This PC Can't Run Windows 11? Find and Fix the Blocker
Short answer: Don't start flipping BIOS switches before you know which of the four requirements is blocking you — TPM 2.0, Secure Boot, UEFI boot mode, or a supported CPU. Press Win+R, run tpm.msc, then run msinfo32. tpm.msc tells you whether the TPM is the problem; 'Compatible TPM cannot be found' almost always means it's just disabled in the BIOS, not absent. msinfo32's BIOS Mode and Secure Boot State lines tell you the rest — if BIOS Mode reads Legacy you're on an MBR disk and have to convert it to GPT with mbr2gpt before Secure Boot can even turn on. Each blocker has a completely different fix, so find yours first instead of guessing.
“This PC can’t run Windows 11” is a deliberately vague error. It won’t tell you which requirement you failed, and there are four of them — TPM 2.0, Secure Boot, UEFI boot mode, and a CPU on Microsoft’s supported list — each with a completely different fix. So before you start flipping BIOS switches, spend two minutes finding out which one is actually blocking you. Press Win+R, run tpm.msc, then run msinfo32. Those two windows settle it.
Find Your Exact Blocker First
Most people read one forum thread, decide it’s “the TPM thing,” and burn an afternoon enabling something that was never the problem. The check is faster than the guess.
Microsoft’s own PC Health Check app is the one-click version: install it, hit Check now, and if it fails it names the specific requirement and offers a “See all results” list of every check, pass and fail. It stops at the verdict, though: it’ll report Secure Boot isn’t on without mentioning that you’re stuck in Legacy mode and can’t just toggle it. tpm.msc and msinfo32 are the manual version that show you the why, which is what decides your fix, so they’re worth opening even after the app points the finger.
tpm.msc opens the TPM Management console. If it says The TPM is ready for use and the Specification Version reads 2.0, your TPM is fine — move on. If it says Compatible TPM cannot be found, that’s the message everyone panics about, but it almost never means your PC lacks a TPM. On any board from the last several years the TPM is built into the firmware and just switched off. The same chip is also where Windows Hello stores the keys behind your PIN and biometric sign-in, so a disabled TPM shows up as Windows Hello not working just as often as it shows up as a blocked Windows 11 upgrade.
Now msinfo32. In the System Summary on the right, find two lines. Secure Boot State reads On, Off, or Unsupported. BIOS Mode reads UEFI or Legacy. The two are linked: Secure Boot only exists in UEFI mode, so if BIOS Mode says Legacy, Secure Boot State will read Unsupported no matter what your firmware can do.
Read the two together and you land in one of three situations. TPM 2.0 fine, Secure Boot Off, BIOS Mode UEFI — easy, you flip two switches in the BIOS. TPM “not found,” Secure Boot Off — likely both are just disabled firmware features, still a BIOS job. Secure Boot State Unsupported alongside BIOS Mode Legacy is the situation that catches people, because no BIOS toggle fixes it on its own; you have to convert the disk first.
When TPM Is Off, Not Missing
Most blocked PCs land here, and it’s the quick fix. You need to get into the firmware: open your BIOS/UEFI — restart and tap Del or F2 on most desktops, F10 or F12 on a lot of laptops, or go through Settings, Recovery, Advanced startup, UEFI Firmware Settings if you’d rather not catch the key.
Once you’re in, the TPM option hides under a tab called Security, Advanced, or Trusted Computing, and the name depends on your CPU. On Intel boards it’s Intel PTT or Intel Platform Trust Technology. On AMD it’s AMD fTPM or AMD PSP fTPM. Some firmware just calls it Security Device Support or TPM State. Set it to Enabled, save and exit, and run tpm.msc again — it should now report ready, version 2.0.
To tell a genuinely absent TPM from a disabled one without rebooting, open Windows Security, go to Device security, and look for a Security processor section: if it’s there, you have a TPM and it’s a settings problem; if that section is missing entirely, the chip probably isn’t present. If the only TPM option your firmware offers is a physical header for an add-in module and there’s no PTT or fTPM anywhere, then you genuinely don’t have one, and you’re into the bypass territory near the end of this guide.
