Fix "This PC Can't Run Windows 11" TPM 2.0 Error
Short answer first: if PC Health Check or the Windows 11 installer is telling you "This PC can't run Windows 11" because of TPM 2.0, the chip is very likely already sitting on your motherboard, just switched off or set to an incompatible mode in firmware. Turn it on in UEFI, confirm the version with tpm.msc, and re-run the check. That resolves this for most systems built in the last eight to ten years. If your specific board genuinely has no TPM 2.0 path at all, you have a smaller, harder set of options — and Microsoft itself, not just forum hacks, documents one of them.
Check what TPM state you actually have before changing anything
Don't guess. Press Windows + R, type tpm.msc, and press Enter. This opens the TPM Management console directly, and it will tell you one of three things:
- "The TPM is ready for use" with a Specification Version of 2.0 — TPM isn't your problem, and the "can't run Windows 11" message is coming from something else (CPU generation, RAM, Secure Boot, or storage).
- "The TPM is ready for use" with a Specification Version of 1.2 — you have a TPM, but it's the older spec. Some 1.2 modules and firmware can be updated to 2.0 through the vendor; many can't.
- "Compatible TPM cannot be found" — either it's disabled in firmware, or your board doesn't have one at all.
That third message is the one that sends people straight to BIOS, and it's the right instinct — Microsoft's own guidance notes that most PC motherboards used for self-built systems ship with TPM turned off by default even though it's almost always available to enable. Prebuilt OEM machines from the last decade are more likely to ship with it on already, so if you're seeing this on a Dell, HP, or Lenovo from the Windows 10 era, it's worth checking whether it was manually disabled at some point rather than assuming it's missing.
Symptom, check, and fix — in order
| What you see | Confirming check | Fix |
|---|---|---|
| "This PC can't run Windows 11," TPM cited specifically | tpm.msc shows "Compatible TPM cannot be found" | Enable TPM/PTT/fTPM in UEFI firmware |
| TPM present but stuck at 1.2 | tpm.msc Specification Version reads 1.2 | Check manufacturer site for a firmware TPM update to 2.0; not all boards support this |
| TPM 2.0 confirmed, error persists | PC Health Check "see all results" flags Secure Boot or CPU instead | You have a different requirement gap — don't keep re-enabling TPM, address the flagged item |
| No TPM option anywhere in firmware | Checked under Security, Advanced, and Trusted Computing menus, updated BIOS, still nothing | Hardware genuinely lacks TPM 2.0 support — decide between upgrading or an unsupported install |
Do these in order: enable TPM the safe way first
1. Confirm you're checking the right thing. Run tpm.msc as described above. Don't open the BIOS yet if it already reports 2.0 ready — you'd be fixing a problem you don't have.
2. Restart into UEFI firmware settings. From within Windows: Settings > System > Recovery > Recovery options > Restart now, next to Advanced startup. After reboot, choose Troubleshoot > Advanced options > UEFI Firmware Settings > Restart. On most desktops you can also just tap Del, F2, F10, or Esc during POST — it varies by motherboard vendor, so check yours if the Windows route isn't available.
3. Find the TPM setting under Security, Advanced, or Trusted Computing. It's rarely labeled "TPM" outright. Intel systems usually call it Intel PTT (Platform Trust Technology); AMD systems call it AMD PSP fTPM or just fTPM. Some boards list it as "Security Device" or "Security Device Support."
4. Set it to Enabled, save, and exit. Saving and exiting UEFI usually reboots the machine automatically.
5. Re-check with tpm.msc, then re-run PC Health Check. Confirm Specification Version 2.0 before assuming you're done — a firmware TPM that comes up as 1.2 won't clear the Windows 11 check.
If the TPM option is greyed out in firmware, the board likely requires a BIOS administrator password to be set first. This is a common and intentional lock, not a bug — set a BIOS password, and the option should become editable.
What I would not do at this stage
- Flash a beta or unofficial BIOS you found on a forum to "unlock" TPM options — a bad flash on a board without dual-BIOS recovery can brick it, and the standard vendor BIOS almost always already exposes the setting somewhere.
- Buy a discrete TPM header module before checking whether your board has firmware TPM (fTPM/PTT) built into the chipset already — most systems from the last several years don't need a physical module at all.
- Clear the TPM as a first troubleshooting step. Clearing resets stored keys and will affect BitLocker and Windows Hello if either is already configured — it's a fix for a TPM reporting an error state, not for one that's simply disabled.
If your hardware genuinely has no TPM 2.0 path
Some CPUs from before roughly 2016, and some low-end or older boards, don't have a TPM 2.0-capable firmware module and never will through a setting change. At that point you have two honest options, and Microsoft documents both outcomes plainly rather than pretending there's a clean third path.
| Option | What you get | Tradeoff |
|---|---|---|
| Stay on your current OS or upgrade hardware | Full Microsoft support and updates | Cost of new hardware, or living without Windows 11 features |
| Install Windows 11 on ineligible hardware anyway | Windows 11 runs, officially acknowledged as possible by Microsoft | Microsoft states explicitly that devices in this state don't receive support and aren't guaranteed to get updates, including security updates |
If you decide to go the unsupported-install route with your eyes open, it's worth knowing this isn't purely a third-party trick: Microsoft's own support documentation acknowledges that people bypass the TPM and CPU checks and publishes the disclaimer text Setup shows when you do it. The commonly used method sets DWORD values under HKEY_LOCAL_MACHINE\SYSTEM\Setup\LabConfig during a clean install from boot media — BypassTPMCheck and BypassSecureBootCheck set to 1 — which only affects the temporary Windows PE environment Setup runs in, not your final installed registry. This applies to clean installs; forcing an in-place upgrade from Windows 10 with a device that fails eligibility is a separate, less reliable path and more likely to leave you in a half-updated state.
I don't love recommending this route for a primary machine that holds anything you can't afford to lose, because "not guaranteed to receive security updates" is doing a lot of work in that sentence. For a secondary machine, a test box, or older hardware you were going to retire anyway, it's a reasonable way to keep using it.
When this advice doesn't apply
If you're on a work or school-managed device, don't touch firmware settings or registry keys yourself — IT policy often controls TPM and Secure Boot state centrally, and an unsupported install on a managed endpoint can break compliance tools, disk encryption recovery, or conditional access policies tied to attested hardware state. Loop in your IT team instead; they may already have a supported upgrade path queued for your device model.
And if PC Health Check is citing CPU family rather than TPM specifically — check the exact wording under "See all results" — none of the TPM steps above will change the outcome. Processor eligibility is a fixed list Microsoft maintains, and it doesn't move with a firmware setting.