How to Check and Enable TPM 2.0 for Windows 11
If Windows 11 setup or the PC Health Check app tells you your PC needs TPM 2.0, don’t shop for a new computer yet. Microsoft says most PCs shipped in the last five years are capable of running TPM 2.0. On many of them, the feature is simply switched off in the firmware. That’s especially common on motherboards sold to people who build their own PCs.
This guide shows you how to check your TPM in under a minute, how to turn it on in your PC’s UEFI settings, and what to check next if Windows 11 still says no.
What TPM 2.0 is and why Windows 11 needs it
A Trusted Platform Module (TPM) is a secure crypto-processor. Microsoft describes it as hardware-based security that can generate and store cryptographic keys, help verify that your PC started up without tampering, and resist malicious software. Windows 11 uses TPM 2.0 for features such as Windows Hello sign-in and BitLocker drive encryption.
TPM version 2.0 is one of Microsoft’s minimum requirements for Windows 11, along with:
| Requirement | Windows 11 minimum |
|---|---|
| Processor | 1 GHz or faster, 2 or more cores, compatible 64-bit processor or SoC |
| Memory | 4 GB RAM |
| Storage | 64 GB or larger |
| System firmware | UEFI, Secure Boot capable |
| TPM | Trusted Platform Module version 2.0 |
| Graphics | DirectX 12 or later with WDDM 2.0 driver |
| Display | HD (720p), larger than 9″ diagonally, 8 bits per color channel |
The TPM can be a separate chip on the motherboard or built into the processor platform as firmware.
Step 1: Check whether your PC already has TPM 2.0
There are three quick ways to check. Use whichever you like.
Option A: tpm.msc (fastest)
- Press Windows key + R.
- Type
tpm.mscand select OK. - Read the result:
- “The TPM is ready for use”: look at Specification Version under TPM Manufacturer Information. If it says 2.0, you’re set. If it’s lower than 2.0, the PC doesn’t meet the Windows 11 requirement.
- “Compatible TPM cannot be found”: the TPM is probably turned off in firmware. Go to Step 2.
Option B: Windows Security
- Open Windows Security (search for it from Start).
- Select Device security.
- If you see a Security processor section, select Security processor details and confirm Specification version is 2.0.
- If there’s no Security processor section, the TPM may be disabled. Go to Step 2.
Option C: PowerShell (handy for IT checking several PCs)
Open PowerShell as administrator and run:
Get-TpmLook at TpmPresent, TpmReady, TpmEnabled and TpmActivated. If these read True, a TPM is present and working. For the version number, use tpm.msc or Windows Security as above.
Tip: If you’re still on Windows 10, run Microsoft’s free PC Health Check app (get it from aka.ms/GetPCHealthCheckApp) and select Check now. It checks every Windows 11 requirement at once, not just TPM, and tells you which one failed.
Step 2: Before you change firmware settings
Firmware (UEFI/BIOS) changes are usually safe, but take two minutes to protect yourself first:
- Back up your BitLocker recovery key. Microsoft lists turning off, disabling or clearing the TPM, and firmware upgrades, among the events that can send a BitLocker-protected PC into recovery mode. If your drive uses BitLocker or device encryption, make sure you can reach the recovery key. Microsoft keeps keys backed up to a Microsoft account at aka.ms/myrecoverykey.
- Never select “Clear TPM” unless you specifically mean to. Enabling the TPM and clearing it are different actions.
- Back up important files. This is good practice before any system change.
- On a laptop, plug in the charger for the whole process.
Step 3: Open your PC’s UEFI firmware settings
You can do this from inside Windows, so there’s no need to guess a startup key:
- Open Settings > System > Recovery.
- Next to Advanced startup, select Restart now. Save any open work first.
- On the blue screen, choose Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.
The PC restarts straight into its firmware menu. If you don’t see UEFI Firmware Settings, use the startup key from your PC or motherboard maker’s manual and read the boot mode section below.
Step 4: Turn on the TPM (Intel PTT or AMD fTPM)
Every manufacturer’s menus look a little different. Microsoft says the TPM setting is usually inside a submenu called Advanced, Security or Trusted Computing, and it may be labeled:
| Usually on | Setting name you may see |
|---|---|
| Intel-based PCs | Intel PTT, Intel Platform Trust Technology |
| AMD-based PCs | AMD fTPM switch, AMD PSP fTPM |
| Many brands | Security Device, Security Device Support, TPM State |
Set it to Enabled (or select the firmware TPM option, such as PTT or fTPM).
If you can’t find the setting, check your PC or motherboard maker’s support site for your exact model. Microsoft’s article links to guides from several manufacturers.
Step 5: Check boot mode (UEFI) and Secure Boot
While you’re in firmware settings, check the other Windows 11 firmware requirement: UEFI, Secure Boot capable.
