Secure Boot, TPM 2.0 and the Windows 11 requirements
Why disabling Secure Boot is the wrong fix, what TPM 2.0 actually does, and how to check both before you build installation media.
A surprising amount of reinstall advice still begins with 'go into the BIOS and turn off Secure Boot'. That instruction was passed around when custom images and legacy boot loaders were common. For a normal Windows 11 install from Microsoft's own media it is not harmless folklore: Windows 11 expects Secure Boot capable hardware, and disabling it moves the machine away from the configuration the operating system was designed for.
This page explains the three firmware-level requirements that decide whether a clean install will go smoothly, how to check them without changing anything, and what to do on a machine that genuinely cannot meet them. It deliberately contains no registry bypass and no modified image.
What Secure Boot actually checks
Secure Boot is a UEFI feature that verifies the digital signature of the boot loader before it runs. If the loader has been replaced or tampered with, the firmware refuses to start it. It is one of the few protections that operates before the operating system exists, which is why it matters specifically on a machine you are reinstalling because you no longer trust what was running.
Official Windows installation media is signed and boots with Secure Boot enabled. If a guide tells you to disable it to make a USB stick boot, the more likely explanation is that the stick was prepared for legacy BIOS/MBR boot, or that the image was altered. Fix the media, not the security setting.
The setting is in firmware setup, usually under a Boot or Security tab. The key used to reach firmware setup differs by manufacturer, which is why the main Windows guide treats the boot-menu key as something to look up for your model rather than a single universal key.
Correction to widely copied advice
Disabling Secure Boot does not make Windows 11 install on unsupported hardware, and it is not required for a standard clean install from Microsoft media. Several older guides say the opposite. Leave it on.
TPM 2.0, and where it hides
A Trusted Platform Module stores keys in hardware and is used for BitLocker encryption, Windows Hello and measured boot. On many consumer machines there is no separate chip: the function is provided by the processor's firmware, appearing as Intel Platform Trust Technology or AMD fTPM in firmware setup, often disabled by default on boards that predate Windows 11.
You can check without rebooting. Run msinfo32 and look for Secure Boot State and TPM information, or open Windows Security and check the device security section. If the TPM is present but not visible to Windows, the fix is usually a firmware setting, not a new component.
This is also where the recovery-key conversation belongs. BitLocker can bind the disk encryption key to the TPM, which is convenient until the firmware or the mainboard changes. Before a clean install, confirm you have the recovery key in the Microsoft account used on the device.
UEFI, GPT, and the partition question
Windows 11 installs in UEFI mode to a GPT-partitioned disk. An older system installed in legacy BIOS/CSM mode to an MBR disk will not simply upgrade in place to that layout; converting it is a separate operation with its own backup requirement. This is one of the few cases where a clean install is genuinely the cleanest route.
When you boot the official USB stick, the firmware may offer two entries for the same device — one UEFI and one legacy. Choosing the UEFI entry is what produces the correct partition layout. If only a legacy entry appears, check the media preparation rather than switching the firmware to CSM mode to accommodate it.
- Check Secure Boot State and TPM in msinfo32 before making media.
- Boot the USB stick using its UEFI entry when the firmware offers a choice.
- Keep CSM / legacy boot off for a normal Windows 11 install.
- If the machine cannot meet the requirements, treat it as a Windows 10 or Linux decision — do not reach for a registry bypass or a stripped image.
When the machine genuinely does not qualify
Microsoft publishes the supported processor list and the system requirements for Windows 11, and the release-health dashboard is where current known issues are listed. Check those rather than a forum post from a different release. A machine outside the supported list is not broken; it simply needs a different plan.
The honest options are to keep it on a supported operating system for as long as that remains viable, install a Linux distribution that supports the hardware, or replace the machine. Windows 10 reached the end of support on 14 October 2025, so treating it as a permanent fallback has a deadline. What this site will not recommend is a modified image or an activation utility that makes an unsupported install appear to work.
Why this site takes that position
A modified installer defeats the reason for reinstalling in the first place. If the goal is a trustworthy system, the image has to come from the vendor, unaltered — even when that means accepting that older hardware needs a different operating system.
A short check before you start
None of the above requires a change to firmware settings on a compliant machine. Record what you find, and only enter firmware setup if a specific item is missing or you need to choose the boot device.
- Secure Boot State: on, or at least supported and enabled in firmware.
- TPM: present, version 2.0, and visible to Windows.
- Disk layout: GPT for the target system disk, or a planned conversion with a tested backup.
- BitLocker recovery key saved outside the machine.
- The processor appears on the vendor's supported list for the release you intend to install.
Mistakes to avoid
- Disabling Secure Boot because an old guide said to, then spending the next session trying to work out why the machine no longer matches the supported configuration.
- Using a registry tweak or a modified ISO to bypass the requirement check on unsupported hardware, which is exactly the class of image this site exists to argue against.
- Booting the USB stick's legacy entry and ending up with an MBR layout that later blocks features such as Device Encryption.
- Changing firmware settings without writing down the original values, so the machine cannot be returned to its previous state if the install is abandoned.
- Assuming a TPM is a physical chip that must be purchased, when it is usually a firmware feature waiting to be enabled.
Questions people ask
Will enabling Secure Boot stop my existing Linux or older Windows install from booting?
It can, if that system uses an unsigned boot loader. If you dual-boot, check that arrangement before changing firmware settings and make sure you have a tested backup.
Do I need to clear the TPM before a clean install?
Not for a normal reinstall of the same machine. Clearing it destroys keys that may be needed to read existing encrypted data. Only consider it when disposing of hardware or after that data is safely recovered.
My firmware mentions fTPM or PTT but Windows shows no TPM. What now?
Enable the corresponding firmware option and check again. The naming differs by vendor; the Windows Security device page and msinfo32 will confirm whether Windows can see it afterwards.
Is Windows 10 still a reasonable fallback?
It remains downloadable from Microsoft, but support ended on 14 October 2025. Use it as a temporary compatibility measure with a plan, not as a permanent destination.
Sources and further reading
- Windows 11 specifications and system requirements Microsoft · Vendor specification page We check requirements here before recommending any install. Older hardware gets an honest alternative, never a requirement bypass.
- Windows release health dashboard Microsoft Learn · Vendor status dashboard Where to check whether a problem is a known issue with the current release before assuming the machine is at fault.
- Microsoft Support — Windows help Microsoft Support · Official support documentation The first-party reference for activation and update behaviour after a clean install, and for the built-in troubleshooters.
- Download Windows 10 Microsoft · Vendor download page We present it as a time-boxed compatibility fallback for hardware that cannot meet the Windows 11 requirements, not as a permanent destination.
Editorial note. This article describes decision logic and checks, not laboratory results. It quotes no benchmark, no test score and no screenshot. Screen labels are reproduced so you can find them on your own device; the sources listed below are the vendor documentation they were checked against.