When you build a new PC and go to install Windows 11, you may hit a wall: the installer says your system does not meet requirements. Nine times out of ten the culprit is TPM 2.0 or Secure Boot being disabled in the BIOS, even though your hardware fully supports both. The good news is these are settings, not missing parts, and enabling them takes only a few minutes.
What TPM and Secure Boot Are
TPM, the Trusted Platform Module, is a small security processor that stores encryption keys and helps features like disk encryption. On most modern platforms it is built into the CPU or chipset and simply needs to be switched on, often under a vendor name like PTT or fTPM. Secure Boot is a firmware feature that only allows trusted, signed bootloaders to run, blocking a class of low-level malware. Windows 11 requires both.
Why they ship disabled
Motherboards often default these off for maximum compatibility with older operating systems and boot media. That is why a brand-new build can technically support Windows 11 yet still fail the check until you change the BIOS.
Enabling Them Step by Step
| Step | Action | Common menu name |
|---|---|---|
| 1 | Enter BIOS at boot | Delete or F2 |
| 2 | Enable firmware TPM | PTT (Intel) or fTPM (AMD) |
| 3 | Set boot mode to UEFI | Disable CSM / Legacy |
| 4 | Enable Secure Boot | Boot or Security menu |
| 5 | Save and exit | Reboot |
Secure Boot usually requires UEFI mode, so disabling CSM comes first. If Secure Boot appears greyed out, look for an option to install or restore default Secure Boot keys, then enable it.
Checking Your Work in Windows
Quick verification
Inside Windows you can confirm TPM status through the TPM management tool and Secure Boot status through system information. Both should report as present and enabled. If the Windows 11 installer still complains, double-check that TPM shows version 2.0 and that Secure Boot is truly on, not just available.
If you are converting from an older install
Switching to UEFI on a disk that was set up in legacy mode can stop it booting. If you are upgrading an existing drive rather than doing a clean install, research converting the disk to GPT before disabling CSM so you do not lose access to Windows.
Common Problems and How to Solve Them
Two issues trip people up most. The first is Secure Boot appearing greyed out or refusing to enable; this usually means the system is still in legacy or CSM mode, or that the platform needs its default Secure Boot keys installed. Switch to UEFI mode, look for an option to restore or install default keys, then try again. The second is the Windows 11 installer still complaining after you enable everything, which typically means TPM is on but not reporting as version 2.0, or Secure Boot shows as available rather than active. Recheck both in the BIOS and confirm the exact states.
Upgrading an existing legacy install
If you are enabling these on a PC that already runs Windows in legacy BIOS mode, switching to UEFI can stop it booting because the disk uses the older MBR layout. The safe path is to convert the disk to GPT first using the built-in Windows conversion tool, then change the BIOS to UEFI and enable Secure Boot. Rushing the boot-mode change without converting the disk is the most common way people lock themselves out of Windows during this process.
Why it is worth doing
Beyond satisfying the installer, TPM and Secure Boot underpin real protections: hardware-backed encryption keys and a defense against boot-level malware. Enabling them is not just a box to tick for Windows 11; it genuinely hardens a new build with no downside for typical users.
FAQ
Does my CPU have a TPM if I do not see a chip?
Almost certainly yes. Modern CPUs and chipsets include firmware TPM, so there is no separate module to install. You just enable PTT or fTPM in the BIOS and it appears to Windows as TPM 2.0.
Is Secure Boot safe to turn on?
Yes. It is a standard security feature and is required for Windows 11. The only thing to watch is that some older or unsigned boot media and a few Linux setups need extra steps, but for a normal Windows build it is straightforward and beneficial.
Bottom Line
If Windows 11 refuses to install on your new build, enable firmware TPM, switch to UEFI boot, and turn on Secure Boot in the BIOS. These are quick toggles on virtually all modern hardware. Just handle the CSM change carefully if you are converting an existing legacy install rather than starting fresh.
