How to Enable TPM 2.0: 13 Steps, 30 Min [2026]

Windows 11 will not install on a PC that lacks TPM 2.0, and on a surprising number of boards the chip is simply switched off in firmware. According to Intel’s Platform Trust Technology datasheet, Intel PTT provides the capabilities of a discrete TPM 2.0, and AMD’s fTPM does the same job on Ryzen systems. This guide shows how to enable TPM 2.0 in your BIOS in 13 steps, and how to do it without locking yourself out of an encrypted drive.

The timing matters. Windows 11 version 26H2 reached general availability on September 29, 2026, and Windows 11 24H2 Home and Pro editions stopped receiving updates on October 13, 2026. Anyone still on Windows 10 or on an old 24H2 install now has a real reason to upgrade. A Microsoft support thread updated on October 27, 2026 also warns that a BIOS change can make Windows stop seeing a TPM it previously detected, so the switch deserves a careful, ordered approach rather than a quick poke around the menus.

Plan on about 30 minutes, one reboot into firmware, and a USB stick for a recovery-key backup. If your board is old enough that the TPM option does not exist, you may need to update your BIOS first, and we cover that branch in the troubleshooting section. Everything below applies to desktops and laptops alike, though laptop menus tend to be shorter and more locked down.

·

Google · Preferred Sources

Don't miss new tech stories on Google

Add Tech Insider once in the Google app and our stories appear in your news suggestions.

Add Now

What TPM 2.0 Actually Is, and Why Windows 11 Cares

A Trusted Platform Module is a small security processor that stores cryptographic keys and records what the machine boots. Windows leans on it for BitLocker drive encryption, Windows Hello sign-in and device attestation. Microsoft’s documentation draws a hard line between TPM 1.2 and TPM 2.0, and the version Windows 11 requires is 2.0. The Trusted Computing Group, which publishes the standard, lists TPM 2.0 Library Specification Version 185 (March 2026) as its newest release, following Version 184 from March 2025. You can browse the current documents on the group’s TPM 2.0 Library page.

You do not need to buy anything in most cases. Modern CPUs ship a firmware TPM, which runs inside the processor’s own security subsystem. Intel calls its version Platform Trust Technology (PTT). AMD calls its version fTPM, sometimes shown as PSP fTPM. Some boards also carry a header for a discrete TPM module, a separate chip that plugs into the motherboard. Windows treats all three the same way once the firmware exposes them.

Firmware TPM vs Discrete TPM

A firmware TPM costs nothing and needs no extra hardware, which is why it dominates consumer PCs. A discrete TPM sits on its own silicon, which some security teams prefer because it keeps keys physically apart from the CPU. For a home build or a gaming laptop, the firmware option is the right default. Use a discrete module only when your board manual says the platform expects one.

The 2026 Pluton Wrinkle

On October 26, 2026, Windows Report published a story saying Microsoft’s documentation now states that Pluton no longer serves as the TPM 2.0 implementation on processors released in 2026. Per that report, those chips use a vendor firmware TPM or a discrete TPM instead, and older AMD and Qualcomm devices that use Pluton as their TPM keep receiving support. We treat this as reported rather than confirmed, since it rests partly on third-party coverage. The practical effect on you is small. On a 2026 board you should still look for an Intel PTT or AMD fTPM entry, and the steps below do not change.

Prerequisites and Versions as of October 2026

Before you touch firmware, confirm you have the following. None of it is exotic, but a missing item is the usual reason a 30-minute job turns into an evening.

• Windows 11 or Windows 10: Microsoft currently documents Windows 11 feature versions 26H2, 25H2 and 24H2. The commands here also run on Windows 10 if you are preparing an upgrade.
• An administrator account: every PowerShell command below needs an elevated session.
• A USB flash drive: for storing your BitLocker recovery key away from the drive it protects.
• Your motherboard or laptop model: menu names vary by maker, so keep the manual or support page handy.
• The Windows 11 baseline: TPM 2.0 sits alongside a supported processor, UEFI with Secure Boot capability, 4 GB of RAM and 64 GB of storage.

