Skip to content

Working laptop refuses Windows 11 due to TPM 2.0 / Secure Boot

Microsoft enforces the TPM 2.0 requirement strictly for the upgrade. On older business laptops TPM is often physically present but disabled in BIOS; on genuinely old models it is absent.

Try this first

  1. 1Check whether TPM exists: Windows key+R, 'tpm.msc'. Status 'Ready for use' and version 2.0: fine, look elsewhere. 'No compatible TPM found': onward to BIOS.
  2. 2Reboot into BIOS/UEFI (often F2 or Del). Look for 'PTT' (Intel Platform Trust Technology), 'fTPM' (AMD), or 'Security chip'. Enable, save, reboot.
  3. 3Check Secure Boot in the same BIOS. If it sits on 'Other OS' or 'Disabled', set it to 'Windows UEFI' or 'Enabled', and ensure Boot Mode is 'UEFI', not 'Legacy/CSM'.
  4. 4If steps above do not work, run Microsoft's PC Health Check. It names the failing requirement (CPU generation, TPM version, Secure Boot). CPU too old has no supported workaround.
  5. 5For an SMB fleet: run the check before scheduling upgrade work. Machines that fail are better folded into your refresh plan straight away than fought over.

When to bring us in

A working fleet with partly ineligible laptops near Windows 10 end-of-life: there are paths (ESU, in-place until June, replace) with different fiscal outcomes. We are happy to walk you through the three scenarios.

See also

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.

Who are you?

For the AI question we need your email and company, so we can follow up if the AI gets stuck, and to prevent abuse.

Limited to 2 questions per hour and 5 per day, kept lean so the AI stays useful. For more, contacting us directly works better for you and us.

Or skip the DIY entirely

Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.