Check and enable TPM 2.0 in Windows 11

What is TPM 2.0?

TPM stands for Trusted Platform Module. It is a security component that stores cryptographic keys, passwords and certificates separately from the operating system, so malicious software cannot access them. Windows 11 requires version 2.0 of this module; without TPM 2.0 the installation will normally not run. This guide explains how to check and enable TPM 2.0 in Windows 11.

The module exists in two forms. A discrete TPM is a separate chip on the motherboard. A firmware TPM runs as part of the processor, under the name Intel Platform Trust Technology (PTT) on Intel systems and fTPM on AMD systems. For Windows 11 it does not matter which form you have, as long as it is version 2.0 and the feature is enabled.

Besides the installation requirement, Windows 11 uses the TPM for features such as BitLocker drive encryption and Windows Hello. The keys for those features are stored securely in the module, which makes it harder to read them outside your PC.

Microsoft chose TPM 2.0 as a requirement to guarantee a basic level of hardware security on every Windows 11 PC. For example, the module makes it possible to check at startup whether the firmware and boot files have not been modified, and to store sign-in details securely. Many computers from after 2016 have a suitable firmware TPM on board, but it is not always switched on from the factory. As a result, a PC sometimes appears to have no TPM even though the module is present and only needs to be enabled.

Check TPM 2.0 with tpm.msc

The built-in management console shows at a glance whether the TPM is present, ready and version 2.0.

1. Press Windows + R, type tpm.msc and press Enter.
2. Look at the Status box. If it says the TPM is ready for use, the module is active.
3. Under TPM Manufacturer Information, check the Specification Version line. It should say 2.0.

If instead you see a message that no compatible TPM can be found, the module is either disabled in the firmware or not present. If the version number is lower than 2.0, such as 1.2, the device does not meet the Windows 11 requirement.

On the left in the console you also see an option to prepare or clear the TPM. You do not need these for a standard check; they are intended for management and troubleshooting. For the question whether you are ready for Windows 11, the status line and specification version are enough. Note the version, because you need it later if you have to change the firmware.

Check TPM 2.0 with Get-Tpm in PowerShell

If you want to read the status in a way you can copy or use in a script, PowerShell is more convenient than the console. Open PowerShell as administrator and run:

Get-Tpm

The output contains a few lines that give you an immediate answer:

• TpmPresent: True if a TPM is present.
• TpmReady: True if the module is ready for use.
• TpmEnabled: True if the module is enabled.

If TpmPresent and TpmReady are both True, your system is ready for Windows 11. If an error message appears or the values are False, you probably still need to enable the module in the firmware.

If you want Microsoft's full requirements check, use the PC Health Check app. It checks not only TPM 2.0, but also Secure Boot, the processor and memory, and tells you in plain language whether your PC is suitable for Windows 11. For only the TPM status, Get-Tpm is faster, but the app gives a complete picture if you are unsure whether you meet all system requirements.

Check TPM 2.0 in Windows Security

A third check method is in Settings itself and also shows the version straight away.

1. Open Settings > Privacy & security > Windows Security.
2. Select Device security.
3. Under Security processor, click Security processor details.
4. Under Specification version, check whether it says 2.0.

If you do not see a security processor section at all, Windows does not detect a TPM and you need to enable it in the firmware first. If you see a warning triangle saying the security processor needs attention, click it; often a restart or firmware update is enough to clear the message.

The three methods give the same information; choose whichever you find most convenient. The table below compares them.

Enable TPM 2.0 in the UEFI firmware

If the check shows no TPM is found while your system does have one, the feature is often simply disabled in the firmware. You switch it on in the UEFI settings (BIOS).

1. Go to Settings > System > Recovery and under Advanced startup select Restart now.
2. After restarting, choose Troubleshoot > Advanced options > UEFI Firmware Settings and click Restart.
3. In the UEFI, look for a section such as Security, Advanced or Trusted Computing.
4. Turn on the TPM option. On Intel it is often called Intel PTT or Intel Platform Trust Technology, on AMD AMD fTPM or AMD PSP fTPM switch.
5. Save (usually with F10) and restart.

If you prefer not to enter the firmware through Windows, you can also open the UEFI by pressing a key immediately at startup, usually Del, F2 or F10 depending on the brand. The boot screen often briefly shows which key you need. The route via Settings and Advanced startup works on every PC, even if the boot screen passes too quickly.

After restarting, check with tpm.msc whether the module is now recognised. The exact menu names vary by manufacturer and motherboard; the official guidance with variants is at Microsoft Support.

TPM not recognised? Fix it with a firmware update or by clearing the TPM

Sometimes the module still causes problems after being enabled. These steps can help:

• Update the UEFI firmware to the latest version. Older firmware does not always recognise fTPM or PTT correctly.
• Check that Secure Boot is enabled; Windows 11 requires this alongside TPM 2.0.
• Clear the TPM only as a last resort via tpm.msc using the Clear TPM option. This removes stored keys, so do not do this if BitLocker is active without having your recovery key to hand.

A common situation is that the UEFI shows the TPM option, but Windows still sees nothing after enabling it. Usually it helps to save the firmware settings, fully shut down the PC (not just restart) and start it again. On AMD systems the fTPM option is sometimes hidden under a submenu called AMD CBS or PSP, deeper in the settings than you would expect. Take time to work through the menus calmly before concluding that your PC has no TPM.

Also pay attention to discrete TPM modules on older motherboards: they sometimes require a physical presence confirmation in the UEFI before Windows may use them. The UEFI then shows a prompt in which you must approve the change with a key. Do not skip that step, because otherwise the module remains disabled despite your setting.

For a PC that you set up with a local account, resetting can sometimes differ from a Microsoft account. Read more about this in How to install Windows 11 with a local account. If you want to make sure you can reactivate Windows after a hardware change, link your licence as described in Link your Windows digital licence to your Microsoft account.

Without TPM 2.0, only Windows 10 or a hardware upgrade remains

If your device definitively does not meet the requirement, for example because it only has TPM 1.2 or does not support a module, there are a few realistic options.

Workarounds for installing Windows 11 without TPM 2.0 circulate, but they create an unsupported configuration. Such an installation does not always receive updates and can still fail on the system requirement during a major Windows update. For a PC you use daily, that is a risk you would rather avoid; staying on Windows 10 or upgrading the hardware gives a more stable result.

If you are considering new hardware, keep in mind what happens to your existing licence. A modern processor almost always contains a firmware TPM, so on a new PC you will rarely run into this requirement.