TPM 2.0 and Windows 11: how to check whether you have it, and why it matters

“This PC doesn’t meet the minimum system requirements to run Windows 11.” Next to that message, three letters almost always show up — TPM. What follows is half an hour of searching online, ending in the conclusion that a new computer has to be bought.

That may not be true. Many newer computers do have the chip inside. The manufacturer just left it switched off.

The short answer: Press Win + R, type tpm.msc and confirm. In the window, look for the Specification Version line — it has to say 2.0. If you get “Compatible TPM cannot be found” instead, on many newer computers TPM is merely switched off in UEFI: Intel PTT or AMD fTPM. Flip it to Enabled and you buy nothing. Just one thing before you go into UEFI — make sure you have your BitLocker recovery key.

What TPM actually does

TPM (Trusted Platform Module) is a small security chip, or these days more likely a piece of firmware running directly inside the processor. It is a cryptographic module: it performs cryptographic operations itself, protects keys marked as non-exportable, and stores measurements of what was launched when the computer started.

In practice, three things rest on it: the key that unlocks a BitLocker-encrypted disk at start-up; signing in with Windows Hello, where TPM can protect the private key (the PIN itself and biometric data are not normally stored in the TPM); and boot integrity measurements, which protections rely on to verify that no tampered bootloader was launched.

The difference from a password stored in a file is fundamental: a properly created non-exportable key cannot be extracted from the TPM by ordinary means. If someone steals a laptop and pulls the SSD out, they will not open it on another computer without the recovery key — the TPM stayed in the original motherboard. That is exactly what encrypting a company laptop with BitLocker is built on.

For a business owner, this boils down to something simple: TPM 2.0 is not just an annoying condition for installing Windows 11, it is what holds data encryption together on a laptop that travels.

How to check it quickly

The fastest route is the TPM console:

1. Press Win + R, type tpm.msc, confirm with Enter.
2. In the TPM Manufacturer Information section, find the Specification Version line. It has to say 2.0.
3. If “Compatible TPM cannot be found” pops up instead, the chip is either missing or switched off — and the second option is far more common.

Three more places each show something slightly different, and all of them are worth going through:

Remember that last one. It is the most common dead end in this whole topic: TPM 2.0 is fine, but BIOS mode reports Legacy — and Windows 11 still will not go through. The PC Health Check app from Microsoft itself will also spell out the specific reason for the rejection.

”Module cannot be found” does not yet mean you do not have one

This is the main takeaway of the whole article. On machines from roughly 2017 onwards, TPM is not a separate board plugged into the motherboard but a function built into the processor: at Intel it is called PTT (Platform Trust Technology), at AMD fTPM (firmware TPM). Plenty of board makers ship it disabled from the factory — and the user then reads that they have to buy a new computer.

Microsoft itself points out that the item in UEFI may be called Security Device, Security Device Support, TPM State, AMD fTPM switch, AMD PSP fTPM, Intel PTT or Intel Platform Trust Technology. Where to look for it by manufacturer (names differ between firmware versions):

You can get into UEFI without guessing the boot key: Settings → System → Recovery → Restart now, then Troubleshoot → Advanced options → UEFI Firmware Settings.

Before you flip the setting, do one thing: make sure you have your BitLocker recovery key. Changes around TPM and Secure Boot can trigger a blue prompt for the 48-digit key at the next start, and without it you will not get to your data. Where to look for it is covered in our article on what to do when a disk will not unlock.

On Dell, HP and Lenovo laptops, TPM is usually enabled from the factory; we mostly run into it being switched off on custom-built desktops. Some boards let you buy a separate module for the TPM/JTPM header, but be aware that the pin count and layout are specific to the board maker, no universal part exists, and on older models they are hard to source. If the processor has fTPM or PTT, you buy nothing.

TPM is not the only gate — and often not the toughest one

The machine has to meet every condition at once:

• a processor from the supported list, 64-bit, 1 GHz and two or more cores,
• 4 GB of RAM and 64 GB of disk space,
• UEFI firmware capable of Secure Boot,
• TPM version 2.0,
• graphics with DirectX 12 and a WDDM 2.0 driver.

In practice, what stops you most often is the processor, not TPM. The line runs roughly at Intel Core 8th generation and newer (with a few exceptions from the 7th generation) and at AMD Ryzen 2000 and newer — the first generation of Ryzens is not supported. Check your specific model against Microsoft’s list; going by the name alone does not always work out.

