Enable TPM 2.0 in BIOS to unlock Windows 11 upgrade from Windows 10

If your Windows 10 PC is being told it’s “ineligible” for Windows 11, the fix may be a single BIOS/UEFI switch — enabling your machine’s TPM (Trusted Platform Module) support — and in many cases that alone will make the system eligible for the free Windows 11 upgrade before Windows 10 support ends on October 14, 2025. This piece walks through exactly what TPM is, why Microsoft requires it, how to check for and enable TPM (including the Intel PTT and AMD fTPM options you’ll see in many UEFI menus), what to do after you flip the switch, and the important risks and workarounds when TPM isn’t present or enabling it doesn’t solve the problem.

Background / Overview​

Microsoft’s Windows 11 upgrade path enforces a short list of minimum hardware requirements: a 64‑bit CPU with two or more cores at 1 GHz or faster, at least 4 GB of RAM, 64 GB of storage, UEFI firmware with Secure Boot capability, DirectX 12/WDDM 2.0 graphics support, and Trusted Platform Module (TPM) version 2.0. Those requirements are official and still in force.
Most modern laptops and desktops built in the last several years already meet those specs, but TPM in particular shows up in two forms: as a discrete chip soldered to the motherboard or — more commonly on mid‑range and many laptop systems — as a firmware TPM implemented by the CPU platform (Intel’s Platform Trust Technology, PTT, or AMD’s fTPM). If a device already contains TPM support but the firmware option is disabled, Windows 10 will report the device as missing TPM and refuse an in-place Windows 11 upgrade until you enable it in BIOS/UEFI. In many real‑world cases, switching a single setting in UEFI is all that’s needed. That’s exactly what several hands‑on reports and community threads document.

---

Why TPM 2.0 matters for Windows 11​

TPM is a small hardware (or firmware) secure element used to store cryptographic keys, protect measured boot and attestation, and provide a hardware root of trust for features such as BitLocker disk encryption, Windows Hello credentials, and platform integrity protections.

• Security-first rationale: Microsoft requires TPM 2.0 to underpin modern security features and combat increasingly sophisticated firmware- and boot‑level attacks. That’s the reason Microsoft doubled down on TPM as a non‑negotiable baseline for Windows 11.
• Practical effect: When TPM is present and enabled, Windows 11 can provide hardware-backed key storage and enable features that simply cannot be secured at the same level by software alone.

Those security improvements carry trade‑offs: some older hardware lacks TPM 2.0 or lacks firmware that exposes TPM functionality, which is why an otherwise capable PC can be blocked from the official upgrade pathway.

---

The key facts you must verify before trying an upgrade​

Before you touch UEFI settings, confirm the essentials:

• Windows 10 builds must be at least version 2004 (or later) to perform the official upgrade path.
• Windows 10 end of support is October 14, 2025 — after that date Microsoft will stop routine security updates for Windows 10 devices unless enrolled in Extended Security Updates (ESU). That deadline is the practical reason many users are racing to upgrade.
• If your PC fails the upgrade check, run Microsoft’s PC Health Check app for a breakdown of which requirement failed; it often reports exactly “TPM is disabled,” “TPM not found,” or “Secure Boot not enabled.”

Cross‑reference: Microsoft’s own requirements page and the PC Health Check guidance should be your first stop for authoritative, up‑to‑date status.

---

How to check whether your PC already has TPM (fast checks)​

• Open the Run box (Win + R), type tpm.msc, and press Enter. If a TPM is present and enabled, you’ll see “The TPM is ready for use” and the “Specification Version” will typically show “2.0.” If it reports “Compatible TPM cannot be found,” TPM is absent or disabled.
• Use Device Manager: expand “Security devices” and look for “Trusted Platform Module 2.0.” No listing means Windows does not see an active TPM device.
• System Information: run msinfo32 and check “BIOS Mode” (should be UEFI for Windows 11), and look for other firmware indicators. If BIOS Mode is Legacy, you’ll likely need to convert to UEFI/GPT before a supported upgrade.

If these checks suggest TPM is present but “not ready” or simply absent, your next step is to inspect UEFI.

---

How to enable TPM 2.0 in BIOS / UEFI — the practical steps​

Important: firmware menus vary by vendor and motherboard. Vendors label the TPM option differently — “TPM,” “Security Device Support,” “Intel PTT,” or “AMD fTPM” are the most common labels. The following is a general, vendor‑agnostic sequence; examples from ASUS and Intel documentation back up the wording you’ll likely see.

