What is TPM 2.0 and why is it now mandatory in Windows 11?

Informatec Digital » Resources » What is TPM 2.0 and why is it now mandatory in Windows 11?

If you're thinking about upgrading to Windows 11, you've probably come across the dreaded message that your computer needs TPM 2.0 enabled to install the system . And of course, the natural question is: what is that, why is it now mandatory, and what happens if my PC doesn't have it or it's not listed anywhere?

In the latest versions of Windows, this small component has gone from being almost unknown to becoming a key piece of security and an essential technical requirement . It may sound very technical, but the underlying idea is quite simple: it's a kind of safe inside your computer that holds the keys to everything important.

What is TPM and what role does it play in your computer?

The acronym TPM stands for Trusted Platform Module , which is a chip or integrated functionality within the processor that acts as a secure cryptoprocessor—a mini-processor dedicated exclusively to security and encryption operations.

This module is responsible for creating, storing, and protecting cryptographic keys, passwords, certificates, and other sensitive data that the operating system needs to ensure that no one can access your information without permission, even if they have physical access to the computer.

TPM is not a new invention: it has been used for years in professional environments to strengthen hardware security, especially in companies and public administrations . However, with the arrival of Windows 11, it has come to the forefront because Microsoft has made it a mandatory requirement for officially installing the system.

From a physical standpoint, the TPM can be a separate chip soldered to the motherboard or a module that plugs into a specific connector . In many modern devices, especially laptops, TPM functionality is already integrated into the CPU (Intel PTT, AMD fTPM), although it is sometimes disabled by default and must be enabled through the UEFI/BIOS.

What does TPM actually do and why is it so important?

The most interesting aspect of the TPM is that it acts as a secure and isolated repository for cryptographic keys and authentication information . The keys stored within it are not directly accessible by the operating system or applications; they can only be accessed through specific commands on the chip itself.

Each TPM incorporates its own cryptographic keys, linked to the specific device . One of these is the Endorsement Key (EK), a unique RSA key pair generated at the factory and stored within the chip, inaccessible to software. Other keys are generated from this EK, such as the Storage Root Key , which is used as the basis for encrypting the remaining keys stored in the module.

In addition, the TPM can generate an Attestation Identity Key (AIK) , which reliably verifies the system's boot state. The chip calculates hashes or measurements of the firmware, UEFI, and critical parts of the operating system during boot , and can send these measurements to a server that checks if everything matches expectations. If suspicious changes are detected, the device is considered potentially compromised.

Thanks to this design, the TPM is very useful for protecting against modern threats such as firmware attacks, advanced ransomware , boot manipulation, or data theft through physical access . An attacker may have the hard drive in their hands, but without the keys stored within the TPM, the encrypted data will remain unusable.

The TPM standard not only defines the chip, but also a whole set of specifications and commands maintained by the Trusted Computing Group (TCG) , a non-profit organization responsible for updating and expanding these standards to adapt them to new security needs.

TPM 1.2 vs TPM 2.0: Why Windows 11 Requires the New Version

For many years, the most widespread version was TPM 1.2, even standardized as the international standard ISO/IEC 11889. This version already allowed for key protection, data encryption, and system integrity verification, but it was more limited in its encryption algorithms and the functions it could offer.

The move to TPM 2.0 brought a significant upgrade in capabilities and flexibility . Among other improvements, the new standard allows the use of different cryptographic algorithms interchangeably, instead of being practically tied to SHA-1 as was the case with TPM 1.2, which is essential for better resistance to modern attacks.

TPM 2.0 also incorporates improvements in key management, biometric data protection, and signature verification , and is designed to work not only on desktop and laptop PCs, but also on devices with more limited resources, such as tablets or embedded systems.

That's why Microsoft decided that, for Windows 11, the minimum acceptable hardware security level would be TPM 2.0 . Although Windows can technically function with TPM 1.2, the most advanced security features and future platform improvements rely on the extended capabilities of version 2.0.

In practice, this means that a computer with TPM 1.2 may be able to run Windows 11 from a performance standpoint, but it will not meet the official system security requirements , and the installation will fall outside of Microsoft's supported methods.

What does Windows use TPM for on a daily basis?

In Windows 10 and, especially, in Windows 11, the TPM is integrated with a number of security features. It's not something you see constantly, but it's working in the background to protect your data and your identity.