Secure Boot and the Legacy Trap
If Secure Boot State said Off but BIOS Mode already said UEFI, the fix is one switch. Back in the firmware, find Secure Boot under the Boot or Security tab and enable it. Watch for one snag: Secure Boot won’t enable while CSM (Compatibility Support Module, the legacy-boot shim) is still on, so turn CSM off first. Save, reboot, recheck msinfo32.
The harder version is BIOS Mode: Legacy. That means Windows is installed on an old-style MBR disk and booting in legacy mode, and Secure Boot is structurally impossible until you convert the disk to GPT and switch the firmware to UEFI. Windows ships a tool for the conversion that keeps your data in place, but the operation is irreversible, so back the machine up first — not optional.
From an elevated Command Prompt, validate before you commit:
mbr2gpt /validate /disk:0 /allowFullOSIf that returns “Validation completed successfully,” run the real thing:
mbr2gpt /convert /disk:0 /allowFullOSThe /allowFullOS flag lets it run from inside Windows instead of the recovery environment. When it finishes, go back into the BIOS and switch the boot mode from Legacy/CSM to UEFI — the disk is now GPT, so a legacy boot would just fail to find the OS. Then enable Secure Boot, which is finally available. If validation fails instead — usually too many partitions, or no room for the EFI system partition — that’s a sign to weigh a clean install from USB against fighting the existing layout, since a clean install sets up GPT and UEFI correctly from the start.
The Requirements That Rarely Bite
Four of the checks get all the attention, but the spec sheet has a few more, and once in a while one of them is the real culprit. The bars are low: 4 GB of RAM, 64 GB of storage, a 720p display, and DirectX 12 with a WDDM 2.0 driver. Almost any machine that ran Windows 10 well clears them. The two worth a glance are RAM and storage — msinfo32 shows Installed Physical Memory near the top, and This PC shows free space on your drive. If you’re sitting on exactly 4 GB and a nearly full drive, the installer can balk for reasons that have nothing to do with TPM, and that’s a cheap stick of RAM or a cleanup away rather than a firmware expedition. The graphics requirement effectively never fails on hardware new enough to have UEFI in the first place.
When the CPU Is the One That Fails
If tpm.msc is happy and Secure Boot is on but the installer still refuses, your processor isn’t on Microsoft’s supported list. There’s no switch for that — the chip is the chip. The rough cutoff is Intel 8th-generation Core (the 8000 series, late 2017) and AMD Ryzen 2000 (Zen+), so anything from about 2018 onward usually qualifies and most older chips don’t; if you’re unsure, find your exact model in Task Manager’s Performance tab and check it against Microsoft’s published CPU lists. Officially the line stops here, and a fresh machine is the clean answer.
Unofficially, there’s a registry change Microsoft itself shipped for in-place upgrades on hardware with an unsupported CPU. Open regedit, go to HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup, create a DWORD (32-bit) value named AllowUpgradesWithUnsupportedTPMOrCPU, set it to 1, and rerun the Windows 11 upgrade. It ignores the CPU list and accepts TPM 1.2 instead of 2.0, but it still wants UEFI, Secure Boot, and at least a TPM 1.2 — it’s for old-CPU machines, not for hardware with nothing at all.
For a machine with no usable TPM at all, the bypass moves to install time: boot the Windows 11 USB, and at the “This PC can’t run Windows 11” screen press Shift+F10 for a command prompt, launch regedit, and under HKEY_LOCAL_MACHINE\SYSTEM\Setup create a key called LabConfig with DWORDs BypassTPMCheck and BypassSecureBootCheck both set to 1. If hand-editing the registry mid-install sounds like a misstep waiting to happen, the free tool Rufus bakes the same bypass into the bootable USB when you create it, with a checkbox instead of a regedit detour — same outcome, fewer chances to fat-finger a key name.