- Boot mode: Windows 11 needs the PC to boot in UEFI mode, not Legacy or CSM. If both are offered, Microsoft says to make UEFI the first or only option.
- Secure Boot: Microsoft’s minimum is a PC that is Secure Boot capable. Microsoft says you may also consider enabling Secure Boot. It’s usually in the Boot or Security menu.
Important if you’re changing Legacy to UEFI: Microsoft’s built-in MBR2GPT tool converts the system disk from MBR to GPT without deleting data. You can run mbr2gpt /validate /allowFullOS from an administrator command prompt to check eligibility first, then convert. After conversion, Microsoft says the firmware must be set to boot in UEFI mode. If that sounds like more than you want to take on, stop here and contact us.
Step 6: Save, restart and confirm
- Choose Save & Exit (often F10) and confirm.
- Let Windows start normally.
- Run
tpm.mscagain. You should see The TPM is ready for use and Specification Version: 2.0. - If you’re upgrading, run PC Health Check again. Then follow our Windows 10 to Windows 11 Pro upgrade guide for the actual upgrade.
Still blocked? Common problems and fixes
- TPM shows version 1.2. Some older PCs have TPM 1.2. Check your PC maker’s support site for your model.
- No TPM setting anywhere in firmware. Update the PC’s BIOS/UEFI from the manufacturer’s site, then look again.
- TPM is 2.0 but PC Health Check still fails. TPM is only one requirement. The most common other blocker is the processor. It has to be on Microsoft’s supported processor lists, which you can find from Microsoft’s Windows processor requirements page. PC Health Check names the item that failed.
- BitLocker recovery screen after the change. Enter the recovery key you saved in Step 2. Windows then starts normally.
Once TPM is on: getting Windows 11 set up and activated
With TPM 2.0 and UEFI sorted, you can upgrade or install Windows 11. If you’re moving to Pro for features like BitLocker management, Remote Desktop hosting or domain join, compare the editions in Windows 11 Home vs Pro for Small Business. Then see Microsoft Windows 11 Pro Digital License or Microsoft Windows 11 Home Digital License, or browse all Windows products.
Activation is online. Enter your product key in Settings > System > Activation. Our Windows 11 Pro activation guide walks through it. If activation doesn’t go through, contact our support team and we’ll sort it out with you. To see how orders and license details arrive, check our Delivery & Activation page.
Frequently asked questions
Press Windows key + R, type tpm.msc and select OK. If the console says the TPM is ready to use, check Specification Version under TPM Manufacturer Information. It needs to say 2.0. You can also open Windows Security > Device security > Security processor details.
Usually that the TPM is turned off in your PC’s firmware, not that it’s missing. Microsoft notes that many motherboards sold for self-built PCs ship with TPM off even though it can almost always be enabled. Turn it on in UEFI settings and check again.
They’re firmware-based TPMs built into the processor platform. Microsoft lists Intel PTT, Intel Platform Trust Technology, AMD fTPM switch and AMD PSP fTPM among the setting names that turn on TPM. After enabling, tpm.msc shows the specification version, which should read 2.0 for Windows 11.
Turning on the TPM doesn’t erase your drive. Two things to watch: don’t choose Clear TPM unless you mean to, and if you switch from Legacy to UEFI boot mode on an MBR disk, convert the disk with Microsoft’s MBR2GPT tool first. Back up important files and your BitLocker recovery key before changing firmware settings.
Microsoft’s requirement is a PC with UEFI firmware that is Secure Boot capable, so the PC must boot in UEFI mode. Microsoft says you may also consider enabling Secure Boot.
TPM is only one requirement. Windows 11 also needs a compatible 64-bit processor on Microsoft’s supported list, 4 GB of RAM, 64 GB of storage, and UEFI with Secure Boot capability. PC Health Check tells you which item failed.
No. Enabling TPM is a firmware setting and doesn’t change your Windows license. If you’re moving to Windows 11 Pro or setting up a new PC, you’ll enter a Windows 11 product key during setup or in Settings > System > Activation.
Need a hand with TPM or Windows 11?
If firmware menus aren’t your thing, we can help. Our Windows Upgrade Help service is a scheduled remote session where a technician checks your PC’s eligibility, moves it to the Windows edition or version you need, and checks drivers and updates. If you just want the software installed and activated for you, see Pro Install: Remote Software Installation & Activation.
- Questions or help with an order: email support@solveditservices.com (fastest), or call (447) 223-5297. Contact support and we’ll fix it.
- Setting up several PCs for your business: request a quote.
- More answers are on our FAQ page.
We offer 24/7 support and order fulfillment. Business hours are 9 AM–5 PM PT, Monday–Friday, and remote sessions are booked within business hours.