How to Prepare Your PC to Support Windows 11 (Update TPM 2.0, Enable UEFI & Secure Boot)

Does PC Health Check say your computer can’t run Windows 11? Microsoft requires four things that older PCs often fail: TPM 2.0, Secure Boot, UEFI boot mode (instead of Legacy) and a supported processor. In this post and in the video above, I check each one and fix them step by step on my HP Z440 workstation.

Update (October 2026): Windows 10 stopped getting security updates on October 14, 2025, so these checks matter more than ever. If your processor is not on Microsoft’s list, you can still install Windows 11 with an unsupported-PC method: see How to Install Windows 11 26H2 on Unsupported PC.

In this article

1. Step 1: Check Your PC with PC Health Check
2. Step 2: Check Your TPM Version
3. Step 3: Check BIOS Mode and Secure Boot
4. Step 4: Convert the Disk from MBR to GPT
5. Step 5: Switch the BIOS to UEFI and Enable Secure Boot
6. Step 6: Upgrade TPM 1.2 to TPM 2.0
7. Step 7: Check That Your Processor Is Supported

Step 1: Check Your PC with PC Health Check

Start with Microsoft’s PC Health Check app. It tells you which requirement your PC fails. When I made the video, Microsoft’s page only said “coming soon”, so I shared the first release of the app. Today you can download the current version directly from Microsoft.

Download PC Health Check (latest, Microsoft) Download PC Health Tool

The second button is the first release of PC Health Check from 2021 that I used in the video. For more details, see Download PC Health Check Windows 11 and Microsoft’s official Windows 11 website.

Step 2: Check Your TPM Version

TPM (Trusted Platform Module) is a small security chip on your motherboard. Microsoft made TPM 2.0 a requirement when it announced Windows 11 in June 2021. Most computers released in the three years before that should already have TPM 2.0. Some older machines have a TPM 1.2 chip, which on some models can be upgraded to 2.0 with a firmware update (Step 6). Not every computer can be upgraded.

1. Press Windows + R, type tpm.msc and press Enter.
2. Look at Specification Version (1.2 or 2.0) and Manufacturer Version. On my HP it showed specification version 1.2 and manufacturer version 4.40.

You can also check the TPM in Windows Security (Device security > Security processor details) or with PowerShell.

Step 3: Check BIOS Mode and Secure Boot

1. Press Windows + R and type msinfo32, or just start typing System Information in the Start menu.
2. Look at BIOS Mode: it should say UEFI, not Legacy.
3. Look at Secure Boot State: it should say On.

On my PC, BIOS Mode was Legacy and Secure Boot State was Unsupported. Secure Boot only works in UEFI mode, so first the disk has to be converted (Step 4) and the BIOS switched to UEFI (Step 5).

Step 4: Convert the Disk from MBR to GPT

UEFI cannot boot from an MBR disk. To check your disk, right-click This PC, choose Manage and open Disk Management. Right-click Disk 0, choose Properties and look at Partition style on the Volumes tab. If it says Master Boot Record (MBR), convert it with Windows’ own tool. It keeps your files, but make a backup first anyway.

1. Run Command Prompt as administrator.
2. Check that the disk can be converted:

   mbr2gpt.exe /validate /allowfullOS

3. Convert it:

   mbr2gpt.exe /convert /allowfullOS

4. Wait until the process is done. You can follow the progress on screen until you see Conversion completed successfully.

Warning: After the conversion, you must switch the BIOS to UEFI mode (Step 5). If you don’t, Windows will not start.

Step 5: Switch the BIOS to UEFI and Enable Secure Boot

Restart the PC and enter the BIOS. On my HP, I press Esc several times while the PC starts; on other computers it’s usually F2, F10 or Delete (search for your PC model if you’re not sure). These are the settings on my HP Z440 workstation. In the video I said this usually works the same way on most HP computers that are not older than about five years:

1. Open BIOS Setup. In the Security menu you can see the TPM version.
2. Go to Advanced > Secure Boot Configuration and choose Legacy Support Disable and Secure Boot Enable.
3. Go to Advanced > Boot Options and make sure the UEFI Boot Order is enabled.
4. Go to Advanced > Option ROM Launch Policy and change All Legacy to All UEFI.
5. Go to Main > Save Changes and Exit and confirm with Yes.
6. When the PC restarts, open the boot options and choose Windows Boot Manager on the disk you converted.

When Windows starts, open System Information again. BIOS Mode should now say UEFI and Secure Boot State should say On.

Step 6: Upgrade TPM 1.2 to TPM 2.0

If tpm.msc still shows specification version 1.2, check whether your PC maker offers a TPM firmware update. The update is different for every brand.

• Microsoft’s TPM firmware page, with the list of PC makers (Acer, Fujitsu, HP and others)
• Dell TPM firmware update (Dell is not on Microsoft’s list)
• HP’s list of laptops with TPM 1.2: https://support.hp.com/bg-en/document/c05381064

Note: TPM must be enabled in the HP BIOS before you can update it.

This is how I upgraded my HP Z440 with HP’s TPM Configuration Utility:

1. On HP Customer Support, search for your model and download the TPM 1.2 to 2.0 firmware update.
2. Run the download. It extracts its files to a folder inside C:\SWSetup.
3. Create a new folder, for example TPM upgrade on the desktop.
4. Copy the firmware file that matches your current TPM version into it. My TPM was version 1.2 with manufacturer version 4.40, so I used the file that upgrades it to TPM 2.0 version 5.62. Check your own versions in tpm.msc and pick the right file.
5. Copy TPMConfig64.exe into the same folder.
6. Right-click TPMConfig64.exe, choose Run as administrator, accept the warning and click Next.
7. When it says the TPM firmware update was prepared successfully, click Restart.

Warning: Do not turn off or shut down the PC while the TPM update runs during the restart.

After the restart, run tpm.msc again. My PC now showed manufacturer version 5.62 and specification version 2.0.

Step 7: Check That Your Processor Is Supported

If PC Health Check still says your PC can’t run Windows 11, the reason is usually the processor. Look for your CPU in Microsoft’s Windows Processor Requirements list. It has separate lists for Intel, AMD and Qualcomm.

That was my problem too: my Intel Xeon E5-1650 v4 is on the Windows 10 list but not on the Windows 11 list. So my HP now has TPM 2.0, UEFI and Secure Boot, but PC Health Check still says no because of the CPU. Check your processor first, before you do all the other steps.

If you have questions, leave a comment below.