Windows 11 System Requirements Explained: What Is TPM 2.0 and Does Your PC Have It?

Quick Answer

Windows 11 requires a 1 GHz+ dual-core 64-bit CPU from Microsoft’s approved list, 4 GB of RAM, 64 GB of storage, UEFI firmware with Secure Boot, a DirectX 12-capable GPU, and TPM 2.0. TPM (Trusted Platform Module) 2.0 is a small security chip — built into most CPUs made since 2018 — that stores encryption keys for BitLocker, Windows Hello, and virtualization-based security. Most PCs from the last 6–7 years already have it, just switched off in the BIOS. You can check yours in under a minute by pressing Windows key + R, typing tpm.msc, and hitting Enter.

Windows 11 System Requirements at a Glance

Component	Minimum Requirement	Notes
Processor	1 GHz+, 2+ cores, 64-bit, on Microsoft’s approved CPU list	Generally Intel 8th Gen+ or AMD Ryzen 2000 series+
RAM	4 GB	8 GB+ strongly recommended for real-world use
Storage	64 GB or larger	SSD strongly recommended; extra space needed for updates
System firmware	UEFI, Secure Boot capable	Legacy BIOS/MBR mode will fail the check
TPM	Trusted Platform Module version 2.0	Often present but disabled by default
Graphics card	DirectX 12 or later, WDDM 2.0 driver	Nearly all GPUs from the last decade qualify
Display	720p, 9″ diagonal, 8 bits per color channel	Effectively any modern monitor
Internet & account	Required for Home and Pro edition setup	Microsoft account required during initial setup

What Is TPM 2.0, Actually?

TPM stands for Trusted Platform Module — a dedicated security chip (or a firmware equivalent) that generates, stores, and protects cryptographic keys separately from your main CPU and operating system. Think of it as a small, tamper-resistant vault: even if malware compromises Windows itself, it can’t easily extract the encryption keys sitting inside the TPM.

TPM 2.0 is the current specification version, standardized in 2014 and required by Microsoft for Windows 11. It’s what makes several core Windows security features actually secure:

• BitLocker drive encryption — TPM stores the encryption key and verifies the boot process hasn’t been tampered with before releasing it
• Windows Hello — biometric and PIN sign-in credentials are protected by the TPM rather than stored in software
• Virtualization-based security (VBS) and Credential Guard — isolates sensitive processes like credential storage from the rest of the OS, even from a compromised kernel
• Measured boot — the TPM records a cryptographic log of what loaded during startup, so security software can detect if the boot chain was tampered with (e.g., by a rootkit)

Why Microsoft Made TPM 2.0 Mandatory

Microsoft’s stated reasoning centers on ransomware and firmware-level attacks, which have both grown sharply as a share of real-world breaches. Software-only security can be bypassed by an attacker with enough access; hardware-rooted security anchored in a TPM is dramatically harder to defeat because the keys never leave the chip in usable form. Requiring TPM 2.0 as a baseline — rather than an optional feature only power users enable — was Microsoft’s way of making hardware-backed security the default for the entire Windows 11 install base, not just the security-conscious minority who’d turn it on themselves.

How to Check If Your PC Has TPM 2.0

There are three easy ways to check, from fastest to most thorough:

1. tpm.msc: Press Windows key + R, type tpm.msc, press Enter. If you see “The TPM is ready for use” along with a specification version of 2.0, you’re set.
2. Windows Security app: Open Windows Security → Device security → Security processor. This shows manufacturer, version, and status details.
3. PC Health Check app: Microsoft’s official compatibility checker evaluates your entire system — not just TPM — against all Windows 11 requirements in one pass, and tells you specifically which requirement is failing if your PC isn’t eligible.

If tpm.msc reports no TPM found, don’t assume your PC is incapable — on the large majority of systems built since roughly 2016–2018, the chip is physically present but simply disabled in the BIOS/UEFI firmware by default.

How to Enable TPM 2.0 in Your BIOS/UEFI

The exact menu location varies by motherboard and laptop manufacturer, but the general steps are consistent:

1. Restart your PC and enter BIOS/UEFI setup — usually by pressing Delete, F2, F10, or Esc repeatedly during boot (check your manufacturer’s key if unsure)
2. Look under a Security, Advanced, or Trusted Computing menu
3. On Intel systems, look for PTT (Platform Trust Technology) — this is Intel’s firmware-based TPM implementation
4. On AMD systems, look for fTPM (firmware TPM) or AMD PSP fTPM
5. Set the option to Enabled, then save and exit (usually F10)
6. Boot back into Windows and re-run tpm.msc to confirm it’s now active

Most desktops and laptops from the last several years ship with this hardware present but toggled off by default — enabling it is typically a two-minute BIOS change, not a hardware purchase.

