TPM 2.0 & Secure Boot: Why Windows 11 Requires Them

General

July 6, 2026 · Updated July 6, 2026

Trusted Platform Module (TPM) 2.0 and Secure Boot are hardware-based security features required by Windows 11 to protect your PC's startup process and sensitive data. They work together to create a trusted foundation, preventing malware from loading at boot and securing cryptographic keys against firmware-level attacks.

Key Takeaways

TPM 2.0 is a Hardware Cryptoprocessor: It's a dedicated chip that securely stores sensitive data like encryption keys and user credentials, isolating them from the main operating system and potential malware.
Secure Boot Prevents Malicious Code: A UEFI firmware feature, Secure Boot verifies the digital signature of all boot software, blocking unauthorized code like rootkits from running before the OS loads.
Mandatory for Windows 11 Security: According to Microsoft, these features are essential for establishing a secure hardware baseline, enabling advanced protections like BitLocker disk encryption and Windows Hello biometric login.
A Layered Defense: Secure Boot ensures the integrity of the software loading on your PC, while TPM 2.0 verifies the integrity of the system's state and protects the secrets used by that software.
Checking is Simple: You can verify your system's compatibility using built-in Windows tools like 'tpm.msc' and 'msinfo32' without needing to enter your PC's firmware settings.

What Is TPM 2.0 and Why Does Windows 11 Require It?

TPM 2.0, or Trusted Platform Module, is a secure cryptoprocessor, an international standard for a dedicated microchip designed to provide hardware-based security functions. This chip is typically integrated into your computer's motherboard or embedded within the main processor. Its primary purpose is to act as a secure vault for sensitive cryptographic data, such as encryption keys, passwords, and digital certificates.

By storing this data in hardware, the TPM isolates it from the main operating system and other software. This makes it significantly more difficult for malware or attackers to access and compromise your credentials, even if they gain administrative control over your PC. It's a foundational element of a modern defense-in-depth security strategy.

Microsoft made TPM 2.0 a mandatory requirement for Windows 11 to raise the baseline of security across the entire PC ecosystem. This hardware root-of-trust enables and strengthens several critical Windows security features:

Windows Hello: When you use a fingerprint or facial recognition to log in, the TPM securely stores the biometric data, preventing it from being stolen from system memory.
BitLocker Drive Encryption: TPM 2.0 protects the encryption keys used to lock your hard drive. Without the TPM's verification, a thief cannot simply remove your hard drive and access its data on another machine.
Credential Guard: In enterprise environments, this feature uses virtualization-based security (VBS) to isolate login credentials in a protected environment that even the operating system kernel cannot access, with the TPM providing the hardware-level protection.

Essentially, by enforcing the TPM 2.0 requirement, Microsoft ensures that every certified Windows 11 device has a hardware-level defense against common attacks like firmware exploits and ransomware that attempt to steal credentials or tamper with the system's integrity.

What Is Secure Boot and How Does It Protect Your PC?

Secure Boot is a security standard built into the Unified Extensible Firmware Interface (UEFI), which is the modern firmware that has replaced the traditional BIOS on nearly all recent computers. Its sole function is to ensure that your PC boots using only software that is trusted and digitally signed by the device manufacturer or Microsoft. It acts as a gatekeeper during the critical startup sequence.

When you turn on your computer, Secure Boot begins verifying the digital signature of each piece of software in the boot chain—from the UEFI firmware drivers to the operating system's bootloader and kernel. If it detects any code that lacks a valid signature or whose signature has been tampered with, it will block that code from running. This process happens before your main operating system or any antivirus program has a chance to load.

This is crucial for defending against some of the most dangerous types of malware:

Rootkits and Bootkits: These malicious programs are designed to load before the operating system, embedding themselves deep within the system. This allows them to hide their presence from security software and gain complete control over the device.

By preventing unsigned code from loading at startup, Secure Boot effectively shuts the door on this entire class of threats, ensuring the integrity of your operating system before it even begins to run.

For Windows 11, Microsoft requires that devices are Secure Boot capable and have UEFI firmware. While it may be possible to install the OS with it disabled, keeping Secure Boot enabled is a non-negotiable best practice for maintaining a secure and stable system.

Can You Install Windows 11 Without TPM 2.0 and Secure Boot?

While unofficial workarounds and registry edits exist that allow users to bypass the TPM 2.0 and Secure Boot checks during Windows 11 installation, doing so is not supported by Microsoft and is strongly discouraged. Installing the operating system on unsupported hardware fundamentally undermines the security architecture that these features are designed to create. The risks far outweigh the convenience.

Users who bypass these requirements may face several significant consequences. Your device may not be entitled to receive future Windows updates, including critical security patches, leaving your system permanently vulnerable. Furthermore, security-dependent features like BitLocker and Windows Hello may function improperly or not at all. You are essentially running a version of the operating system that is stripped of its foundational hardware protections.

For a fully secure, stable, and supported experience, the only recommended path is to use hardware that meets the official system requirements. If you are building a new PC or upgrading an older one, ensuring it is equipped for a genuine copy of Windows 11 Pro is the best way to leverage these essential security advancements.

How to Check if Your PC Has TPM 2.0 and Secure Boot

Before attempting to upgrade to Windows 11, it's wise to check if your current system has these features and whether they are enabled. You can do this easily from within Windows without needing to reboot into your PC's firmware settings first.

Checking for TPM 2.0

The quickest way to check your TPM status is with the TPM Management tool:

Press the Windows key + R to open the Run dialog box.
Type tpm.msc and press Enter.
In the window that appears, look under the "Status" section. It should say, "The TPM is ready for use."
Under "TPM Manufacturer Information," check the "Specification Version." For Windows 11, this must be "2.0".

If the tool reports that a compatible TPM cannot be found, the feature may be disabled in your PC's UEFI/BIOS settings. This is common on custom-built PCs and some pre-built desktops.

Checking for Secure Boot

You can verify your Secure Boot status using the System Information tool:

Press the Windows key + R to open the Run dialog box.
Type msinfo32 and press Enter.
In the System Information window, find the "System Summary" section.
Scroll down to find the "Secure Boot State" item. Its value should be "On".

If the state is listed as "Off" or "Unsupported," you may need to enable it in your UEFI/BIOS settings. Note that enabling Secure Boot often requires the system to be in UEFI mode, not a legacy BIOS or CSM (Compatibility Support Module) mode.

Frequently Asked Questions

Is TPM 2.0 a physical chip I need to buy?

TPM 2.0 is typically a physical chip integrated into the motherboard or built into the CPU (as firmware TPM or fTPM) on modern computers. For most PCs manufactured since 2016, you do not need to buy it separately, but you might need to enable it in the UEFI/BIOS settings.

What are the risks of disabling Secure Boot?

Disabling Secure Boot makes your system vulnerable to rootkits and bootkits, which are advanced forms of malware that load before your operating system and antivirus software. This can compromise your entire system at a fundamental level, making malware extremely difficult to detect and remove.

Can I enable TPM 2.0 and Secure Boot on an older PC?

It depends entirely on your hardware. Most PCs made after 2016 should have TPM 2.0 and UEFI with Secure Boot capabilities, but they are often disabled by default in the firmware. You will need to enter your PC's UEFI/BIOS settings to enable them, but hardware older than that may not support these features at all.

Do TPM 2.0 and Secure Boot affect PC performance?

No, these are low-level security features that have no noticeable impact on your PC's day-to-day performance in gaming, productivity, or general use. They operate primarily during the boot process and when performing specific cryptographic functions, using negligible system resources.