Know your firmware version too. If you have never updated it, make sure you have a recovery plan before you start. Boards that support a USB flashing button let you recover from a bad flash without a working CPU, and our BIOS Flashback guide explains that rescue path in detail. A thirty-second look at the board’s support page now tells you whether a newer firmware exists and what its release notes say about TPM or security fixes.

Item	Status on October 27, 2026	Why it matters
Windows 11 version 26H2	Generally available	Newest release, delivered as an enablement package to eligible 25H2 and 24H2 devices
Windows 11 24H2 Home and Pro	End of updates on October 13, 2026	Pushes many users toward 26H2, which still requires TPM 2.0
Windows 11 24H2 Enterprise and Education	Not listed	Managed fleets keep a longer runway
TPM 2.0 Library Specification	Version 185, March 2026	Current Trusted Computing Group release
Microsoft BitLocker FAQ	Updated October 27, 2026	Covers firmware changes and recovery prompts
Intel PTT and AMD fTPM	Active, no rename or retirement confirmed	Still the two firmware TPM names to look for

How TPM, Secure Boot and BitLocker Fit Together

Three features share a single firmware screen, and confusing them causes most of the mistakes later in this guide. The TPM holds keys and records measurements of the boot chain. Secure Boot checks that the boot loader carries a trusted signature before it runs. BitLocker sits on top and asks the TPM whether the measurements still match the ones it saw when it sealed the drive’s key. If they match, the drive unlocks silently. If they differ, BitLocker falls back to the recovery key.

That design explains why a firmware edit can lock you out. Change the boot mode, flip Secure Boot, clear the TPM or load a new BIOS image (our guide to updating a BIOS safely covers that last one), and the measurements shift. Microsoft’s BitLocker guidance lists firmware version changes, Secure Boot changes, boot-order changes and other BIOS configuration changes as events that can alter those measurements and prompt for recovery. The drive is fine. BitLocker is simply doing its job and asking you to prove you own the machine.

A few related facts help you reason about your own system. The BitLocker FAQ describes support for TPM 1.2 or later in some configurations, but the platform requirement for Windows 11 is TPM 2.0, so do not read the older number as permission to stay on a legacy module. The same FAQ says BitLocker can protect an operating-system drive without a TPM if the firmware can read a USB startup key, though the drive then stays locked until you supply that key. And Windows Hello PINs lean on the same chip, which is why a cleared TPM can wipe your sign-in PIN along with the encryption seal.

How to Enable TPM 2.0: The 13-Step Plan at a Glance

The order is the point. Most failed attempts at how to enable TPM 2.0 come from doing the right things in the wrong sequence, such as flipping the BIOS switch before saving the BitLocker key. Here is the full route in short form, with the detail following in the next sections.

1. Check whether Windows already sees a TPM with tpm.msc.
2. Read the Security processor details page in Windows Security.
3. Confirm your BIOS mode and Secure Boot state.
4. Back up the BitLocker recovery key to a USB drive.
5. Suspend BitLocker for the reboot.
6. Restart into the UEFI firmware settings.
7. Find the TPM entry in the Advanced, Security or Trusted Computing menus.
8. Enable Intel PTT on an Intel system.
9. Enable AMD fTPM on an AMD system, or the discrete TPM if your board uses one.
10. Switch the boot mode to native UEFI and turn off CSM.
11. Save, exit and boot Windows.
12. Verify TPM readiness and the 2.0 specification version.
13. Resume BitLocker and store the recovery key safely.

Steps 1 to 3 cost you two minutes and may save the whole job. If the TPM is already present and ready, you skip straight to Windows 11 setup and never open the firmware menus.

Steps 1 to 3: Check What Windows Already Sees

Press Win + R, type tpm.msc and press Enter. A working install reports that the TPM is ready for use and lists a specification version. You want to see 2.0 there. If the console says a compatible TPM cannot be found, Windows sees nothing, which usually means the firmware switch is off. If it shows 1.2, your board either carries an older module or exposes a legacy mode that you can change in firmware.

The same data is available from PowerShell, which is easier to paste into a support ticket. Open Windows Terminal as administrator and run the following.