Be clear-eyed about what this buys you. Microsoft quietly pulled its own bypass guide, and it now warns that PCs installed this way are outside support and may not be entitled to updates, including security updates. It works today; it’s a calculated risk, not a free pass.
Windows 10’s support ended in October 2025, and the scramble shows in the numbers — Windows 11 crossed roughly 73% of desktop Windows by early 2026 while Windows 10 fell to about 26%, a jump that came almost entirely from people upgrading once the deadline hit. A sizable share of machines still can’t make the cut, and in fleet hardware-readiness audits TPM 2.0 keeps turning up as the single most common reason. Most of those are the disabled-firmware case above, not truly incapable hardware.
If you’ve checked tpm.msc and msinfo32 and the blocker is real — an unsupported CPU, or a BIOS where the TPM and Secure Boot options are buried under names that don’t match any guide, or an MBR disk you’d rather not convert blind — the work shifts from a five-minute toggle to firmware archaeology and a disk conversion you don’t want to get wrong. That’s the kind of job we handle remotely: confirm the exact blocker, change the right firmware settings over a screen-share, run the conversion with a backup in hand, and leave you on a supported, updating Windows 11. Microsoft’s enable TPM 2.0 and Windows 11 and Secure Boot pages, plus the mbr2gpt reference, cover the same ground from the manufacturer’s side if you want to keep going yourself.
Frequently Asked Questions
What does 'This PC can't run Windows 11' actually mean?
It means the upgrade or installer found at least one hardware requirement your PC doesn't currently meet, but it won't tell you which one. There are four common blockers — TPM 2.0, Secure Boot, UEFI boot mode, and a CPU on Microsoft's supported list — and each has a completely different fix. Run tpm.msc and msinfo32 to see exactly which requirement is failing before you change anything, because enabling the wrong thing wastes an afternoon.
Why does it say 'Compatible TPM cannot be found' if my PC has a TPM?
Because on most boards from the last several years the TPM is built into the firmware and simply switched off, so the console reports it as not found until you enable it. It's called Intel PTT (Platform Trust Technology) on Intel systems and AMD fTPM (or PSP fTPM) on AMD, usually under a Security, Advanced, or Trusted Computing tab in the BIOS. Turn it on, save, and run tpm.msc again — it should then report ready, version 2.0. A genuinely absent TPM is rare on hardware from 2016 onward.
How do I tell which Windows 11 requirement I'm failing?
Two windows settle it. tpm.msc shows whether the TPM is ready or 'cannot be found.' msinfo32, under System Summary, shows two lines: Secure Boot State (On, Off, or Unsupported) and BIOS Mode (UEFI or Legacy). Secure Boot only exists in UEFI mode, so if BIOS Mode says Legacy, Secure Boot State will read Unsupported no matter what your firmware supports. Microsoft's PC Health Check app names the failing requirement too, but it stops at the verdict and doesn't show you the why that decides your fix.
Can I install Windows 11 on an unsupported CPU?
Yes, with a registry change Microsoft itself shipped for in-place upgrades. In regedit, go to HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup, create a DWORD named AllowUpgradesWithUnsupportedTPMOrCPU, set it to 1, and rerun the upgrade. It accepts an unsupported CPU and TPM 1.2 instead of 2.0, but it still requires UEFI, Secure Boot, and at least a TPM 1.2. Microsoft has pulled its official bypass guide and warns that PCs installed this way are outside support and may be denied updates, including security updates — it's a calculated risk, not a free pass.
What does BIOS Mode: Legacy mean for Windows 11?
It means Windows is installed on an old-style MBR disk and booting in legacy mode, so Secure Boot is structurally impossible until you convert the disk to GPT and switch the firmware to UEFI. Windows ships mbr2gpt to convert in place while keeping your data, but the operation is irreversible, so back up first. Validate with mbr2gpt /validate /disk:0 /allowFullOS, then run mbr2gpt /convert /disk:0 /allowFullOS, switch the firmware from Legacy/CSM to UEFI, and enable Secure Boot, which is finally available.