A blocked Windows 11 upgrade is usually not a hardware problem at all. On most PCs built from roughly 2016 onward, the TPM 2.0 chip and Secure Boot are physically present but switched off in the firmware, and turning them on costs nothing. A new PC is only genuinely required when the processor itself is absent from Microsoft's supported CPU list, because no firmware setting can change which chip you own. Knowing which situation you are in saves you from spending money on a problem a free toggle would have solved.
Quick Answer
If your upgrade is blocked by missing TPM 2.0 or Secure Boot, the fix is almost always free: enable them in your BIOS or UEFI firmware. Only an unsupported CPU forces a genuine purchase, because that cannot be resolved through any firmware change. Check the firmware first, then decide.
The free fix most people miss
Microsoft's Windows 11 requirement that catches the most people is TPM 2.0, a small security module. Here is the part that matters: most machines from the last several years already have it, baked into the processor as firmware. Intel calls this feature PTT (Platform Trust Technology) and AMD calls it fTPM. It is frequently disabled out of the box.
Secure Boot is the same story. It is a UEFI feature that almost every modern motherboard supports, often left off by default or after a previous reinstall. Both of these are settings, not parts. If your PC reports that it lacks TPM 2.0 or Secure Boot, the realistic first assumption is that they are present and switched off.
How to check and enable them
Restart and enter your firmware setup, usually by tapping Delete, F2 or F10 during boot. Look under security or advanced menus.
- Find the TPM or PTT or fTPM option and set it to enabled.
- Find Secure Boot, ensure boot mode is UEFI rather than legacy, and enable it.
- Save and exit, then re-run the Windows 11 compatibility check.
If the machine now passes, run the official upgrade through Windows Update. That route keeps you fully supported and receiving security updates, which matters far more than it sounds.
When a new PC is the honest answer
The one block you cannot toggle away is the CPU. Microsoft maintains a supported processor list, and if your chip is functional but not on it, the official upgrade path is closed. Community workarounds exist, such as registry edits and modified install media, but Microsoft treats those installs as unsupported and warns they may stop receiving updates. For a machine you rely on, an unsupported install is a poor long-term bet.
Why an unsupported workaround is a trap
An install that "works for now" but may lose security updates is exactly the kind of false saving worth avoiding. If your CPU is off the supported list, the clean path is new hardware that ships Windows 11-ready, with TPM and Secure Boot already enabled. A compact, capable machine often does the job for everyday use, and the mini PC range at Evetech is worth checking first if desk space and power draw are a factor.
Working out which camp you are in
Run the PC Health Check or the Windows Update compatibility report and read the specific reason it gives. If it names TPM or Secure Boot, head into the firmware first, because that is almost certainly a free fix. If it names the processor, no setting will help and you are looking at new hardware.
There is a middle case worth noting: a very old machine may genuinely lack a firmware TPM, in which case some desktops can take an add-in TPM module on the motherboard header, while many laptops cannot. For most people, though, the split is clean. Firmware toggle, or new CPU. When it is the latter, Evetech's best-selling PCs show what current Windows 11-ready machines cost in Rand.
Why getting this right saves money
The financial argument for checking firmware before buying anything is straightforward. Intel PTT and AMD fTPM are built into most processors from the last six or seven years and cost nothing to enable. Secure Boot is a UEFI configuration item, not a paid feature. If either of those is the only blocker, you go from blocked to passing without spending a rand.
The scenario where spending makes sense is narrower than people assume. An unsupported CPU on an otherwise capable machine is genuinely a hardware wall. But even then, the options split further: on a desktop with a standard socket, an AM4 board can often take a Ryzen 5000-series chip for a relatively modest upgrade, moving the whole machine onto the supported CPU list without replacing it. On a laptop or mini PC with a soldered processor, that path is closed and a full replacement is the only realistic move.
Understanding which category your machine is in before you do anything else is the practical starting point. Firmware settings take minutes; a hardware purchase is final. Getting the diagnosis right first is the entire difference between a free afternoon fix and an unnecessary spend.
Checking your current state in two steps
Before opening the BIOS, open the PC Health Check tool and note the exact failure reason. Then press Windows + R and run msinfo32 to check BIOS Mode (UEFI vs Legacy) and Secure Boot State. If BIOS Mode shows Legacy, Secure Boot cannot be enabled until you switch to UEFI, which typically means converting a disk from MBR to GPT. That is a more involved process but still free. If BIOS Mode already shows UEFI and only TPM is flagged, the firmware menu is your next and probably final stop before re-running the compatibility check.
Frequently Asked Questions
Does enabling TPM 2.0 in BIOS cost anything?
No. TPM 2.0 is built into most processors from recent years as a firmware feature, called PTT on Intel and fTPM on AMD. Enabling it is a free settings change, not a hardware purchase.
My PC says no TPM 2.0. Do I need to buy a chip?
Usually not. The far more likely cause is that the firmware TPM is simply disabled. Enable PTT or fTPM in your BIOS first, and only consider hardware if the option genuinely is not present.
Can I install Windows 11 on an unsupported CPU?
Technically yes, using registry edits or modified install media, but Microsoft considers these installs unsupported and warns they may stop receiving updates. For a machine you depend on, that is a risky long-term choice.
How do I know if my CPU is the problem?
Run the PC Health Check or read the Windows Update compatibility report. If it names the processor specifically, no firmware setting will fix it. If it names TPM or Secure Boot, the firmware toggle almost certainly will.
Is Secure Boot also just a setting?
Yes, on nearly all modern motherboards. Ensure your firmware is in UEFI mode rather than legacy, then enable Secure Boot. Like TPM, it is a configuration change rather than a part you buy.
Confirmed your CPU is off the supported list? Skip the unsupported workaround and look at the mini PC range at Evetech for a compact, Windows 11-ready machine priced in Rand.