Get-Tpm

Get-CimInstance -Namespace 'root\cimv2\Security\MicrosoftTpm' -ClassName Win32_Tpm |
  Select-Object IsEnabled_InitialValue, IsActivated_InitialValue, SpecVersion

On a machine with the firmware TPM switched off, the output looks like the block below. Treat it as an illustration, since field values differ slightly between systems.

TpmPresent                : False
TpmReady                  : False
TpmEnabled                : False
TpmActivated              : False
ManufacturerIdTxt         :
ManagedAuthLevel          : Full
RestartPending            : False

Step 2 is a second opinion from the Windows interface. Open Windows Security, choose Device security, then select Security processor details. Microsoft documents this page as a place to read the TPM status and specification version. If the Security processor entry is missing from Device security, Windows has no TPM to report on. That matches the PowerShell result above and tells you the problem sits in firmware, not in Windows.

Step 3 checks the boot mode, because TPM 2.0 depends on it. Run msinfo32 and read two lines on the System Summary page, BIOS Mode and Secure Boot State. BIOS Mode should say UEFI. If it says Legacy, you will need the extra conversion in Step 10. The commands below give you the same answer in the terminal.

Get-ComputerInfo -Property BiosFirmwareType

try { Confirm-SecureBootUEFI } catch { 'Secure Boot not available (Legacy BIOS mode or unsupported)' }

Microsoft Learn is blunt about the mode requirement. In its TPM recommendations, the company states: “TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS.” It adds that “Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only.” Write down what you find here, because it tells you which of the later steps apply to your machine.

Steps 4 and 5: Protect the BitLocker Key Before You Change Anything

This is the section people skip, and it is the one that bites. Microsoft’s BitLocker guidance says firmware, Secure Boot, TPM or related boot changes can trigger a recovery prompt. Its support material also says that clearing the TPM can affect BitLocker keys, Windows Hello PINs and virtual smart cards. The BitLocker FAQ on Microsoft Learn, updated on October 27, 2026, repeats the same warning, so the safe habit is to save the key first and suspend protection second.

Resetting firmware defaults counts as a boot change too. If you plan to clear the CMOS during this job, treat that reset exactly like the TPM change and save the key beforehand. Start by listing the protectors on your system drive. The recovery password protector is the one you need.

manage-bde -protectors -get C:

(Get-BitLockerVolume -MountPoint 'C:').KeyProtector |
  Where-Object KeyProtectorType -eq 'RecoveryPassword' |
  Select-Object KeyProtectorId, RecoveryPassword

Copy that recovery password to a text file on a USB drive, and photograph it with your phone as a second copy. Do not store the only copy on the encrypted drive itself, because you cannot read it when the drive is locked. On a personal Microsoft account, the key may also appear on Microsoft’s recovery-key page. Work or school devices often escrow the key with the organization, so ask your IT team before you change anything on a managed laptop.

If BitLocker is not on, you can skip to Step 6. Many Windows 11 Home machines use device encryption instead, and according to Microsoft’s BitLocker documentation, Windows 11 24H2 removed the DMA and HSTI or Modern Standby prerequisites for device encryption, which makes more devices eligible. You may therefore have encryption running without ever having switched it on yourself. Check with manage-bde -status if you are unsure.

Step 5 suspends protection so the next reboots do not trip the integrity check. Use a reboot count that covers the trip into firmware and the first boot back into Windows.

Suspend-BitLocker -MountPoint 'C:' -RebootCount 2
manage-bde -status C:

The status output should now list protection as suspended. Suspension does not decrypt the drive. It only tells the system to stop checking the boot measurements for a couple of restarts, which is exactly what you want while the TPM state changes.

Steps 6 and 7: Reach the Firmware Settings and Find the TPM Menu

There are two clean ways into the firmware on Windows 11. The first goes through Settings. Open System, then Recovery, choose Restart now next to Advanced startup, and after the restart pick Troubleshoot, Advanced options and UEFI Firmware Settings. The second is a single command that reboots straight into firmware.

shutdown /r /fw /t 0

If that command reports that the system does not support firmware boot, your PC is in Legacy mode or the firmware lacks the feature. Fall back to the manufacturer’s hotkey during power-on, which is commonly Delete, F2 or F10 depending on the maker. Your support page lists the exact key.

