How to Enable TPM 2.0 in BIOS (Step-by-Step Guide for Windows 11 PCs)
Saw the message “This PC must support TPM 2.0” while installing Windows 11? Don’t panic. In most cases, your PC already has a TPM. It is just switched off in the BIOS.
This guide shows you exactly how to turn it on. It covers Intel and AMD systems, popular laptop and motherboard brands, and the fixes for when the option refuses to show up. You can finish the basic steps in about five minutes.
Quick Answer: How to Enable TPM 2.0 in BIOS
- Press Win + R, type tpm.msc and check if a TPM already exists.
- Restart your PC and open the BIOS/UEFI (usually F2, Del, F10 or Esc during startup).
- Go to the Security, Advanced or Trusted Computing menu.
- Enable Intel PTT (Intel PCs) or AMD fTPM (AMD PCs). On some boards, set Security Device Support to Enabled.
- Press F10 to save and exit.
- Open tpm.msc again. It should say “The TPM is ready for use” with Specification Version 2.0.
While you are in the BIOS, also check that Secure Boot is on. Windows 11 needs both.
What Is TPM 2.0 (in Simple Words)?
TPM stands for Trusted Platform Module. It is a small security chip, or a security feature inside your processor, that stores encryption keys safely. Think of it as a tiny locker that malware cannot easily open.
Windows uses it for BitLocker drive encryption, Windows Hello sign-in and protection against boot-level attacks. Windows 11 will not install normally without TPM 2.0. TPM 1.2 is not enough.
Which Type of TPM Does Your PC Have?
You will see different names in different BIOS screens. They all lead to the same result.
| TPM type | Where it lives | BIOS name you will see | Common on |
|---|---|---|---|
| Firmware TPM (Intel) | Inside the Intel chipset/CPU | Intel PTT, Platform Trust Technology, PCH-FW Configuration | Most Intel laptops and PCs from around 2014 onwards |
| Firmware TPM (AMD) | Inside the AMD processor | AMD fTPM, AMD CPU fTPM, PSP fTPM | Ryzen laptops and AM4/AM5 boards |
| Discrete TPM (dTPM) | Separate chip or plug-in module | TPM Device, Security Chip, Security Device Support | Business laptops, some desktop boards with a TPM header |
For Windows 11, the processor also matters. Microsoft officially supports Intel 8th gen and newer, and AMD Ryzen 2000 series and newer, with a few exceptions. If your CPU is older, enabling TPM alone may not make the PC eligible.
Not sure about your processor generation? Our AMD Ryzen 3 vs Intel Core i3 comparison explains how to read CPU model numbers.
Before You Start: A Quick Checklist
A two-minute check now saves you hours later.
- Check if TPM is already on. Run
tpm.msc. If it shows a version, you may not need the BIOS at all. - Back up your files. BIOS changes are usually safe, but a backup is cheap insurance. Our guide on how to back up and restore files in Windows shows the easy way.
- Save your BitLocker recovery key. If drive encryption is on, changing TPM settings can trigger a recovery screen. Your key is at account.microsoft.com/devices/recoverykey if you sign in with a Microsoft account.
- Keep the power connected. Plug in your laptop charger before you start.
- Write down what you change. If something goes wrong, you can reverse it.
If you don’t have a spare pen drive for the recovery key and later BIOS updates, a 32 GB or 64 GB USB 3.0 drive from a brand like SanDisk or HP is cheaply available on Amazon and worth keeping in your laptop bag.
Step 1: Check Your Current TPM Status
You can check in three ways. Use whichever is easiest.
Method A: tpm.msc
Press Win + R, type tpm.msc and press Enter. If you see “The TPM is ready for use” and Specification Version 2.0, you are done. If you see “Compatible TPM cannot be found”, TPM is switched off or missing.
Method B: Windows Security
Open Windows Security > Device security > Security processor details. Look for Specification version 2.0. If the Security processor section is missing, TPM is most likely disabled.
Method C: PowerShell
Right-click Start, open Terminal (Admin) and type Get-Tpm. If TpmPresent and TpmReady both say True, you are good.
Step 2: Open the BIOS/UEFI Settings
Restart your PC and press the BIOS key repeatedly as soon as the logo appears. The key depends on the brand.
| Brand | Usual BIOS key |
|---|---|
| Dell | F2 (F12 for the boot menu) |
| HP | Esc, then F10 |
| Lenovo | F2 or Fn + F2 (ThinkPad: Enter, then F1) |
| ASUS | F2 or Del |
| Acer | F2 or Del |
| MSI | Del |
| Gigabyte / Aorus | Del |
| ASRock | F2 or Del |
Fast startup can make the key window very short. If you keep missing it, use this Windows method instead.
- Open Settings > System > Recovery.