• Back up your data. Always do this first. UEFI changes and later upgrade steps (like converting MBR to GPT) can cause data loss if mishandled.
• Reboot and enter UEFI/BIOS:
• Immediately after powering on, press the boot/menu key shown by your PC/vendor (common keys: Del, F2, F10, Esc). If you’re unsure, check your motherboard or laptop manual or the manufacturer’s web support page.
• Find the TPM/security setting:
• Look under Security, Advanced, or Trusted Computing sections.
• Intel systems: look for “Intel PTT” or “PTT” and set to Enabled.
• AMD systems: look for “fTPM,” “AMD fTPM,” or “TPM Device Selection” and switch to “Firmware TPM” or “fTPM.”
• Save and exit:
• Usually F10 saves and exits; confirm the prompt to save changes, then reboot into Windows.
• Verify:
• Re-run tpm.msc or Device Manager. You should now see “TPM is ready for use” and Specification Version should read 2.0 if firmware implements TPM 2.0. If it does not, the platform may only support TPM 1.2 or require a BIOS update.
• If UEFI doesn’t show TPM options:
• Update your motherboard or laptop firmware (BIOS/UEFI) to the latest vendor release and retry. Some boards require a firmware update to expose fTPM/PTT options.

ASUS, Intel, and other vendors explicitly document these menu names and the enable/disable steps; their support pages are the best place to confirm the exact labels for your model.

Intel PTT vs AMD fTPM — quick note​

• Intel PTT acts like a firmware TPM and fulfills Windows 11’s TPM 2.0 requirement on Intel platforms.
• AMD fTPM is the AMD equivalent implemented in platform firmware and is commonly present on Ryzen systems; enabling it in UEFI makes Windows detect the TPM.

---

After enabling TPM: what to do next​

• Reboot into Windows and run the PC Health Check app (Settings → Windows Update → Check for updates or run the PC Health Check tool) to force a new compatibility scan. The tool should now show TPM present and may change your compatibility status.
• If Windows Update doesn’t immediately offer Windows 11:
• Install any pending Windows updates first and reboot, then check again.
• In some cases you may see a message that your device is eligible but the update isn’t yet ready — click “Check for updates” until the Windows 11 offer appears.
• If PC Health Check still reports a failure after enabling TPM:
• Confirm UEFI is in native UEFI mode (not CSM/Legacy). TPM 2.0 is not supported in Legacy/CSM mode. If your system uses Legacy BIOS + MBR, you may need to convert the system disk to GPT (Microsoft’s MBR2GPT tool can do this non‑destructively) and switch firmware to UEFI. Guides from Windows Central and Microsoft document this conversion path.

---

When enabling TPM doesn’t solve the problem​

If enabling TPM doesn’t make your PC eligible, there are three common reasons:

• CPU/feature list exclusions: some very old CPUs lack necessary instruction support (e.g., POPCNT, SSE4.2) required by later Windows 11 builds; those cannot be fixed by enabling TPM. Community testing and official notes indicate later Windows 11 24H2 builds enforced some instruction‑level checks that older chips fail to meet.
• Secure Boot not enabled or disk partitioning incompatible: if Secure Boot is off or your system uses MBR partitioning under Legacy BIOS, Windows Update may still block the upgrade until the system uses UEFI/GPT and Secure Boot is enabled. Converting MBR→GPT and enabling Secure Boot are verifiable steps you may need to take.
• TPM hardware absent: desktops sometimes expose a physical TPM header for an add‑on module; if neither discrete chip nor CPU/firmware TPM are present, you may need a motherboard‑level upgrade or a TPM module — check the motherboard vendor’s compatibility first.

---

Alternatives and workarounds — pros, cons, and risks​

If your device can’t be made eligible by enabling TPM, the community has documented several approaches; these are technology paths, not official Microsoft recommendations.

• Registry bypass (AllowUpgradesWithUnsupportedTPMOrCPU): a registry key can relax Setup checks when you run Windows Setup from within Windows and allow an upgrade on some devices. This method is widely circulated and can work for borderline setups, but it’s unofficial and may result in an unsupported configuration. Community posts explain the exact key and workflow in detail.
• Custom install media (Rufus and related tools): Rufus and other utilities can build installation media that remove or bypass hardware checks, enabling installations on unsupported hardware. This can be used for either in‑place upgrades or clean installs, and it’s especially useful for Legacy BIOS systems, but it carries the same caveat: unsupported configurations may not receive updates and may be unstable.
• Hardware upgrades: on desktops, adding a discrete TPM module (if your motherboard supports one), upgrading the CPU/motherboard, or buying a new Windows 11–ready PC are the most future‑proof solutions. OEM systems and laptops are often not upgradeable in CPU or TPM hardware, so a full device purchase may be the practical path.
• Extended Security Updates (ESU) for Windows 10: if you can’t upgrade immediately, Microsoft offers ESU options that extend critical and important security updates for a limited time — check the terms and regional availability. ESU is a bridge, not a forever solution.

