Windows 11 requires TPM 2.0, and most boards made in the last several years already have it built into the processor firmware. It is often just switched off. AMD calls the feature fTPM and Intel calls it PTT, and enabling it takes a minute in the BIOS. Older boards may offer a header for a separate plug-in module instead. This guide shows how to check your status in Windows, turn on firmware TPM, set up Secure Boot, and avoid problems such as losing access to an encrypted drive.
What TPM 2.0 Does and Why Windows 11 Asks for It
A Trusted Platform Module is a small security function that stores cryptographic keys and records measurements of the boot process. Windows uses it for features such as device encryption, Windows Hello sign-in protection and verified startup. Microsoft made version 2.0 a baseline requirement for Windows 11, together with UEFI firmware and Secure Boot capability.
For a gaming PC, the requirement has a practical side beyond the installer check. Some online games with strict anti-cheat systems ask for Secure Boot, and in some cases for TPM, to be active before they launch. The details vary by title and change over time, so rely on the game’s own support page for its current rules instead of assuming.
Firmware TPM Versus a TPM Header Module
| Type | What it is | Typical BIOS name | Good to know |
|---|---|---|---|
| AMD firmware TPM | Runs inside the processor’s secure environment | fTPM or AMD CPU fTPM | Common on modern Ryzen boards; update the BIOS if you notice stutter |
| Intel firmware TPM | Runs in the platform’s management firmware | PTT or Intel Platform Trust Technology | Often found under a PCH firmware or security menu |
| Header module | A small plug-in card with its own chip | TPM Device or Security Device Support | Pin layouts vary by board maker, so match the module to your board |
The names differ between brands, so look for any entry containing the words TPM, fTPM, PTT or Security Device. If your manual shows a TPM header and no firmware option, check the manufacturer’s page for a compatible module instead of guessing from a generic listing.
Before You Change Anything: Prerequisites
- Know whether your drive is encrypted. If BitLocker or device encryption is on, copy the recovery key from your Microsoft account or Windows settings first.
- Back up important files. BIOS changes are usually safe, but a partition style change is not forgiving.
- Write down your current BIOS version from the main screen so you can describe it if you need support.
- Have your board’s manual or its online version ready, because menu names vary between makers.
- Keep the PC on stable power. A surge-protected outlet or a small battery backup helps, especially if a BIOS update turns out to be needed.
Step 1: Check What Windows Already Sees
This is the safest step, because it only reads information. Press the Windows key and R together, type tpm.msc and press Enter. The window reports whether a TPM is ready to use and shows its specification version. If it says compatible TPM cannot be found, the feature is off or missing. You can also open Windows Security, choose Device security, and look for a Security processor entry.
Next, check Secure Boot and boot mode. Open System Information by typing msinfo32 in the Start menu. Look at BIOS Mode, which should say UEFI, and Secure Boot State, which should say On. Write down both values before you move on.
Step 2: Turn On Firmware TPM in the BIOS
Restart the PC and open the firmware setup using the key shown at startup, often Delete or F2. If you are unsure how to reach it, our walkthrough on opening the UEFI BIOS in Windows 11 lists every method, including the one that works from inside Windows.
- Switch to the advanced view if the board opens in a simple mode.
- Search the advanced, settings, security or miscellaneous menus for fTPM, PTT or a TPM device entry.
- Change the value to Enabled. If there is a choice between firmware and discrete, pick firmware unless you installed a header module.
- Save changes and exit, using the key shown on the screen, usually F10.
- Boot into Windows and run
tpm.mscagain to confirm it reports version 2.0.
If you cannot find the option, update the BIOS first using the maker’s instructions. Only do this on stable power, never interrupt the process, and use USB BIOS Flashback or a dual-BIOS safety feature only on boards that have it.
Step 3: Enable Secure Boot Without Breaking Startup
Secure Boot needs the board to boot in UEFI mode, with the compatibility support module disabled and the system drive using the GPT partition style. If msinfo32 showed Legacy for BIOS Mode, do not just flip switches, because Windows may stop booting. Windows includes a tool called mbr2gpt that can convert a system disk without wiping it. Run its validate option first, and treat the conversion as something to attempt only after a full backup.