- Click Restart now next to Advanced startup.
- Choose Troubleshoot > Advanced options > UEFI Firmware Settings.
- Click Restart. Your PC opens the BIOS directly.
On Windows 10, the same option sits under Settings > Update & Security > Recovery. If you are still on Windows 10, read why Windows 10 support is ending and what it means for you.
Step 3: Find and Enable the TPM Setting
The menu names change from brand to brand. Look inside Security, Advanced, Settings or Trusted Computing. Then enable the option that matches your processor.
Intel PCs: enable Intel PTT
Look for Intel Platform Trust Technology (PTT), PTT, or TPM Device Selection. Set it to Enabled or PTT / Firmware TPM.
AMD PCs: enable AMD fTPM
Look for AMD fTPM, AMD CPU fTPM or PSP fTPM. Set it to Enabled. On some boards, you also need to set Security Device Support to Enabled.
Boards or laptops with a separate TPM chip
Look for TPM Device, Security Chip or TPM State. Choose Enabled, Available or TPM 2.0.
Brand-wise menu paths (quick reference)
BIOS versions differ, so treat these as a map, not a promise. The wording on your screen may vary slightly.
| Brand | Where to look | What to set |
|---|---|---|
| Dell | Security > TPM 2.0 Security | Tick TPM On |
| HP | Security > TPM Embedded Security | TPM Device: Available, TPM State: Enabled |
| Lenovo (IdeaPad/Legion) | Security > Intel Platform Trust Technology or AMD fTPM | Enabled |
| Lenovo (ThinkPad) | Security > Security Chip | Enabled, then pick Intel PTT or TPM 2.0 |
| ASUS (Intel) | Advanced > PCH-FW Configuration | TPM Device Selection: PTT (Firmware TPM) |
| ASUS (AMD) | Advanced > AMD fTPM configuration | AMD CPU fTPM: Enabled |
| MSI | Settings > Security > Trusted Computing | Security Device Support: Enabled, then choose PTT or AMD fTPM |
| Gigabyte | Settings > Miscellaneous | Intel PTT or AMD CPU fTPM: Enabled |
| ASRock | Advanced or Security tab | Intel PTT or AMD fTPM: Enabled |
| Acer | Security | TPM / Intel PTT: Enabled |
Expert tip: If you cannot find the option, use the BIOS search feature (often the F9 or the magnifier icon on newer boards). Search for “TPM”, “PTT” or “fTPM”.
Step 4: Save Your Changes and Exit
Press F10, then confirm with Yes. The PC restarts and loads Windows. Do not switch off the power during this restart.
Don’t confuse “Save and Exit” with “Discard Changes and Exit”. It sounds silly, but this is one of the most common reasons the setting seems to “not work”.
Step 5: Verify That TPM 2.0 Is Working
Back in Windows, press Win + R and run tpm.msc again. You should see “The TPM is ready for use”. Check that Specification Version says 2.0.
Next, run the PC Health Check app from Microsoft. It tells you whether your PC meets all Windows 11 requirements, not just TPM.
Don’t Forget Secure Boot
TPM is only half the story. Windows 11 also needs Secure Boot, and it needs the PC to run in UEFI mode, not Legacy/CSM mode.
Here is how to check:
- Press Win + R, type
msinfo32and press Enter. - Look at BIOS Mode. It should say UEFI.
- Look at Secure Boot State. It should say On.
If Secure Boot is off, open the BIOS and go to Boot or Security. Set Secure Boot to Enabled and choose the Windows UEFI or default keys. On some laptops, the option stays greyed out until you set a BIOS supervisor password.
Secure Boot is greyed out because of Legacy/CSM or MBR?
This is common on older PCs where Windows was installed in Legacy mode on an MBR disk. You can convert the disk to GPT without reinstalling Windows. Back up first.
- Open Command Prompt as administrator.
- Run
mbr2gpt /validate /allowFullOS. If it passes, continue. - Run
mbr2gpt /convert /allowFullOS. - Restart into the BIOS, disable CSM/Legacy, and enable UEFI and Secure Boot.
Before converting a disk, copy your important files to an external drive. A portable SSD such as the SanDisk Extreme Portable SSD or a basic external hard disk like the WD Elements is a sensible backup for a one-time job like this.
My PC Is a Desktop With No TPM Option. What Now?
Some older desktop boards have no firmware TPM at all. The motherboard may still have a TPM header, a small row of pins for a plug-in module.
Check your motherboard manual for the header name and pin layout, for example, 14-1 pin or 20-1 pin. The module must match your board’s brand and header exactly. A wrong one won’t work.
If your board supports it, an official TPM 2.0 module made for your board family, such as the ASUS TPM-M R2.0, M.SI TPM 2.0 module or Gigabyte GC-TPM2.0, is the cleanest fix. Always confirm compatibility with your exact board model before ordering from Amazon.
