Upgrading to Windows 11 requires strict hardware compliance that differs significantly from previous Windows generations. Microsoft instituted mandatory hardware security baselines—chiefly TPM 2.0 (Trusted Platform Module), UEFI Secure Boot, and hardware-enforced virtualization security (VBS/HVCI). This guide walks you through every requirement and explains how to verify your system accurately.

1. Official Windows 11 Hardware Baselines

Before attempting an upgrade or installation, your PC hardware must meet or exceed Microsoft's minimum baseline specifications:

Component Minimum Baseline Recommended Power User Spec
Processor (CPU) 1 GHz or faster with 2+ cores on a compatible 64-bit architecture Intel Core 12th+ Gen or AMD Ryzen 5000+ series (6+ cores)
System Memory (RAM) 4 GB RAM 16 GB to 32 GB dual-channel DDR4/DDR5
Storage Drive 64 GB storage space 512 GB+ NVMe PCIe Gen 3/4 SSD
System Firmware UEFI with Secure Boot capability enabled UEFI with Secure Boot and TPM firmware enabled
Security Chip Trusted Platform Module (TPM) Version 2.0 Discrete TPM 2.0 or integrated processor fTPM / PTT
Graphics Card (GPU) DirectX 12 compatible or later with WDDM 2.0 driver DirectX 12 Ultimate with dedicated VRAM (4GB+)
Display Resolution High definition (720p) display greater than 9" diagonal 1080p (FHD) or 1440p (QHD) at 60Hz+

2. Understanding TPM 2.0 & UEFI Secure Boot

The most common obstacle preventing older or custom desktop PCs from qualifying is the security subsystem:

  • TPM 2.0 (Trusted Platform Module): A cryptoprocessor designed to secure hardware through integrated cryptographic keys. It stores BitLocker encryption keys, Windows Hello biometric signatures, and validates kernel boot integrity. Modern desktop processors have firmware TPM integrated directly into the processor architecture: Intel PTT (Platform Trust Technology) for Intel processors and AMD fTPM (Firmware TPM) for AMD processors.
  • UEFI Secure Boot: Replaces legacy BIOS MBR partitioning with modern GPT-based boot integrity. Secure Boot ensures that only cryptographically signed bootloaders and hardware drivers execute during power-on, blocking rootkits and boot-sector malware.
💡
Tip: If the official PC Health Check app flags your PC as incompatible, in 80% of custom desktop cases the CPU actually supports TPM 2.0, but the feature is simply disabled in your motherboard's BIOS settings under AMD fTPM or Intel Platform Trust Technology (PTT).

3. CPU Compatibility: Intel 8th Gen & AMD Zen 2 Cutoffs

Microsoft established an architectural cutoff point for processor compatibility based on support for Mode Based Execution Control (MBEC) and hardware-level mitigations against speculative execution vulnerabilities (Spectre/Meltdown):

  • Intel CPUs: Generally requires 8th Generation Core processors (Coffee Lake) or newer (e.g., Core i5-8400, Core i7-8700K, and subsequent 9th, 10th, 11th, 12th, 13th, and 14th Generations). Older 7th Gen processors (like Core i7-7700K) are officially unsupported except for a few select enterprise SKUs.
  • AMD CPUs: Generally requires AMD Ryzen 2000 series (Zen+ / Zen 2) or newer (e.g., Ryzen 5 2600, Ryzen 7 3700X, Ryzen 5 5600X, Ryzen 7000/9000). First-generation Ryzen 1000 series processors (Zen 1) are excluded from the official whitelist.

4. Verifying Compatibility via PowerShell & Command Line

You can check whether your system has TPM 2.0 and Secure Boot enabled without installing third-party utilities by executing standard Windows administrative commands:

Checking TPM Status:

# Open PowerShell as Administrator and run:
Get-Tpm

Inspect the output fields: TpmPresent: True, TpmReady: True, and ManufacturerVersion. If the version shows 2.0, your cryptographic hardware is fully compliant.

Checking Secure Boot Status:

# In PowerShell as Administrator:
Confirm-SecureBootUEFI

A return value of True confirms Secure Boot is running. If it returns False or throws an error indicating the system is booted under Legacy BIOS, your disk is likely partitioned with MBR rather than GPT.

5. Enabling fTPM & Intel PTT in BIOS/UEFI

If your processor is modern but Get-Tpm returns false, follow these steps:

  1. Reboot your PC and press Del or F2 during POST to enter motherboard UEFI settings.
  2. Switch to Advanced Mode (usually F7 on ASUS, MSI, and ASRock).
  3. Navigate to the Security, Trusted Computing, or PCH Configuration tab.
  4. Look for AMD fTPM switch (AMD systems) or Intel Platform Trust Technology (PTT) (Intel systems).
  5. Set the toggle to Enabled or Firmware TPM.
  6. Navigate to the Boot section, ensure CSM (Compatibility Support Module) is set to Disabled, and Secure Boot is enabled in Standard Mode.
  7. Save changes and reboot (F10).