How to enable TPM 2.0 and Secure Boot to upgrade to Windows 11

With the Windows 11 operating system just introduced in the company, the controversy is now. About the minimum requirements for upgrading to the new Microsoft operating system Two important new features are coming: TPM 2.0 and Secure Boot. The problem here is that many PCs don’t have these options, especially from 2015, and they are disabled in modern devices.

In fact, it is common for the TPM option on embedded computers to be partially disabled by the motherboard manufacturer. The solution is to enter the BIOS and activate this feature. So, in a few minutes, we’ll see how the PC health check goes from refusing to update to Windows 11 to indicating that our hardware is fully compatible.

How to check the TPM version of our devices

As we said, Windows 11 requires the TPM 2.0 update. So, before going into the BIOS and touching anything, we will check if the TPM chip is enabled (this is common in laptops) to see if the version is compatible.

1. In the search box we type tpm.msc.
2. We open the first search result to go to the TPM administrator.

Here we should look at the bottom, where the specification version is indicated. If we see version 2.0, then our PC should be compatible with Windows 11 in this section. If the computer health check still says we can’t update, we’ll need to look for other reasons, which are likely related to the graphics driver from the computer manufacturer.

How to enable TPM from BIOS

To enable TPM 2.0 by firmware, as is usually the case on desktop machines, we will need to access the BIOS. To do this, press the corresponding key when starting the device. Usually this is F2, F8, F12, or Esc, although we can confirm this in the manufacturer’s manual or motherboard.

If Windows 10 is installed by UEFI, we can access the BIOS from the Settings app. Concretely, we have to go to Update & Security > Recovery. Here, click “Restart now” in the “Advanced startup” section.

The computer will restart and a blue background menu will appear. On the first screen, click on Troubleshoot and then on Advanced. Finally, we click on “UEFI Firmware Configuration”. Finally, we confirm the reboot and the computer will enter the BIOS directly.

The next steps will depend on the manufacturer, though They are generally the same on all motherboards. In this case, we will detail the process of MSI cards using ClickBIOS.

1. We go to the “Security” section.
2. Click on Trusted Computing.
3. Click on Security Device Support and select Enable.
4. We make sure that the “AMD fTPM Switch” option is enabled. For Intel processors, “Intel Platform Trust Technology” will appear.

How to enable secure boot from BIOS

Secure boot is also a prerequisite for upgrading to Windows 11. Likewise, it is also disabled by default on desktop computers. To activate it, we will follow the following steps from the BIOS.

1. We go to the “Advanced” section. On cards from other manufacturers it is common to find them in the “Boot” section.
2. Click Configure Windows.
3. We check that in “BIOS UEFI / CSM mode” it is indicated “UEFI”.
4. We click or select “Secure boot”.
5. Click on Safe Boot Mode and select Custom. If a warning about the security code appears, click Yes.
6. Click “Enter all factory default keys” to generate the secure boot keys.
7. Finally, click on Secure Boot and choose Enabled.

It is important that you check what we indicated in step 3, because UEFI is a prerequisite for installing Windows 11. If “Legacy” or “CSM” appears, we must bear in mind that we will need to change it and reinstall our copy of Windows 10 or perform a clean install For Windows 11 after releasing the installation ISO image.

Finally, we save the changes made from the “Save and Exit” section by clicking on the “Save Changes and Restart” option. If we now reopen the PC Health Check app, we will see that the device is compatible with Windows 11.