If your board has no header and no firmware TPM, you are out of options. The better path is a newer PC. Our laptop buying guide and the best i5 laptops under ₹50,000 list will help you choose.
TPM Option Missing or Not Working? Troubleshooting Guide
| Problem | Likely cause | What to do |
|---|---|---|
| No TPM/PTT/fTPM option in BIOS | Outdated BIOS, or old hardware | Update the BIOS from the manufacturer’s website, then check again |
| Option is greyed out | BIOS is locked or in Legacy mode | Switch to UEFI mode, or set a supervisor password if your BIOS demands it |
| tpm.msc says “Compatible TPM cannot be found” | TPM still disabled or changes not saved | Re-enter BIOS, enable it again and use Save and Exit |
| TPM shows version 1.2 | Firmware is set to 1.2 mode | Look for a “TPM Specification Version” or “TPM 2.0” setting. On some business PCs, you need a manufacturer TPM firmware update |
| TPM is ready, but Windows 11 still refuses | Secure Boot off, Legacy/CSM on, or unsupported CPU | Enable Secure Boot, use UEFI mode and run PC Health Check |
| BitLocker asks for a recovery key | TPM settings changed | Enter the recovery key from your Microsoft account |
| BIOS settings keep resetting | Dead CMOS battery | Replace the coin cell battery |
If your BIOS date and time reset every time you unplug the PC, the CR2032 coin cell on the motherboard is probably dead. A fresh Panasonic or Duracell CR2032 (available on Amazon) costs very little and takes a minute to replace on most desktops.
Still stuck? Try these in order:
- Update the BIOS to the latest version.
- Load the BIOS default settings, then enable TPM again.
- Check the manufacturer’s support page for your exact model.
- Contact the service centre, especially if the laptop is under warranty.
Warning Signs Your TPM Setup Needs Attention
- Windows says “TPM 2.0 must be supported and enabled on this PC.”
- tpm.msc shows “Compatible TPM cannot be found.”
- Windows Hello or BitLocker setup fails.
- A game’s anti-cheat refuses to start because of a TPM or Secure Boot error.
Common Mistakes to Avoid
- Pressing Clear TPM without a reason. Clearing wipes the keys stored in the TPM. If BitLocker is on, you can lose access to your data without the recovery key.
- Skipping Secure Boot. TPM alone won’t satisfy Windows 11.
- Forgetting to save in BIOS. Always use Save and Exit.
- Updating BIOS with a laptop on battery. A power cut during a BIOS flash can brick the machine.
- Buying a TPM module without checking the header. Not every module fits every board.
Myth vs Fact
| Myth | Fact |
|---|---|
| “I need to buy a new motherboard to get TPM 2.0.” | Most modern PCs already have a firmware TPM. You only need to enable it. |
| “TPM slows down my PC.” | Everyday performance impact is not noticeable for normal users. |
| “TPM 1.2 is good enough for Windows 11.” | Windows 11 needs TPM 2.0. |
| “TPM spies on me.” | TPM stores keys and security measurements. It does not track what you do. |
| “Enabling TPM erases my data.” | Enabling alone does not. Clearing the TPM can, if BitLocker is active. |
Which Path Should You Take? (Decision Guide)
| Your situation | What to do |
|---|---|
| TPM 2.0 shows in tpm.msc | Just check Secure Boot and run PC Health Check |
| TPM missing; CPU is Intel 8th gen+ or Ryzen 2000+ | Enable Intel PTT or AMD fTPM in the BIOS |
| TPM missing; desktop board has a TPM header | Buy a matching TPM 2.0 module |
| CPU is too old for Windows 11 | Stay on a supported setup, or plan a hardware upgrade |
| Secure Boot is greyed out | Switch to UEFI mode and convert the disk from MBR to GPT |
Why Enabling TPM 2.0 Matters Beyond Windows 11
TPM-backed features are useful even if you don’t care about the Windows 11 badge. BitLocker and device encryption lean on it. So does Windows Hello.
Some competitive PC games, such as Valorant and recent Call of Duty titles, also ask for TPM 2.0 and Secure Boot on Windows 11. A locked-down boot chain also helps against nasty boot-level malware. For a refresher on threats, see our guide to types of computer viruses.
Once Windows 11 is installed, our checklist of things to do after installing Windows 11 helps you set it up properly. If you plan a fresh install, here is how to install Windows from a USB drive.
Expert Tips From Real-World Use
- Update your BIOS first. Many TPM options appear only after a BIOS update. Update gradually if your BIOS is very old.
- Keep your BIOS and Windows updated in 2026. Microsoft has been refreshing the Secure Boot certificates that date back to 2011. Most home PCs get the new ones through Windows Update, but some older systems need a BIOS update from the manufacturer.