Step 7 is the hunt. Firmware makers do not agree on a name or a location. Microsoft’s support page on enabling TPM 2.0 puts it plainly: “If you need to enable TPM, these settings are managed via the UEFI BIOS (PC firmware) and vary based on your device.” It adds that “These settings are sometimes contained in a sub-menu in the UEFI BIOS labeled Advanced, Security, or Trusted Computing.” Many boards hide these menus behind an Advanced Mode toggle, so switch from the simple EZ-style screen first.

The same Microsoft page lists the labels you may meet: “The option to enable the TPM may be labeled Security Device, Security Device Support, TPM State, AMD fTPM switch, AMD PSP fTPM, Intel PTT, or Intel Platform Trust Technology.” The table below sorts those names by platform.

Platform	Labels you may see	Menus to check	What to select
Intel desktop or laptop	Intel PTT, Intel Platform Trust Technology, Security Device Support	Advanced, Security, Trusted Computing	Enabled
AMD Ryzen desktop or laptop	AMD fTPM, AMD fTPM switch, AMD PSP fTPM, Firmware TPM	Advanced, Security, Trusted Computing	Enabled, and choose the firmware option where a device selector appears
Any board with a TPM header	TPM Device, TPM State, Security Device	Security, Trusted Computing	Enabled for the discrete module, with the firmware option off if both exist
OEM laptop or prebuilt	TPM 2.0 Security, TPM Device	Security	Enabled or Available

If you cannot find any entry, do not assume the hardware lacks a TPM. Press the search shortcut your firmware offers, usually F9 or a magnifier icon on modern boards, and type TPM or PTT. A settings reset can also scramble the layout. When a previous owner or a failed tweak left odd values behind, loading the optimized defaults restores the stock menus, though you will lose any custom fan curves and memory settings. Photograph those values first so you can restore them afterward.

Steps 8 to 10: Flip the Switch and Fix the Boot Mode

Step 8 covers Intel. Open the entry labeled Intel PTT or Intel Platform Trust Technology and set it to Enabled. Some boards pair it with a Security Device Support switch that also needs to read Enabled. Intel’s documentation says PTT supports Windows 8, 10 and 11, and that it meets Microsoft’s TPM 2.0 requirements, so a single enabled toggle is normally all it takes.

Step 9 covers AMD. Find AMD fTPM, AMD CPU fTPM or Firmware TPM and enable it. Where a selector offers a choice between firmware and discrete, pick firmware unless you have installed a physical module. According to ASRock’s dated support guidance, users should enable Intel PTT or AMD CPU fTPM in UEFI instead of buying a separate module. If your board does carry a discrete TPM and you plugged it in, enable the matching TPM Device entry and leave the firmware option off so that Windows does not see two competing modules.

Step 10 is where older systems stumble. TPM 2.0 needs native UEFI, so look for the Compatibility Support Module, usually shown as CSM or Launch CSM, and set it to Disabled. Secure Boot sits in the same part of the menu and should read Enabled with the standard keys loaded. The catch is that a Windows install made in Legacy mode lives on an MBR disk. If you switch CSM off while Windows sits on MBR, the machine will refuse to boot. Convert the disk from inside Windows before you make that change.

mbr2gpt /validate /allowFullOS

mbr2gpt /convert /allowFullOS

Run the validate line first and read the result. Only run the convert line if validation passes, and make a full image backup of the drive beforehand, since a disk conversion is not a casual operation. After the conversion, restart into firmware again, disable CSM, enable Secure Boot and continue with the TPM toggle. If your disk is already GPT, none of this applies and you can move on.

While you are in this menu, consider other settings that benefit from a native UEFI setup. Memory profiles are one example, and our guide to enabling XMP and EXPO walks through that toggle, which is a good use of the same firmware visit. Change one group of settings at a time, though, so you can tell which change caused a problem if the machine misbehaves.

Steps 11 to 13: Save, Verify and Resume Protection

This last stretch is where how to enable TPM 2.0 turns from a firmware edit into a working Windows feature. Step 11 is a plain save and exit, usually F10, followed by a confirmation. Windows may boot a little slower the first time because the firmware initializes the TPM. If BitLocker was suspended correctly, you will reach the desktop without a recovery prompt. If the blue recovery screen appears anyway, type the key you saved in Step 4 and carry on.

