Many modern CPUs supply firmware TPM, but it must often be explicitly enabled in UEFI.
• CPU not on Microsoft’s supported processor list. This is a harder block; some older CPUs are simply not approved. Microsoft has tightened CPU instruction checks in later Windows 11 builds (for example, SSE4.2/POPCNT enforcement in newer feature updates), which makes very old processors non‑viable for the latest releases.

---

First Things First: A Safe, Minimal Checklist​

Before you do anything invasive, follow this short, verifiable sequence:

• Back up your data (image + file copy). Never skip this.
• Run PC Health Check (PC Integrity) and note the exact blocker. Microsoft’s PC Health Check app reports which requirement fails and whether a firmware switch is likely to fix it.
• From Windows, check System Information: Win+R → msinfo32. Look at:
• BIOS Mode (should be UEFI)
• Secure Boot State (On/Off/Unsupported)
• System Type (must be x64-based)
  Use Win+R → tpm.msc to open TPM Management and verify whether a TPM exists and if the Specification Version is 2.0. These are the authoritative ways to discover state without opening the case.

If the blocker is Secure Boot or TPM, there’s a real chance you can fix it in firmware without buying anything.

---

How to Enable UEFI, Secure Boot and TPM (the supported fixes)​

Entering UEFI/BIOS​

Accessing UEFI differs by vendor — common keys during boot are Del, F2, F10, or Esc. If unsure, note the BaseBoard (motherboard) manufacturer and model in msinfo32 and check the vendor’s support pages. On laptops, UEFI options commonly live in a Recovery → Advanced Startup path if a keypress is hard to time. Many vendor support pages offer step‑by‑step instructions.

Switch to UEFI (if currently legacy)​

If msinfo32 shows BIOS Mode = Legacy/CSM, you need to migrate the system disk to GPT and switch firmware to UEFI. Microsoft’s built‑in mbr2gpt utility can convert a boot disk from MBR to GPT without data loss (when used correctly), but you must follow vendor guidance and have a full backup prior to running it. After conversion, change firmware mode to UEFI-only and confirm Windows boots. Community walkthroughs and vendor documentation show this sequence repeatedly as the correct approach.

Enable TPM (fTPM / Intel PTT) and provision it​

Look for options in firmware labelled “TPM,” “fTPM” (AMD), or “Intel PTT” (Intel). Enable the setting, save and reboot. Confirm with tpm.msc that the TPM is “ready to use” and the Specification Version is 2.0. If the TPM appears as present but not provisioned, the Windows TPM management console or firmware will present a “Clear/Initialize” operation — follow vendor guidance carefully (clearing TPM can remove BitLocker keys). Microsoft’s documentation walks through this exact flow.

Turn on Secure Boot​

Once in UEFI and with the disk converted to GPT, find Secure Boot under Boot/Security settings and set it to Enabled. On some firmwares you must enroll Secure Boot keys (factory defaults) or set an administrator password before toggling. Confirm Secure Boot State = On in msinfo32. If Secure Boot cannot be enabled, check for firmware updates from your vendor — older firmware sometimes lacks proper UEFI key provisioning. Independent walkthroughs from repair and how‑to sites verify these same steps.

---

When the Firmware Fixes Don’t Work: Registry and Installer Workarounds​

If you’ve confirmed UEFI + Secure Boot + TPM are present and enabled but PC Health Check still lists a CPU compatibility block, or if your PC lacks TPM 2.0 entirely and you accept risk, there are two widely used, unsupported approaches:

1) Microsoft’s documented registry bypass for some CPU/TPM blocks​

Microsoft has made a registry key available that lets Windows 11 setup relax some checks when running Setup from within Windows. The commonly used entry is:
HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup

• Name: AllowUpgradesWithUnsupportedTPMOrCPU
• Type: DWORD (32‑bit)
• Value: 1

This key is intended for cases where at least some TPM capability exists (for example TPM 1.2) and the issue is a CPU that’s not listed. The method has been widely documented and tested by multiple outlets, but it is explicitly a workaround and may not succeed for every unsupported CPU or every Windows 11 build. Back up the registry and your system before attempting this; Microsoft community threads and tech outlets document both successes and failures.
Caution: modifying the registry can break systems. Never edit keys you don’t understand and always create an image backup first.

2) Rufus and “Extended Windows 11 Installation” installer media​

Rufus — a widely used third‑party USB creation utility — added an “Extended Windows 11 Installation” mode that builds media which inserts bypass keys (LabConfig entries such as BypassTPMCheck, BypassSecureBootCheck) into the install environment when booted. This makes clean installs (booted from USB) possible on many machines lacking TPM 2.0 or Secure Boot. Rufus’s own FAQ and multiple independent how‑tos describe the behavior and the limitations (it modifies the boot‑time environment; running Setup.exe from inside Windows bypass is a different matter). Tom’s Hardware, Lifewire and community forums offer step‑by‑step usage notes.
Important operational points:

• Rufus’ bypasses are applied when booting the machine from the USB; running setup from inside Windows may still fail unless you use other methods.
• Rufus modifies the installer to bypass checks at setup time; it does not change Microsoft’s official compatibility policy or guarantee future update entitlement.
• Use Rufus only on non‑critical machines and after backing up — community testing shows it works in many cases, but not universally.

---

Hardware options short of a full new PC​

If firmware toggles and installer tricks aren’t practical, you have a couple hardware options:

• Install a compatible discrete TPM module to a motherboard TPM header if the board supports one. Many desktop boards include an empty TPM header; you must purchase a vendor‑compatible module and follow your board manual. Compatibility is specific and not universal — modules are often manufacturer‑ or chipset‑specific.
• Replace the motherboard and CPU (desktop only) with modern parts that include fTPM/PTT and are on Microsoft’s supported CPU list. This becomes a cost vs. benefit decision; for systems older than ~6+ years, replacement hardware is often more sensible than wrestling with a cascade of firmware/driver problems.