One of the most visible features is BitLocker , Windows' drive encryption system . When BitLocker is enabled, the disk's contents are encrypted, and the decryption key is stored (or protected) by the TPM (Target Memory Module). This way, if someone steals the hard drive or laptop, without the keys stored in the module, they won't be able to access the data, even if they connect the drive to another computer.

The TPM is also used in Windows Hello, the login system that uses facial recognition, fingerprint, or PIN . The biometric data and associated keys are linked to your computer's hardware via the chip, making them much harder to steal or reuse on another device.

Another key element is its relationship with Secure Boot and Measured Boot . Secure Boot ensures that only signed and trusted software is loaded during the initial boot phases, while Measured Boot records measurements of each running component in the TPM. This allows for the detection of attempts to inject malware into the system startup process.

Furthermore, Windows can combine TPM with technologies such as Credential Guard or virtualization-based credential protection . In this scenario, passwords and access tokens are isolated in a protected environment, and the TPM acts as a cryptographic root of trust, making it much more difficult for attackers to steal credentials.

Other common uses include virtual smart cards for authenticating to corporate resources , protection against dictionary attacks when attempting to crack passwords, or secure storage of certificates and keys for VPN connections, digitally signed email, and secure browsing.

Different types of TPM implementation

Although we always refer to the TPM as if it were a single chip, there are actually several ways to implement it, each with its own security features . All of them adhere to the TCG specifications, but differ at the physical or logical level.

On one hand, there are discrete TPMs, which are dedicated, specific chips soldered onto the motherboard. In theory, they are the safest option, as they are designed to be resistant to physical tampering and reduce the chances of errors resulting from sharing space with other components.

Another widespread option is the TPM integrated into the main CPU , which incorporates its own security mechanisms and offers a level of protection close to that of the discrete chip, but reducing costs and gaining convenience for manufacturers.

Firmware-based TPMs also exist , which run within the CPU's trusted execution environment . They remain quite secure and, for the average user, offer sufficient protection for everyday and professional use.

At the less secure end are software-only TPMs , which basically emulate the module's behavior but without a strong root of trust in the hardware, making them susceptible to external attacks or vulnerabilities in the operating system itself.

Finally, in virtualization environments it is common to use virtual TPMs provided by the hypervisor , which allow virtual machines to have similar functions without needing a separate physical chip for each one.

Why Windows 11 makes TPM 2.0 mandatory

The big change with Windows 11 is that Microsoft is no longer viewing TPM as an optional extra and is making it a core security requirement . The idea is that all computers running the system will have a hardware-level root of trust to better withstand the current threat landscape.

Today, attacks are no longer limited to simple viruses; we're talking about sophisticated ransomware, malware that attaches to firmware, attempts to steal credentials, and remote access exploiting misconfigurations . In this context, relying solely on security software is no longer enough, which is why Microsoft is committed to integrating protection directly into the hardware.

By requiring TPM 2.0, Windows 11 ensures that features such as BitLocker, Windows Hello, Secure Boot, Measured Boot, Credential Guard, and other virtualization-based technologies can be enabled by default , without depending on whether each manufacturer or user decides to activate them or not.

In many devices manufactured from 2016 onwards, especially laptops and PCs intended for business use, TPM 2.0 was already included from the factory, although sometimes disabled . In other cases, particularly in custom-built computers or mid-range and low-end motherboards from a few years ago, the module was not integrated by default and had to be added via a specific connector.

This is the source of many complaints from users who have very powerful computers, perfectly capable of running Windows 11 , but who find that they do not pass the filter because they lack TPM 2.0 or have it disabled in the UEFI/BIOS.

How to tell if your PC has TPM 2.0 from Windows

Before assuming your PC isn't compatible with Windows 11, it's worth checking if it actually has TPM 2.0 and, if so, which version is active . Windows offers several ways to do this without installing anything.

One of the simplest is to use the Microsoft Management Console for TPM :

1. Press the key combination Windows + R to open the “Run” dialog box.
2. Write tpm. msc (without quotes) and press Enter.
3. The Secure Platform Module administration window will open.

If a message like “Compatible TPM not found” or “No compatible TPM found” appears in that window , it could mean two things: your device doesn't have this module, or it's disabled in the firmware settings. In the second case, you'll need to access the UEFI/BIOS to enable it.

If, on the other hand, the console indicates that "TPM is ready for use" and displays manufacturer information , you'll need to look at the "Specification Version" field. If it shows 2.0, your PC meets this requirement for Windows 11; if the number is lower (for example, 1.2), the device will not reach the required security level.