Step 12 verifies the result. Run tpm.msc again and confirm that the status reads ready for use and that the specification version reads 2.0. Microsoft’s guidance says a usable TPM for BitLocker should be present, ready, enabled, activated and owned, and Get-Tpm reports each of those states.

Get-Tpm

(Get-CimInstance -Namespace 'root\cimv2\Security\MicrosoftTpm' -ClassName Win32_Tpm).SpecVersion

A healthy result looks like the following. The manufacturer text typically reads INTC for Intel PTT and AMD for AMD fTPM, and a discrete module shows its own maker code.

TpmPresent                : True
TpmReady                  : True
TpmEnabled                : True
TpmActivated              : True
TpmOwned                  : True
ManufacturerIdTxt         : AMD
RestartPending            : False

2.0, 0, 1.59

The last line is the specification string from the WMI class, and the leading 2.0 is the part that matters. The numbers after it describe the vendor revision and will differ on your hardware. If the output says ready but the version starts with 1.2, return to the firmware and look for a TPM version selector.

Step 13 turns protection back on and checks that it took.

Resume-BitLocker -MountPoint 'C:'
Get-BitLockerVolume -MountPoint 'C:' | Select-Object MountPoint, ProtectionStatus, VolumeStatus

manage-bde -protectors -get C:

Protection status should read On. Re-run the protector listing and compare the recovery password with the copy on your USB drive. If you cleared the TPM at any point, the old TPM protector no longer works, and BitLocker will have created a new one. Store the final recovery key in a password manager, a printed sheet or both, and keep the USB drive somewhere other than your laptop bag.

Common Pitfalls That Waste an Evening

Most of the support questions we see boil down to six mistakes. Learn them once and you will avoid hours of guessing.

1. Skipping the recovery-key backup. A TPM change can raise a BitLocker recovery prompt, and without the key the drive stays locked. Back up first, every time.
2. Clearing the TPM instead of enabling it. Enabling and clearing are different actions. Clearing wipes TPM-protected keys and can break BitLocker, Windows Hello PINs and virtual smart cards. Only clear when a guide tells you to.
3. Leaving CSM on. Microsoft says TPM 2.0 is unsupported in Legacy and CSM modes, so a perfectly enabled PTT or fTPM still fails when the board boots in compatibility mode.
4. Converting the disk after turning CSM off. The order matters. Convert MBR to GPT from inside Windows, then change the firmware mode, not the other way around.
5. Treating Secure Boot and TPM as one switch. They are separate. Windows 11 expects both, and fixing one does not fix the other.
6. Trusting an unofficial installer bypass. Workarounds that skip the TPM check leave you with an unsupported setup and none of the security features that rely on the chip. Enable the real thing instead.

Gamers carry a seventh trap. Several guides published this month for Call of Duty: Modern Warfare 4 tell players to check TPM and Secure Boot before launching the game, and one walkthrough from FinalBoss covers the BIOS side of that check. Other features need the same native UEFI setup. Resizable BAR, for example, typically wants CSM off, and our Resizable BAR guide explains why. Handle both in a single trip into firmware and you save a reboot.

Troubleshooting: 10 Problems and How to Fix Them

Even a clean run can hit a snag. The table gives you a fast first move for the five symptoms we see most often, and the numbered list below it goes deeper. Work down the list in order, since the early items cover the most common causes.