- Don’t tweak random settings. Change only the TPM and Secure Boot options.
- Take a phone photo of each BIOS screen before changing it. It is the easiest undo button.
- Use official sources. Download BIOS files only from your brand’s official support site.
Can You Install Windows 11 Without TPM 2.0?
Technically, there are workarounds. Tools and registry tweaks can skip the check. But Microsoft does not support such installs, and you may miss out on updates or run into problems later.
If your PC can only run Windows 11 through a bypass, think about whether the risk is worth it. For a daily-use or work PC, supported hardware is the safer route.
Learn the effectiveness of running another OS side by side in our dual boot vs virtual machine guide.
Conclusion
Enabling TPM 2.0 is usually quick. Open the BIOS, switch on Intel PTT or AMD fTPM, save, and verify with tpm.msc. Then confirm Secure Boot and UEFI mode, and you are ready for Windows 11.
If the option is missing, update the BIOS first. If your hardware simply doesn’t support it, plan an upgrade rather than fighting the machine. Got stuck on a specific brand or model?
Tell us in the comments, and we will help you find the setting.
Frequently Asked Questions
Restart the PC, open the BIOS, and go to Security, Advanced or Trusted Computing. Enable Intel PTT on Intel PCs or AMD fTPM on AMD PCs. Save with F10 and verify using tpm.msc.
Press Win + R, type tpm.msc and press Enter. If it shows “The TPM is ready for use” and Specification Version 2.0, you have it. You can also check Windows Security > Device security > Security processor details.
Dell usually uses F2. HP uses Esc, then F10. Lenovo uses F2 or Fn + F2, and ThinkPads use Enter, then F1.
Both are firmware-based TPMs built into the processor platform. Intel calls it PTT and AMD calls it fTPM. Windows treats both as a TPM 2.0.
Your BIOS may be outdated, in Legacy mode, or the hardware may not support TPM. Update the BIOS first and look for names such as PTT, fTPM or Security Device Support.
Yes. Windows 11 officially needs TPM 2.0, Secure Boot capability, UEFI firmware and a supported processor.
Only if the motherboard has a TPM header and you buy a matching module made for that board. Otherwise, there is no software fix.
No. Enabling TPM does not erase files. Clearing the TPM can cause data loss if BitLocker is on and you don’t have the recovery key.
Secure Boot may be off, the PC may be in Legacy/CSM mode, or the processor may not be on the supported list. Run PC Health Check to see exactly which item fails.
Open the BIOS, go to Boot or Security, and set Secure Boot to Enabled. The PC must be in UEFI mode, and a GPT disk is needed.
Open Command Prompt as administrator, run mbr2gpt /validate /allowFullOS, then mbr2gpt /convert /allowFullOS. Switch the BIOS to UEFI afterwards, and keep a backup before you start.
The BIOS may be locked, in Legacy mode, or waiting for a supervisor password on some models. Switch to UEFI mode or load defaults and try again.
Yes, if you change only what you need and save properly. Avoid unknown settings and never interrupt a BIOS update.
It can, especially if drive encryption was already on. Keep your recovery key ready before you change settings.
Many hypervisors can add a virtual TPM. For example, recent VirtualBox versions have a TPM option in the VM’s System settings.
No. Normal users will not notice any difference in speed.
Some anti-cheat systems on Windows 11 ask for TPM 2.0 and Secure Boot. Valorant and recent Call of Duty titles are well-known examples.
It is possible with workarounds, but unsupported by Microsoft. You may face update problems, so it is not ideal for a main PC.
Open Windows Security > Device security > Security processor details > Security processor troubleshooting > Clear TPM. Back up your BitLocker key first, because clearing resets stored keys.
Sometimes. If the TPM option is missing or stuck at version 1.2, a BIOS update from your brand’s official support page often fixes it.
We hope you are interested in our articles and consider following our Facebook, Instagram, and Twitter pages for regular updates.
Also, share this article with your friends and relatives. Bookmark this page for future reference.
Subscribe to our free newsletter to get similar articles and regular updates directly in your Email Inbox.
Subscribe to be the first to learn about new information
Disclosure: If you follow our links to a retailer’s website and make a purchase, we will get an affiliate commission on some, but not all, of the items or services we promote. This will cause no price change for you.
You May Be Interested to Read:
- Dynamic Lock in Windows 11: Setup Guide, Fixes & Is It Worth Using?
- How to Recover Shift-Deleted Files in Windows 10/11
- No Internet, Secured Error in Windows 10 & 11: 15 Fixes
- Best OS for Low-End PCs: Especially After Windows 10’s End
- “Windows Could Not Automatically Detect This Network’s Proxy Settings” – 14 Fixes
