Windows 11 has a number of system requirements. These requirements include TPM 2.0 and Secure Boot, two important security features that must be enabled to install Windows 11.
If you have used the PC Health Check app and it indicates that your PC does not meet the requirements for Windows 11, you are probably advised to activate TPM 2.0 and Secure Boot via the UEFI settings. These features can be enabled in the BIOS if your computer supports them. This article was updated in 2024 to reflect the latest developments in this field.
Enable TPM and Secure boot in the BIOS
To activate TPM 2.0 and Secure Boot in the UEFI, you must first completely shut down your computer. When you restart your computer, you will need to press a specific key immediately upon startup to access the UEFI settings.
The specific key you should use varies depending on the manufacturer of your computer. Consult your computer's manual or search online for your computer's model name in combination with 'BIOS key' or 'UEFI key'. Some motherboards, especially home-built PCs, may briefly display on the screen during boot which key you need to press to enter the BIOS settings, such as F2, DEL, F12, or F1.
Once in the BIOS settings, navigate to the 'Security', 'Security' or 'Boot' sections. There you enable 'TPM', as well as 'Secure Boot'. Below is an image of my computer's UEFI interface.
If you have enabled TPM and Secure Boot in the BIOS, make sure you save the customized BIOS settings – “Save and exit”. Then check via the PC Health Check app whether this app indicates that you can install Windows 11.
How do I know if Secure Boot is enabled?
After you enable Secure Boot, you can check in Windows to see if this setting has been applied correctly. Follow these steps to verify this:
1. Open 'Windows Security' from the start menu or search bar.
2. In the Windows Security menu, click 'Device Security'.
3. Verify that the 'Secure Boot' option is actually enabled.
These steps will help you confirm that Secure Boot is functioning correctly on your system.
If you do not have a TPM chip and Secure Boot, you can read how you can still install Windows 11 in the following article: Install Windows 11 without TPM and Secure Boot. This does require some technical knowledge.
I hope this helped you. Thank you for reading!
Hello Stefan, thanks for your quick response, I will check whether the USB is bootable, but I think it should be fine via rufus.
I knew the referral you sent, but I couldn't really follow it.
I'm going to use another USB and see if it works again, you'll hear back.
greetings Johan
Dear Stefan, maybe you can help me? I bought a new surface pro x with windows 10 home.
I actually want to get rid of home completely and put a new 10 pro on it without any restrictions on rights, etc.
I have now found a version 10 pro and put it on a stick via Rufus. I adjusted my bios so that it must boot from USB and I also turned off security. However, my surface does not want to boot via USB, I see the light on but it will not start. Does this have anything to do with security or can you give me some advice on what else I should adjust?
I am very grateful in advance
Hello Johan, to determine whether the USB is “bootable”, you must first test the USB on another computer. If you boot the USB on the other computer to the installation from USB, the created bootable USB will work. If not, something went wrong creating the bootable USB. Then you can: https://support.microsoft.com/nl-nl/surface/surface-opstarten-vanaf-een-usb-apparaat-fe7a7323-8d1d-823d-be17-9aec89c4f9f5 use information to get your Surface to boot from USB. Good luck! Greetings, Stefan