Symptom	Most likely cause	First move
No TPM in tpm.msc	Firmware switch is off	Re-enter firmware and enable Intel PTT or AMD fTPM
TPM shows 1.2	Legacy TPM mode selected	Pick the 2.0 mode in the TPM menu
Setting will not stay enabled	Defaults reloaded on exit, or a firmware lock	Use Save and Exit, then recheck
BitLocker asks for a key	Boot measurements changed	Enter the saved recovery password
Setup says the PC cannot run Windows 11	Another baseline item failed	Check Secure Boot, UEFI mode, RAM and storage

1. No TPM entry anywhere in the BIOS. Switch to Advanced Mode, then check the Advanced, Security and Trusted Computing menus Microsoft names. Use the in-firmware search if your board has one. If the option truly is absent, the firmware may be too old, so update it using the vendor tool and the guides linked earlier.
2. tpm.msc says a compatible TPM cannot be found. The firmware switch is still off, or you saved without applying. Re-enter the firmware, confirm the setting stuck, and check that you did not load defaults on exit.
3. The TPM reports version 1.2. Some boards carry a selector between TPM 1.2 and TPM 2.0 modes. Choose 2.0, save and retest. Microsoft documents the two versions separately, and Windows 11 needs 2.0.
4. The option is greyed out. A firmware password, a pending Secure Boot key change or a vendor lock can block edits. Set a supervisor password if the board demands one, or clear conflicting Secure Boot keys, then try again.
5. TPM is present but not ready. Get-Tpm may show TpmPresent as True while TpmReady stays False. Run Initialize-Tpm in an elevated session and restart. Avoid Clear-Tpm unless you have the BitLocker key in hand.
6. A BitLocker recovery screen appears after the change. Enter the saved recovery password. Once Windows loads, suspend and resume protection so the system records the new state.
7. Windows Hello PIN stopped working. A Microsoft Learn question thread asks exactly this under the title of a missing PIN after a BIOS update. A TPM change can invalidate the stored PIN keys, so delete the PIN in Settings, then create a new one.
8. Windows 11 setup still rejects the PC. Re-check the baseline. The PC needs a supported processor, UEFI with Secure Boot, 4 GB of RAM, 64 GB of storage and TPM 2.0. A passed TPM test does not excuse a failed processor check.
9. The game or anti-cheat still complains. Confirm Secure Boot reads On in msinfo32. An Intel community report describes PTT attestation enrollment failing with an HTTP 400 error on an Intel Core i9-14900KF system with a Z790 board. That is a single user report, but it suggests updating the BIOS and chipset drivers before you blame the game.
10. Boot trouble after October Windows updates. A Microsoft Tech Community thread from October 20, 2026 describes BitLocker boot problems on some TPM-only systems, resolved by adding and backing up a recovery-password protector. It is a community report, not a confirmed Microsoft defect, but the fix is cheap to apply in advance.

Add-BitLockerKeyProtector -MountPoint 'C:' -RecoveryPasswordProtector
manage-bde -protectors -get C:

If none of that works, boot into the firmware once more and write down every security-related value you see: TPM, Secure Boot, CSM, and the boot mode. Support staff can solve most cases from that short list.

Complete Working Project: A TPM Readiness Audit Script

Checking each item by hand gets old fast, especially if you are preparing a few family PCs for the Windows 11 move. The script below gathers every check from Steps 1 to 5 and Steps 12 to 13 into one run. It reads the TPM state and specification version, the firmware type, Secure Boot, and the BitLocker status. It also exports the recovery password to a folder you choose, such as a USB drive, and writes a JSON report you can compare before and after the BIOS change.

#Requires -RunAsAdministrator
param(
  [string]$ReportDir = "$env:USERPROFILE\Documents\tpm-audit",
  [string]$KeyBackupDir,
  [string]$Label = 'before'
)

$ErrorActionPreference = 'Stop'
New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null
$stamp = Get-Date -Format 'yyyyMMdd-HHmmss'

# TPM state and specification version
$tpm  = Get-Tpm
$wmi  = Get-CimInstance -Namespace 'root\cimv2\Security\MicrosoftTpm' -ClassName Win32_Tpm -ErrorAction SilentlyContinue
$spec = if ($wmi) { ($wmi.SpecVersion -split ',')[0].Trim() } else { 'none' }

# Firmware mode and Secure Boot
$fwType = (Get-ComputerInfo -Property BiosFirmwareType).BiosFirmwareType
try   { $secureBoot = [bool](Confirm-SecureBootUEFI) }
catch { $secureBoot = $false }