CPU Compatibility: What Counts as “Supported”

Having TPM 2.0 enabled isn’t enough on its own — your processor also needs to appear on Microsoft’s approved CPU list. As a general (not exhaustive) guide:

• Intel: 8th Generation Core processors (Coffee Lake, launched 2017) and newer are broadly supported
• AMD: Ryzen 2000 series (Zen+, launched 2018) and newer are broadly supported
• Some specific CPU models within otherwise-supported generations were excluded, and a handful of exceptions were added later — the only reliable way to confirm your exact model is Microsoft’s official supported CPU list or the PC Health Check app

If your PC fails on CPU generation rather than just a disabled TPM setting, no BIOS change will fix it — you’re looking at either running an unsupported configuration (see below) or moving to newer hardware.

The Other Requirements People Overlook

TPM 2.0 gets most of the attention, but two other requirements quietly block upgrades just as often:

• UEFI + Secure Boot: Older systems installed in Legacy BIOS/MBR mode will fail Windows 11 setup even with a supported CPU and TPM enabled. Converting an existing Windows 10 install from MBR to GPT (Microsoft’s MBR2GPT tool handles this) and switching the firmware mode to UEFI is required first.
• Microsoft account requirement: Both Windows 11 Home and Pro now require signing in with a Microsoft account and an internet connection during initial setup — local-only accounts are no longer offered in the standard setup flow, which catches privacy-conscious users off guard.

Can You Install Windows 11 Without TPM 2.0?

Technically, yes — unofficial methods exist (registry edits before setup, or third-party tools like Rufus that patch the installation media) to bypass the TPM, CPU, and RAM checks for a clean install. Microsoft has, at times, documented its own registry-based bypass for edge cases and then later tightened or removed it in subsequent updates, so treat any bypass as an unsupported, unofficial workaround rather than a permanent option.

The real-world consequences of running Windows 11 on unsupported hardware:

• Microsoft explicitly states unsupported installs may not receive all updates, including future feature and security updates
• You lose access to hardware-backed security features the TPM requirement exists to guarantee — BitLocker, Windows Hello, and VBS may be unavailable or degraded
• Driver and firmware support from Microsoft and OEMs isn’t guaranteed on hardware Windows 11 was never validated against
• A future Windows update could break the installation entirely, with no guaranteed fix path

For a short-term test or a low-stakes secondary machine, a bypass install can be a reasonable stopgap. For a primary work or business PC, it’s a real risk — you’re trading long-term reliability and security for a hardware upgrade you’re postponing.

Buyer’s Guide: Upgrade, Enable, or Replace?

Just enable TPM in BIOS if:

• Your PC is from roughly 2016 or newer with an 8th-gen Intel or Ryzen 2000-series (or newer) CPU
• PC Health Check flags only “TPM not enabled” or “TPM not found” — not a CPU generation failure

Consider new hardware (and a fresh Windows 11 license) if:

• Your CPU predates the supported generations — no BIOS setting will fix this
• You’re still on a Legacy BIOS/MBR system and don’t want to go through a firmware mode conversion on aging hardware
• Your current PC is old enough that a clean-install bypass would just be delaying an inevitable hardware refresh

Consider a bypass install only if:

• It’s a secondary, non-critical, or test machine
• You understand and accept the update and security trade-offs above
• You’re not relying on BitLocker or Windows Hello for that device

Real-world example: A small business running five-year-old desktops with 7th-gen Intel CPUs discovers PC Health Check fails them on CPU generation, not TPM. Enabling TPM in BIOS won’t help. The realistic paths are new hardware with Windows 11 Pro preinstalled or purchased separately, or staying on Windows 10 with Extended Security Updates while budgeting for replacement — see our Windows 10 end of support guide for that option.

Why This Matters

TPM 2.0 isn’t Microsoft gatekeeping for its own sake — ransomware and firmware-level attacks are a real and growing share of security incidents, and hardware-rooted protections meaningfully raise the difficulty of both. But the requirement also means a large population of otherwise perfectly functional PCs technically don’t qualify for Windows 11, which is exactly why understanding the difference between “TPM disabled” (a two-minute BIOS fix) and “CPU unsupported” (a hardware decision) matters before you spend money or time on the wrong fix.

