Windows 11 Installation Assistant: Preflight Checklist for TPM 2.0 and Secure Boot

The Windows 11 Installation Assistant remains the quickest path for upgrading an existing Windows 10 PC to Windows 11. Run the tool, click a few buttons, and it handles the heavy lifting—except when the compatibility checks slam the door. Microsoft’s hardware requirements, enforced since October 2021, turn a straightforward upgrade into a troubleshooting session for anyone with an older machine. The Installation Assistant fails if your system lacks a Trusted Platform Module (TPM) version 2.0, Secure Boot isn’t enabled, or the processor didn’t make Microsoft’s curated list. This guide lays out a preflight checklist to diagnose and fix those blockers before you ever launch the tool.

How the Installation Assistant evaluates your PC

Unlike a clean install that can bypass some checks with workarounds, the Installation Assistant runs a rigorous compatibility scan during its initial phase. It queries the UEFI firmware, TPM subsystem, and Secure Boot database to confirm your machine meets the minimum criteria. If any test fails, the assistant refuses to proceed, displaying an error message that rarely tells the full story.

The assistant leans on the same logic as the PC Health Check app but embedded directly into the upgrade flow. It checks:

• TPM 2.0: Presence and activation of a discrete or firmware TPM conforming to version 2.0.
• Secure Boot: A UEFI feature that validates the integrity of boot components; it must be enabled and capable.
• Processor: A compatible 64-bit CPU (1 GHz or faster, 2+ cores) from the official list—Intel 8th Gen (Coffee Lake) and newer, AMD Ryzen 2000 and newer, or Qualcomm Snapdragon 850 and later.
• RAM: 4 GB or more.
• Storage: 64 GB or larger system drive.
• Graphics: DirectX 12 compatible with WDDM 2.0 driver.
• System firmware: UEFI, not legacy BIOS.

The tool also verifies that disk partitioning uses GPT (GUID Partition Table), because Secure Boot requires UEFI, which in turn needs GPT. A system running an MBR disk on legacy BIOS will fail even if TPM and Secure Boot are otherwise present.

The TPM 2.0 conundrum

Microsoft’s insistence on TPM 2.0 caused the most friction. Many custom-built PCs shipped with TPM headers but no physical module, while pre-2018 laptops often supported only TPM 1.2. The difference matters: TPM 2.0 adds SHA-2 hashing, enhanced authorization mechanisms, and support for newer cryptographic algorithms. It underpins Windows 11 security features like BitLocker on system drives, Windows Hello Enhanced Sign-in Security, and Credential Guard.

Check your TPM status:

1. Press Windows + R, type tpm.msc, and hit Enter.
2. The TPM Management console opens. Under Status, look for “The TPM is ready for use.”
3. Under TPM Manufacturer Information, confirm Specification Version is 2.0.

If the console says “Compatible TPM cannot be found,” you have a problem. On Intel systems, search the BIOS/UEFI for “Intel Platform Trust Technology” (PTT). AMD labels it “AMD fTPM.” These are firmware-based TPMs integrated into the chipset—they don’t require a physical module. Enabling PTT or fTPM typically solves the missing TPM error.

Discrete TPM modules can still be purchased for motherboards with TPM headers, but availability fluctuates. Check your motherboard manual for the exact pin count and part number. Once installed, return to the BIOS to enable the module; some boards default to off.

Secure Boot: more than a toggle

Secure Boot prevents unsigned firmware and bootloaders from executing. For the Installation Assistant, it’s binary: on or off. In reality, Secure Boot states span Enabled, Disabled, and Setup Mode. The assistant requires “Enabled” with a populated signature database.

How to verify Secure Boot:

• Open System Information (msinfo32).
• Look for “Secure Boot State” in the System Summary.
• It must say “On.” If it says “Off” or “Unsupported,” you need to enter the UEFI firmware settings.

Enable Secure Boot in UEFI:

1. Restart the PC and press the key to enter UEFI (usually Del, F2, F10, or Esc).
2. Navigate to the Security, Boot, or Authentication tab.
3. Locate “Secure Boot” and set it to Enabled.
4. If the option is grayed out, you may first need to change “OS Type” from “Other OS” to “Windows UEFI Mode.”
5. On some systems, you must also install factory default keys (choose “Restore Factory Keys” or “Reset to Setup Mode”) – this populates the Secure Boot database.
6. Save changes and exit.