# BitLocker on the system drive
$vol = Get-BitLockerVolume -MountPoint $env:SystemDrive
$recovery = $vol.KeyProtector | Where-Object KeyProtectorType -eq 'RecoveryPassword'

if ($KeyBackupDir -and $recovery) {
  New-Item -ItemType Directory -Path $KeyBackupDir -Force | Out-Null
  $keyFile = Join-Path $KeyBackupDir "recovery-$env:COMPUTERNAME-$stamp.txt"
  $recovery | ForEach-Object { "$($_.KeyProtectorId)  $($_.RecoveryPassword)" } | Set-Content -Path $keyFile
  Write-Host "Recovery key saved to $keyFile" -ForegroundColor Green
}

$checks = [ordered]@{
  TpmPresent      = [bool]$tpm.TpmPresent
  TpmReady        = [bool]$tpm.TpmReady
  SpecVersion     = $spec
  FirmwareType    = "$fwType"
  SecureBoot      = $secureBoot
  BitLockerStatus = "$($vol.ProtectionStatus)"
  HasRecoveryKey  = [bool]$recovery
}

$pass = $checks.TpmPresent -and $checks.TpmReady -and ($spec -eq '2.0') -and ($fwType -eq 'Uefi') -and $secureBoot
$checks['Windows11Ready'] = $pass

$report = [pscustomobject]$checks
$report | Format-List
$report | ConvertTo-Json | Set-Content -Path (Join-Path $ReportDir "tpm-$Label-$stamp.json")

if (-not $pass) {
  if (-not $checks.TpmPresent)         { Write-Warning 'No TPM exposed to Windows. Enable Intel PTT or AMD fTPM in firmware.' }
  elseif ($spec -ne '2.0')             { Write-Warning "TPM reports $spec. Look for a TPM 2.0 mode selector." }
  if ($fwType -ne 'Uefi')              { Write-Warning 'Legacy boot detected. Convert to GPT, then disable CSM.' }
  if (-not $secureBoot)                { Write-Warning 'Secure Boot is off or unavailable.' }
}

Run it twice. The first run goes before you touch the firmware and saves your recovery key. Use a command like the one below, adjusting the drive letter to match your USB stick.

powershell -ExecutionPolicy Bypass -File .\tpm-audit.ps1 -Label before -KeyBackupDir E:\keys

On a machine that still has the TPM switched off, the report and warnings look roughly like this. Again, this is illustrative.

Recovery key saved to E:\keys\recovery-DESKTOP-4F2K-20261027-171502.txt

TpmPresent      : False
TpmReady        : False
SpecVersion     : none
FirmwareType    : Uefi
SecureBoot      : True
BitLockerStatus : On
HasRecoveryKey  : True
Windows11Ready  : False

WARNING: No TPM exposed to Windows. Enable Intel PTT or AMD fTPM in firmware.

After Step 13, run it again with -Label after. A passing machine prints Windows11Ready as True and stays silent on warnings. Keep both JSON files. If a later Windows update or firmware revision breaks something, the before and after reports show exactly which value moved. The script writes nothing to the encrypted volume apart from its own report folder, and the key file goes only where you point it.

Advanced Tips for Power Users and Small Fleets

Once the basics work, a few extras are worth knowing. They matter most if you manage several PCs or build your own machines.

Give a Hyper-V Virtual Machine Its Own TPM

If you test Windows 11 in a virtual machine, you do not need a physical TPM. Hyper-V can attach a virtual TPM to a Generation 2 VM. Create a key protector first, then enable the vTPM.

Set-VMKeyProtector -VMName 'Win11-Test' -NewLocalKeyProtector
Enable-VMTPM -VMName 'Win11-Test'
Get-VMSecurity -VMName 'Win11-Test' | Select-Object TpmEnabled

Keep Firmware Current and Settings Documented

Firmware updates can reset or reshuffle TPM options, and the October 27 Microsoft thread mentioned earlier is a reminder of that. Photograph your key settings before each update, run the audit script after it, and compare. On AM5 boards, memory training and TPM options live in the same firmware, so a new release can change both. Our walkthrough on AMD EXPO ULL memory setup covers the memory half of that story.