---

The Upgrade Paths (supported and clean) — what preserves entitlement​

If your PC genuinely meets the requirements, you should use Microsoft’s supported upgrade methods so your machine remains on Microsoft’s update entitlement path:

• Windows Update: Settings → Windows Update → Check for updates. If Microsoft has staged the upgrade for your device, you’ll see “Upgrade to Windows 11 — Download and install.” This is the safest route.
• Windows 11 Installation Assistant: Microsoft’s guided in‑place upgrade tool. It downloads the update and installs while preserving apps/settings.
• Media Creation Tool or official ISO: use to make USB media for clean installs or in‑place upgrades. (Note: if the official Media Creation Tool exhibits issues on Windows 10 hosts, download the ISO directly and create media with Rufus or another trusted tool as a workaround.)

If you use the supported paths and your system meets the baseline, Microsoft will maintain update delivery and activation; unsupported installs are explicitly not guaranteed future updates or support.

---

What Microsoft Says About Unsupported Installs — and the real risk​

Microsoft’s support pages are explicit: installing Windows 11 on devices that don’t meet minimum system requirements is not recommended. Devices that don’t meet the baseline are not guaranteed to receive updates, including security updates, and may not be covered under manufacturer warranties for resulting problems. That’s the central risk. Community reports show many unsupported installs continue to receive some updates for now, but that behavior is variable and can change at Microsoft’s discretion. Treat any expectation of regular future updates on unsupported machines as uncertain.
Practical risk summary:

• Unsupported installs may run fine for a time, but Windows 11 features that rely on hardware‑anchored security (VBS, HVCI, etc.) may be limited or disabled.
• Microsoft can and has tightened checks in feature updates; what works on build X may be blocked on build Y.
• Enterprise and security‑conscious users should not use unsupported workarounds on production machines. Use ESU, replace hardware, or migrate to supported environments.

---

Step‑by‑step: A Conservative Upgrade Checklist You Can Follow Today​

• Full backup: image your system drive and copy critical files to external storage or cloud. Verify the image.
• Run PC Health Check and note the exact blocker.
• If the blocker is TPM or Secure Boot:
• Reboot to UEFI and enable fTPM/PTT.
• Convert boot disk to GPT (mbr2gpt) if needed.
• Enable Secure Boot and provision keys if requested.
• Re-run PC Health Check; if green, use Windows Update or Installation Assistant.
• If the blocker is CPU and you still want to proceed and have backups:
• Try the Microsoft registry bypass (MoSetup → AllowUpgradesWithUnsupportedTPMOrCPU = 1) only if you understand the risks. Restart and run the Windows 11 Installation Assistant or mount the ISO and run setup.exe. Back up first.
• If the machine lacks TPM and you’ll accept unsupported status:
• Create Rufus “Extended Windows 11 Installation” USB on a working PC, boot the target machine from USB, and perform a clean install. Expect to troubleshoot drivers and be prepared to restore the backup if things go wrong.
• If none of the above are viable, enroll the device in consumer ESU (if you qualify) to receive security updates through Oct 13, 2026 while you plan replacement. Microsoft documents the ESU enrollment flow and options.

---

Final analysis — Is the effort worth it?​

• If your PC is roughly six years old or newer and simply needs firmware toggles (UEFI/GPT, enable fTPM/PTT, toggle Secure Boot), yes — it’s usually worth enabling the settings and upgrading through supported channels. That preserves update entitlement and minimizes future headaches. Many users and technicians report that these steps take only minutes to complete when no hardware obstacles exist.
• If your PC lacks TPM, is locked to legacy BIOS with no UEFI option, or uses a very old CPU that fails instruction checks (SSE4.2/POPCNT), the cost‑to‑benefit of trying to retrofit may be poor. TPM modules exist for some motherboards, but compatibility and availability vary; in many cases replacing the system is cheaper and simpler than chasing an unsupported upgrade.
• If you choose an unsupported registry or Rufus path, do so only on non‑critical machines and after a verified backup. Understand you may not receive the same update cadence or support, and that Microsoft could change behavior in future updates.

---

Closing recommendations​

• Run PC Health Check and address firmware toggles first — that resolves most “incompatible” flags without drama.
• Prefer Microsoft’s supported upgrade routes (Windows Update, Installation Assistant) whenever possible; they preserve updates and support.
• If you must use an unsupported workaround: test on a spare machine, keep comprehensive backups, and be prepared to reinstall or replace hardware later. Rufus and registry tweaks are powerful tools, but they are explicitly unsupported and carry lasting uncertainty about update delivery and security posture.
• If you cannot safely upgrade now, enroll in the consumer ESU program to buy time while planning a migration to supported hardware. Microsoft’s ESU guidance explains the options and deadlines.

Windows 10’s end of support changes the incentives, but it does not mean every “incompatible” PC is dead in the water. Many users will be able to enable fTPM/PTT, switch to UEFI/GPT, enable Secure Boot, and move to Windows 11 on the supported path in minutes. For those who can’t, a measured plan — backup first, prefer supported fixes, treat workarounds as short‑term solutions — will minimize risk and keep your data safe while you decide whether to upgrade components or buy new hardware.

---

Source: CNET You Might Actually Be Able to Upgrade Your 'Incompatible' Windows 10 PC to Windows 11 for Free. Here's How