A common trap: even with Secure Boot “On,” the assistant fails because the PC boots in legacy BIOS mode. That’s linked to GPT vs. MBR. Convert the disk to GPT using Microsoft’s MBR2GPT tool (built into Windows 10 1703 and later) without wiping data. Then switch firmware to UEFI mode.

mbr2gpt /validate /allowFullOS
mbr2gpt /convert /allowFullOS

After a successful conversion, the system will boot into UEFI mode, and Secure Boot can function properly.

Processor and other hardware hurdles

Even with TPM 2.0 and Secure Boot squared away, the assistant may balk at an unsupported CPU. Microsoft lists compatible processors on its Windows 11 supported Intel and AMD pages. The cutoff is based on security features like Mode Based Execution Control, page table integrity, and Hypervisor-protected Code Integrity. CPUs that lack these won’t pass the installation assistant check.

What to do when your CPU is unsupported:

• Check physical capability: Some features (like MBEC) are absent in hardware, so no firmware update will help. However, certain Intel 7th Gen and AMD Zen 1 chips were initially tested by Insiders but later excluded. Microsoft hasn’t added them to the official list.
• Consider a clean install: While the Installation Assistant enforces CPU checks, running setup.exe from a Windows 11 ISO on unsupported hardware sometimes lets you proceed if TPM 2.0 and Secure Boot are present. This isn’t guaranteed and may require registry hacks or skipping the CPU check during setup. Microsoft does not support systems that bypass the requirements, and updates may not be offered.
• Stay on Windows 10: It’s supported until October 14, 2025. After that, extended security updates (ESU) will be available for a fee, similar to Windows 7’s end-of-life program.

RAM and storage checks rarely fail on machines that otherwise meet the other requirements. Run dxdiag to confirm DirectX 12 support and WDDM 2.0 driver version.

The installation assistant step-by-step

Once you’ve ticked every box, the actual upgrade is uneventful.

1. Download the Windows 11 Installation Assistant from Microsoft’s official Download Windows 11 page.
2. Launch as administrator.
3. Accept the license terms.
4. The assistant runs the compatibility scan. If it passes, click “Accept and install.”
5. The tool downloads Windows 11 (approximately 4–5 GB) and verifies the files.
6. The PC restarts multiple times. Expect the process to take 30 minutes to an hour depending on hardware and internet speed.

Keep the machine plugged in. Major updates drain battery and a mid-upgrade shutdown can corrupt the OS. Backup critical files beforehand—though the assistant preserves personal data and apps, anomalies happen.

When the assistant still fails: troubleshooting table

Alternative upgrade methods

If the Installation Assistant proves stubborn, other paths exist:

• Windows 11 Media Creation Tool: Creates a bootable USB or downloads an ISO. Running Setup from within Windows performs a similar compatibility check, but running setup from a flash drive on boot can sometimes skip the CPU check, though not the TPM/Secure Boot requirements.
• Windows Update: For PCs that Microsoft deems fully ready, Windows 11 appears as an optional update. This method also enforces requirements.
• Manual workaround: Advanced users can modify the ISO’s appraiserres.dll or registry to bypass TPM and CPU checks. Microsoft has publicly warned that such systems are unsupported and will receive no updates. In practice, some systems have received security patches, but there are no guarantees.

Business and education customers managing fleets should use Windows Update for Business or Windows Server Update Services (WSUS). Those tools can deploy feature updates, but they respect the hardware requirements.

Future of Windows 11 compatibility

As hardware ages, the TPM 2.0 and Secure Boot requirements will eventually feel less draconian. Every modern laptop ships with a firmware TPM and UEFI. The real pain point is the artificial CPU cutoff, which Microsoft has hinted might relax for certain systems via testing. In August 2023, Microsoft briefly lowered the bar for Intel 7th Gen in the Dev Channel, only to reverse course citing reliability. The company’s official stance remains firm: only listed CPUs are supported.

For now, the preflight checklist—TPM 2.0, Secure Boot, UEFI/GPT, and a compatible CPU—is the price of admission for the Installation Assistant. Run through it methodically before you even download the tool, and the upgrade will likely succeed on the first attempt. For hardware that simply can’t meet the mark, Windows 10 remains a capable, supported operating system with nearly two years of life left. Plan your migration now, whether that means a hardware refresh, a targeted component swap, or accepting the status quo until October 2025.