Laptops, Prebuilts and Managed Fleets

Laptop and prebuilt firmware tends to expose fewer options, and some makers lock the TPM menu behind a supervisor password. For work devices, rely on your management platform to hold recovery keys rather than USB sticks. Roll out TPM and CSM changes to a pilot group first, since the community reports of update-related BitLocker boot trouble suggest keeping a small test ring. Add the audit script to your deployment checklist and collect the JSON files centrally.

For more build and firmware walkthroughs, browse the hardware section, which collects our setup guides for memory, storage and cooling.

What Changed in Late 2026

Four developments shape the advice above. First, Windows 11 26H2 became the newest feature release on September 29, 2026, and Microsoft says it reaches eligible 25H2 and 24H2 devices as an enablement package. Nothing in the material we reviewed changes the TPM 2.0 requirement. Second, 24H2 Home and Pro hit end of updates on October 13, 2026, which sends cautious users toward an upgrade and therefore toward this very BIOS visit.

Third, the Pluton report from October 26, 2026 suggests that new silicon leans on vendor firmware TPMs or discrete modules. If you buy a 2026 processor, expect to see Intel PTT, AMD fTPM or a TPM header in the menus, which is what this guide assumes. Fourth, Microsoft’s Release Preview notes from October 16, 2026 describe improved BitLocker pre-boot PIN retry handling, aimed at stopping accidental repeat entries from triggering a TPM lockout. That item comes from preview documentation, so check whether it has reached your build before you count on it.

No source we found announced a rename, retirement or price for Intel PTT, AMD fTPM or BitLocker. That stability is good news. The procedure you learn today should hold up for the next feature release.

The takeaway: how to enable TPM 2.0 comes down to three habits. Check what Windows already sees before you open the firmware. Save the BitLocker key before you change a single setting. Verify the result in Windows before you resume protection. Follow those, and a job that scares many people becomes a half-hour routine you can repeat on every machine you own, from a gaming tower to a spare laptop headed for Windows 11.

Frequently Asked Questions

How do I know if my PC supports TPM 2.0?

Run tpm.msc and read the specification version. If Windows finds no TPM, open your firmware and look for Intel PTT, AMD fTPM or a similar entry in the Advanced, Security or Trusted Computing menus. If neither shows up, check your board manual for a discrete TPM header.

Is it safe to enable TPM 2.0 on a PC with BitLocker?

Yes, if you prepare. Save the recovery password to a USB drive, suspend BitLocker, make the change, then resume protection. Microsoft warns that firmware and TPM changes can trigger a recovery prompt, so the backup is your safety net.

What is the difference between Intel PTT and AMD fTPM?

They are two vendors’ names for the same idea, a TPM 2.0 implemented in processor firmware. Intel PTT appears on Intel systems and AMD fTPM on Ryzen systems. Windows treats either one as a valid TPM once you enable it.

How to enable TPM 2.0 if the option is missing from my BIOS?

Switch the firmware to Advanced Mode and search the Advanced, Security and Trusted Computing menus. Look for the vendor names Intel PTT, AMD fTPM or Security Device Support. If nothing appears, check the board maker’s support page for a newer firmware release, and consult the manual for a header that accepts a discrete module.

Do I need to buy a TPM module?

Usually not. Most recent CPUs include a firmware TPM that satisfies Windows 11. A separate module only makes sense when your board expects one or your security policy prefers a discrete chip.

Why does TPM 2.0 need UEFI and not Legacy mode?

Microsoft’s documentation states that TPM 2.0 is not supported in Legacy and CSM modes, and that devices must run Native UEFI only. Turn CSM off, make sure your disk uses GPT, and keep Secure Boot enabled.

Will enabling the TPM erase my files?

Enabling alone does not touch your files. Clearing the TPM is different, since it can affect BitLocker keys, Windows Hello PINs and virtual smart cards. Avoid clearing unless you have your recovery key and a clear reason.

Why does tpm.msc show my TPM as not ready?

The module may be present but not initialized. Run Initialize-Tpm from an elevated PowerShell window and restart. If the status stays unchanged, return to the firmware and confirm the setting was saved.

Does Windows 11 26H2 change the TPM requirement?

The Microsoft material we reviewed shows no change. TPM 2.0 remains the requirement for supported Windows 11 PCs, alongside Secure Boot and the other baseline items covered above.