Why the caution: Microsoft has stated that unsupported installations may not get updates, and it has tightened rules in successive builds, so bypasses that work today might be blocked later or leave you without security patches. Independent tech outlets and community threads have repeatedly warned that registry hacks and patched installers are a security and stability risk for production machines.

---

Practical pre‑upgrade checklist (step by step)​

• Full backup: create a system image and backup documents; treat this as mandatory.
• Run msinfo32 and tpm.msc to capture baseline state.
• Update BIOS/UEFI to the latest firmware from your vendor.
• Enable TPM (PTT/fTPM) and Secure Boot in UEFI, save, and reboot.
• Verify TPM with tpm.msc and Secure Boot in msinfo32.
• Run PC Health Check and Windows Update; install all pending updates.
• If disk uses MBR and BIOS is Legacy, consider converting to GPT with MBR2GPT (documented by Microsoft) before changing boot mode to UEFI. Backups are essential here.

---

Security and support caveats — what you must accept before enabling or bypassing anything​

• Enabling TPM itself is a low‑risk, vendor‑supported action when done through official UEFI settings; it’s the recommended route to qualifying for Windows 11. But enabling TPM can have implications for enterprise management (if the device is corporate-owned or managed) — consult your IT admin.
• Using registry bypasses or modified installers to skip TPM/CPU requirements is an advanced, partly experimental approach that can expose your machine to missing updates or unpredictable driver/firmware interactions. Microsoft’s stance is that unsupported installations may not be eligible for the full Windows Update path. Several community posts and technical guides document workarounds and emphasize the risks.
• If you proceed with a hack or a non‑standard install, maintain a robust backup strategy and be prepared to revert or rebuild if you run into driver issues, stability problems, or update blocks.

---

Real‑world evidence and anecdote — what the XDA piece and community threads are saying​

Hands‑on reports, including the XDA article that first brought this simple BIOS toggle to many users’ attention, confirm that enabling TPM in UEFI restored eligibility for Windows 11 on machines that were previously flagged as “ineligible.” These anecdotes are valuable because they reflect the typical home‑desktop scenario: hardware supports TPM in firmware, the option is disabled by default, and toggling it fixes the compatibility report. Still, these are case‑by‑case anecdotes — they’re useful for troubleshooting but should not be taken as a universal guarantee.
Community threads on Windows forums echo the same basic pattern and detail both the official route (enable PTT/fTPM) and the community workarounds for machines that truly lack TPM hardware. Those threads also provide step‑by‑step instructions, BIOS menu screenshots, and practical troubleshooting tips such as updating firmware or converting disks to GPT.

---

Bottom line — practical recommendation​

• If your PC fails the Windows 11 check with TPM missing: reboot into UEFI and look for an option labelled TPM, PTT, or fTPM. Enable it, save, reboot, and rerun the PC Health Check and Windows Update. For many users this resolves the issue quickly and painlessly.
• If your PC still fails the check after enabling TPM and updating firmware, confirm UEFI/GPT and Secure Boot status. If the hardware is too old (CPU lacking required instructions) or lacks TPM hardware entirely, plan for either a hardware upgrade, enrollment in ESU as a bridge, or a migration to a supported OS or machine.
• Avoid registry and installer bypasses on critical systems. If you decide to use them on a personal machine, understand the support and security trade‑offs and keep full backups. Community guides document these approaches but also stress the caveats.

---

Conclusion​

For a large segment of Windows 10 users running reasonably modern hardware, the gate to Windows 11 is not a new CPU or a full hardware replacement — it’s a firmware setting: enabling TPM (Intel PTT or AMD fTPM) in UEFI and ensuring UEFI/GPT + Secure Boot are active. That single BIOS/UEFI change can often clear the compatibility block and allow the official free upgrade pathway, saving time and expense. Yet it isn’t a silver bullet for every machine — old CPUs, missing firmware, or locked corporate devices still require other solutions.
Follow the checklist: back up, update firmware, enable TPM and Secure Boot, verify with tpm.msc and PC Health Check, and only resort to unsupported bypasses after you understand the security and update‑support trade‑offs. With that precautionary approach, many users can reach the Windows 11 upgrade with a single firmware flip — and do it with confidence.

---

Source: XDA Changing this one BIOS setting could let you upgrade to Windows 11 — Here's how