Frequently Asked Questions

What is TPM 2.0 in simple terms?

TPM 2.0 is a small security chip (or firmware equivalent) that generates and stores encryption keys separately from your operating system, making features like BitLocker drive encryption and Windows Hello sign-in significantly harder for malware or attackers to compromise.

How do I know if my PC has TPM 2.0?

Press Windows key + R, type tpm.msc, and press Enter. If it shows “The TPM is ready for use” with specification version 2.0, you have it enabled. If it shows nothing, it may simply be disabled in your BIOS rather than physically absent.

Can I enable TPM 2.0 without buying new hardware?

Often, yes. Most PCs built since roughly 2016–2018 have TPM 2.0 hardware built into the CPU (Intel PTT or AMD fTPM) but disabled by default. Enabling it is usually a BIOS/UEFI setting change under Security or Advanced settings — no purchase required.

What happens if my CPU isn’t on Microsoft’s supported list?

Enabling TPM won’t help — CPU generation is a separate requirement. You’d need either new hardware with a supported CPU or an unofficial bypass install, which comes with update and security trade-offs Microsoft explicitly warns about.

Is it safe to bypass the TPM requirement?

It works technically, but Microsoft states unsupported installs may not receive all updates, and you lose access to the hardware-backed security features TPM 2.0 enables. It’s a reasonable choice for a secondary or test machine, riskier for a primary or business PC.

Does every Windows 11 PC need Secure Boot too?

Yes. UEFI firmware with Secure Boot capability is a separate, mandatory requirement alongside TPM 2.0. Systems still running Legacy BIOS/MBR mode need to convert to UEFI/GPT before Windows 11 setup will proceed.

Do I need a Microsoft account to install Windows 11?

For standard Home and Pro setup, yes — an internet connection and Microsoft account sign-in are required during initial setup. This is a separate requirement from TPM and hardware compatibility.

What’s the difference between Intel PTT and a physical TPM chip?

Both satisfy the TPM 2.0 requirement. A physical (discrete) TPM is a separate chip on the motherboard. Intel PTT and AMD fTPM are firmware-based implementations built into the CPU itself — functionally equivalent for Windows 11 purposes, and now far more common than discrete TPM chips in modern systems.

Will enabling TPM 2.0 erase my files?

No. Enabling TPM in BIOS is a firmware setting change and does not affect files on your drive. However, if BitLocker encryption is later enabled using that TPM, losing your recovery key afterward could make data inaccessible — always save the BitLocker recovery key somewhere safe if you turn encryption on.

How much RAM and storage does Windows 11 actually need for good performance?

The official minimum is 4 GB RAM and 64 GB storage, but that’s barely usable in practice. 8 GB RAM and an SSD with at least 100 GB free are realistic minimums for smooth day-to-day use, especially after Windows updates and installed applications consume storage over time.

Can I check Windows 11 compatibility without installing anything?

Yes — Microsoft’s free PC Health Check app scans your entire system against every Windows 11 requirement at once and tells you specifically which one is failing, rather than making you check TPM, CPU, and firmware settings separately.

Does a Windows 11 license key work if my hardware isn’t officially supported?

The product key itself will activate Windows 11 regardless of hardware — activation and hardware eligibility are separate systems. But without meeting the official requirements, you’d need a bypass install method, with the update and support caveats described above.

Conclusion: Windows 11 Requirements and TPM 2.0

Most PCs that fail the Windows 11 compatibility check aren’t actually incapable — they simply have TPM 2.0 switched off in the BIOS, which is a two-minute fix, not a hardware purchase. The real dividing line is CPU generation: if yours predates Microsoft’s supported list (roughly 8th-gen Intel or Ryzen 2000-series and newer), no firmware setting will change that, and you’re choosing between new hardware, staying on Windows 10 with Extended Security Updates, or an unofficial bypass with real trade-offs. Check first with tpm.msc or PC Health Check before assuming you need to spend anything at all.

Ready to Upgrade? Get a Genuine Windows 11 License

Once your PC checks out — TPM enabled, supported CPU, UEFI active — you’ll need a genuine Windows 11 license to activate.

• Windows 11 Pro OEM Product Key — the cheapest genuine option for a single PC
• Windows 11 Pro Product Key — 5 PC License — for households or small offices upgrading multiple machines
• Ultimate Home Bundle — Windows 11 Home + Office 2021 Home & Student — for home users who don’t need Pro-only features

Not sure which edition you actually need? Read our Windows 11 Home vs Pro comparison and our step-by-step activation guide before you buy.

]]>