With UEFI mode confirmed, open the boot or security menu, set the OS type to Windows UEFI mode if offered, and enable Secure Boot. Some boards require loading the default keys before the switch becomes available. Save, restart, and check msinfo32 again.
What to Expect and When to Stop
A normal run involves one or two restarts, a slightly longer first boot while the firmware rebuilds its settings, and no visible change inside Windows apart from the status screens. Games and applications behave as before. Stop and reassess if the board shows a warning about changing security settings that you do not understand, if the BIOS lists no TPM or security entry at all after an update, or if the system fails to reach Windows after a boot-mode change. In those cases, restore the previous values, record the exact message and consult the board maker’s support page. Needing a header module, or a processor that is not supported, is a hardware answer rather than a settings one.
Common Pitfalls and How to Fix Them
- Secure Boot greyed out. The compatibility support module is usually still enabled, or the default keys have not been installed. Disable the module and load the default keys.
- No display after changing boot mode. An older graphics card without UEFI support may fail. Resetting the BIOS by the manual’s method restores the previous mode. When clearing CMOS, unplug the PSU first and remember all settings return to defaults.
- Recovery key prompt after the change. The encryption system noticed a firmware change. Enter the saved key and the drive unlocks.
- Stutter with AMD fTPM. A known issue appeared on some AMD systems in the past and later BIOS releases addressed it, so install current firmware before disabling anything.
- Installer still refuses. The processor may not be on Microsoft’s supported list, which is a separate rule from TPM.
Worked Example: A Typical Ryzen Build
Take a system where the installer reports that the PC cannot run Windows 11. The owner runs tpm.msc and sees no TPM found, then opens msinfo32 and finds UEFI mode with Secure Boot off. After saving the BitLocker key, they enter the BIOS, find fTPM in an advanced menu, enable it, load the Secure Boot default keys, and turn Secure Boot on. One restart later, tpm.msc shows version 2.0 and the installer’s checks pass. The whole sequence took four changes and no hardware. Your menu names will differ, but the order of check, back up, enable and verify transfers to any board.
Related guides
- Windows Macos Linux Gaming Performance Comparison Strengths Weaknesses
- Desktop Operating Systems Gaming Performance Strengths Weaknesses
- 5G Home Internet Wifi Modem Settings Low Latency Gaming
Frequently Asked Questions
Do I need a physical TPM chip for Windows 11?
Not on most modern boards. Recent AMD and Intel platforms include a firmware TPM that behaves as TPM 2.0 and satisfies the requirement, so no extra hardware is needed. A physical module that plugs into a header is mainly relevant for older boards that lack firmware TPM. Check your manual for the exact header layout before buying one.
Why does Windows say TPM is missing when my board supports it?
In most cases the feature is simply switched off in the BIOS. Enter the firmware settings, look for AMD fTPM or Intel PTT, usually under an advanced, security or trusted computing menu, and enable it. Save and restart. If the option is absent, update the BIOS to the latest version from the board maker and check again.
Will enabling or clearing TPM erase my files?
Enabling it does not delete your files. Clearing or resetting the TPM does erase the keys stored in it, which can lock you out of encrypted drives, such as those protected by BitLocker or device encryption, unless you have the recovery key. Save that key somewhere safe before changing TPM or Secure Boot settings.
Is Secure Boot the same thing as TPM?
No. TPM is a security chip or firmware function that stores keys and measurements, while Secure Boot is a firmware feature that only allows signed boot software to start. Windows 11 expects both to be available. They work together, but each is switched on separately in the BIOS, and enabling one does not enable the other.
Can I install Windows 11 without TPM 2.0?
Unofficial workarounds exist, but Microsoft does not support them, and updates may be affected. A board that has firmware TPM can usually meet the requirement with a simple BIOS setting, so that is the better path. If your hardware truly lacks support, consider staying on a supported Windows version until you upgrade the platform.