When TPM 2.0 is enabled and the installation still will not run, go through this order:

1. msinfo32 reports Legacy for BIOS mode → the disk uses an MBR partition layout. Windows includes the mbr2gpt tool, which converts the system disk to GPT without reinstalling and without erasing data (start with mbr2gpt /validate /disk:0 /allowFullOS), then you switch booting in UEFI from CSM/Legacy to pure UEFI. Back up first. Done wrong, the machine stops starting.
2. Secure Boot is disabled → enable it in UEFI.
3. The processor is not on the list → this route takes you no further.

If that disk holds live company accounting and you do not fancy doing the GPT conversion yourself, get in touch — in Brno we do it with a backup taken beforehand and a verified start afterwards.

Four routes when a machine does not meet Windows 11

About that third route: on machines outside the requirements, Microsoft guarantees neither updates nor compatibility, and it adds a watermark to the desktop and to Settings. On a family computer that is the owner’s call. On a machine a company issues invoices from and keeps its accounting on, you are knowingly giving up the certainty that a security patch will arrive.

Two dates change the whole calculation. Mainstream support for Windows 10 ended on 14 October 2025, and both paid and free Extended Security Updates (ESU) are a bridge for a limited time — the registration screen in Settings → Windows Update will show you the current end date and terms directly, so rely on that rather than on articles; we put the context together in our piece on the end of Windows 10 support. And the second date concerns even those already on 11: Windows 11 version 24H2 stops receiving updates in the Home and Pro editions on 13 October 2026, so in about two months. Version 25H2 is distributed onto 24H2 as an enablement package; how it goes depends on the state of the system, and the version brings no new hardware requirements. The Enterprise and Education editions have a year longer.

Where TPM causes trouble instead

Stuttering on Ryzens. A documented problem with a specific cause: on some Ryzen builds, fTPM performed lengthy transactions in the SPI flash memory on the motherboard and the system stalled for a second or two while they ran. In music you heard it as a click, in games as a stutter. It is not fixed by disabling fTPM — you would lose TPM — but by updating the BIOS to a version built on AGESA microcode 1.2.0.7 or newer. Whether your board got one depends on the manufacturer.

The corrupted fTPM memory message. After a processor swap or a BIOS update, AM4 boards show a prompt at start-up saying the fTPM data is corrupted or has changed, and asking whether the firmware should reset it. A reset means deleting the keys — including the BitLocker one. If you do not know where your recovery key is, do not confirm that prompt.

The “Clear TPM” button. It looks harmless and sits within easy reach in Windows Security and in some UEFI menus. Clearing it loses every key that was in the chip — BitLocker and Windows Hello alike. If the disk is encrypted and you have the key stored nowhere, you end up in a situation nobody can solve, not even Microsoft. Back the key up before you touch anything, not after.

Encryption you do not know about. From version 24H2 onwards, Windows turns device encryption on by itself during a clean installation on an eligible machine as soon as the user signs in with a Microsoft account or a work account; the key is saved to that account. This does not happen when upgrading from an older version. So a new laptop at a company may be encrypted without anyone having deliberately switched it on — and that is something you want to find out before the moment the machine stops starting.

If you would rather not touch the settings yourself, we cover it under Windows reinstallation and setup.

When to leave it to a service shop

Enabling PTT or fTPM in UEFI is within reach of a more technically confident person and costs nothing. It belongs in a service shop when:

• there is no TPM item in UEFI at all and you need to know whether the board even supports it,
• the disk uses MBR and a GPT conversion is ahead of you on a machine with live company data,
• the machine is encrypted and nobody has the recovery key — there you first hunt for the key and valid protectors, and only then deal with Windows,
• you are asking whether it is even worth investing in the machine at all; we put the decision criteria together in our article on whether to reinstall, repair or replace.

We do this in Brno as routine work — from verifying TPM and setting up UEFI through converting the disk and moving to Windows 11 with a backup taken first. What it will cost we say after diagnostics; enabling PTT/fTPM is usually a simple setting. On an encrypted disk let us be precise: we can help find an available recovery key where it tends to be stored (Microsoft account, company directory, printed copy, USB stick, domain), check whether the volume has another valid protector, or recover the data once the volume unlocks. Without a usable key or protector, BitLocker cannot normally be broken — neither we nor anyone else can do that. Write to us with what kind of machine it is and what it reports.

Before any intervention in TPM, UEFI or the partition table, the same rule applies as always: back up according to 3-2-1 first, only then touch anything. The check in tpm.msc itself changes nothing and risks nothing — what comes after it is the risky part.

Order online: Windows reinstallation — tell us the model and what happens, and we will come back with the next step.