Don't bypass Windows 11's TPM 2.0 check—inventory and enable it first

The problem: a clean image that will not upgrade

You build a Windows 11 reference image, run sysprep, and deploy it to a batch of laptops. On first boot, Windows Setup refuses to install or the PC Health Check app reports the device is unsupported. The most common culprit is not the processor—it is the Trusted Platform Module (TPM) 2.0. A TPM stores encryption keys and boot measurements in hardware instead of only in software. Windows 11 uses it for BitLocker device encryption and measured boot, which verifies that the boot chain has not been altered.

The useful takeaway: do not patch around the requirement. Inventory TPM status and firmware settings before you standardize on Windows 11, and enable the correct firmware TPM before imaging rather than after the operating system is already deployed.

Check TPM 2.0 before you build the image

Windows 11 officially requires TPM 2.0 alongside a supported processor and Secure Boot. A TPM can be a discrete chip on the motherboard, Intel Platform Trust Technology (PTT), or AMD firmware TPM (fTPM). Presence alone does not guarantee eligibility.

Run these checks on a representative device before you capture an image:

• Press Win + R, type tpm.msc, and press Enter. Look for The TPM is ready for use and specification version 2.0.
• Open PowerShell as Administrator and run Get-Tpm. Verify that TpmPresent and TpmReady are both True.
• Reboot into UEFI or BIOS and look for Security Device, TPM, PTT, or fTPM under Security or Advanced settings. Note whether it is enabled or disabled.

If Get-Tpm returns TpmPresent : False, the module may be disabled in firmware rather than absent. Enabling it after Windows is installed can trigger BitLocker recovery mode because the platform configuration registers change, so change the firmware setting before OS deployment, not after.

Worked example: enabling firmware TPM

This example applies to a corporate imaging pipeline targeting a current supported release of Windows 11. Menu names vary by manufacturer, so treat them as placeholders.

1. Boot the target device and press the firmware key during startup, commonly F2, F10, Del, or Esc depending on the vendor.
2. Navigate to Security > Trusted Computing or Advanced > CPU Configuration.
3. On Intel systems, set Intel PTT or PTT Enablement to Enabled. On AMD systems, set AMD fTPM or Secure Processor to Enabled.
4. Save changes and exit. The device reboots with the firmware TPM exposed to Windows.
5. After Windows starts, open PowerShell as Administrator and run Get-Tpm. Confirm TpmPresent and TpmReady are True.
6. Before enabling BitLocker, run manage-bde -status to confirm current encryption state. If BitLocker is already active, suspend it before changing TPM settings to avoid a recovery prompt.

Risk: toggling TPM on an already deployed system can invalidate the existing BitLocker key protector. If that happens, Windows boots to the BitLocker recovery screen and requires the 48-digit recovery key. Back up the key to Azure Active Directory or Active Directory before you change firmware settings on production devices.

Trade-offs and limitations

Factor	Behavior
TPM 2.0 present	Not sufficient by itself; Windows 11 also requires a supported CPU family and Secure Boot.
Bypassing the check	Unsupported by Microsoft; may block security updates and future feature upgrades.
Enabling after deployment	Can trigger BitLocker recovery or require re-encryption; some AMD fTPM implementations have historically caused boot instability when toggled after OS deployment.

If a device lacks TPM 2.0 entirely and cannot add it through firmware, it is out of scope for a supported Windows 11 deployment. Do not use registry hacks or setup workarounds to force installation on those machines.

Closing checklist

• Inventory TPM status with tpm.msc and Get-Tpm on a sample from each hardware model.
• Enable PTT or fTPM in UEFI before imaging, not after Windows is installed.
• Back up BitLocker recovery keys to your directory service before changing firmware security settings.
• Run Windows Setup or PC Health Check on the imaged device to confirm upgrade readiness.

Treating TPM 2.0 as a pre-deployment requirement, rather than a post-install troubleshooting step, keeps imaging pipelines supported and avoids recovery-mode surprises at the user's desk.