Another alternative is to use PowerShell with administrator permissionsOpen PowerShell as administrator, type the command get-tpm and press Enter. Among the data displayed, look at the value TpmPresentIf it appears as “False”, the module is not present on the motherboard; if it is “True”, it is present, and you can also check its status and characteristics.

You can also check the Windows Security app, specifically the "Device security" and "Security processor" sections . If this section is not visible, the TPM is likely missing or disabled; if it is visible, you can go to "Security processor details" to see the specification version.

How to activate TPM 2.0 from the UEFI/BIOS

If your checks indicate that the TPM is unavailable but you suspect your computer is relatively new, the module may simply be disabled in the firmware settings . On many user-built PCs or consumer motherboards, it is disabled by default.

To change this, you'll need to access your computer's UEFI/BIOS and locate the option related to TPM or platform security . The exact path varies depending on the manufacturer, but on Windows, you can go to Settings > Update & Security > Recovery and use the "Restart now" option under Advanced startup.

After restarting, select Troubleshoot > Advanced options > UEFI Firmware Settings > Reboot . This will take you to the firmware menu, where you should look for options such as security, advanced settings, or similar. Each manufacturer uses slightly different names, so take your time.

On systems with Intel processors, the feature is usually listed as “Intel PTT” or “Intel Platform Trust Technology .” For AMD, it's often found as “AMD fTPM” or “AMD PSP fTPM .” You might also see it listed under labels such as “Security Device,” “Security Device Support,” “TPM Status,” or “Trusted Computing.”

Once you've located the option, you'll need to change its status to Enabled, save the changes, and restart your computer . After that, when you return to Windows, you should be able to see the TPM in tpm.msc or the Windows Security app and confirm that it meets the 2.0 specification.

Also note that on many devices, the TPM works in conjunction with the Secure Boot system . If Secure Boot is disabled, the options related to the module may not be displayed or may not function correctly. In such cases, it's advisable to first enable Secure Boot and then check the TPM status again.

Which computers typically include TPM 2.0 and what are the accompanying requirements?

In general, most computers manufactured from 2018 onwards are considered to have integrated TPM 2.0 or its equivalent . If your PC is less than five or six years old, the chances are quite high that it has this feature, even if it's turned off.

Another clue is provided by the processors: Intel processors from the eighth generation onwards usually come ready to use TPM 2.0 through Intel PTT , while in the AMD ecosystem it is common for Ryzen processors from the second generation onwards to integrate fTPM with support for this version.

However, the TPM isn't the only requirement for Windows 11. The system also requires a 64-bit CPU with at least two cores at 1 GHz, 4 GB of RAM, and 64 GB of storage . While these are modest specifications by today's standards, they exclude a good number of older computers that still run reasonably well with Windows 10.

In many user-built desktop PCs, mid-range and low-end motherboards from a few years ago didn't include the memory module as standard, but only a connector for adding it separately . This has created a rather curious situation: very powerful machines in terms of CPU and graphics, but held back by the absence of a small chip.

Those who don't want to or can't install that additional module need to consider whether to stick with Windows 10 until the end of its official support or consider a hardware upgrade . Windows 10 support extends until October 2025, so there's still some time to make a decision calmly.

What happens if your computer doesn't have TPM 2.0

If, after all the checks, you confirm that your PC doesn't have TPM 2.0 and there's no realistic possibility of adding it , your options are reduced. Officially, that computer doesn't meet the Windows 11 requirements, and therefore you won't be able to install it through Microsoft's standard channels.

There are unofficial methods to bypass system requirements checks during Windows 11 installation , such as modifying configuration files or using third-party tools. However, this means forgoing some support and, more importantly, running the system without the minimum level of security that Microsoft considers essential.

On devices that can't accommodate a TPM 2.0, it's important to consider whether it's more worthwhile to use Windows 10 until the end of its lifecycle, explore alternatives like other operating systems, or invest in a more modern computer . It all depends on how you use your computer and how important integrated hardware security is to you.

For many home users, this can be a good opportunity to opt for recently refurbished computers that already come with TPM 2.0 enabled , capable of running Windows 11 smoothly and at a lower cost than a brand new PC.

While TPM might initially seem like just another requirement, its main purpose is to better protect your data, passwords, and digital credentials . You may not interact with it directly, but it's there as a silent guardian of everything that matters on your computer.