If you’ve ever tried to check whether your work computer can be upgraded to Windows 11, you may well have come across a message like this: the machine does not meet the requirements because TPM 2.0 is missing or disabled. At first glance, this sounds like some kind of technical mystery for engineers. Yet the concept is simple, and it’s worth understanding, because official support for Windows 10 ended on 14 October 2025, so many business owners now have to decide what to do with their computers.
What is a TPM, in simple terms?
TPM stands for Trusted Platform Module. Think of it as your computer’s built-in mini-safe.
The computer stores secret keys and verification data in this small safe. The trick is that whilst Windows can use these keys (for example, for authentication or encryption), it is very difficult to read or copy them using software – even for malware. It’s like a bank safe-deposit box: the bank can handle its business with the contents of the safe, but it doesn’t take the contents out onto the street.
There are two things worth knowing about it:
- It may be a separate chip on the motherboard, or a version built into the processor. Depending on the manufacturer, the latter is referred to by different names (for example, Intel PTT or AMD fTPM). From a Windows 11 perspective, both can work.
- 2.0 is the latest version of the standard. The older version, 1.2, is no longer sufficient for Windows 11.
What is the practical benefit of this?
- Data encryption. If your laptop is lost or stolen, the contents of the encrypted drive will remain unreadable to the thief. Windows uses encryption features (BitLocker or device encryption) for this, and these may rely on the TPM. If you handle customers’ personal data, this can be particularly important, but it’s worth consulting your own adviser about the legal details.
- More secure login. The TPM generally also plays a role in the security of Windows Hello (PIN, fingerprint, facial recognition). It’s the same principle as with passkeys, which I wrote about earlier: the secret remains on your device and does not go out onto the internet.
- Boot-time verification. When the machine is switched on, it can check whether the data required for booting has been tampered with. This is important because there are malware programmes that attempt to infiltrate the system before Windows even starts up.
Why does Microsoft require this?
Microsoft’s stated reason is that it wanted to make hardware-based security protection a core requirement for Windows 11. The crux of the argument is that if the protection is built into the computer’s hardware, it is harder to disable or circumvent than purely software-based protection.
Furthermore, if it is present on every Windows 11 machine, software developers can certainly count on it.
It is worth noting, however, that this is a business and technical decision by Microsoft, and there are critics: many older machines that still work well will be left out, which represents a cost for businesses and means more obsolete devices. There is a way to circumvent this requirement during installation, but Microsoft does not support this. In a business environment, I would not recommend this, as there is no guarantee that machines installed in this way will receive updates in the long term.
In summary
TPM 2.0 is not magic, nor is it necessarily just another unnecessary bureaucratic hurdle; rather, it is the computer’s built-in security vault, which aids encryption, login and boot protection. There is a sound security rationale behind why Microsoft has made it mandatory, but the requirement also entails real costs for small businesses. The best thing you can do is to assess the situation calmly, on a per-machine basis, and make a decision based on careful planning rather than rushing into it.
This post is for general information purposes only. Computer settings, Microsoft’s terms and conditions, and the available solutions are subject to change
Vélemény, hozzászólás?