Tag: TPM 2.0

Windows 11 upgrade eligibility checklist showing CPU TPM BIOS and storage icons
August 9, 2026

Windows 11 Upgrade Eligibility: The Full Compatibility Check

Post By administrator Microsoft, Windows , , , , , No Comments

Your Windows 11 upgrade eligibility depends on far more than a single chip. While TPM 2.0 grabs all the headlines, millions of PCs are blocked by CPU generation limits, BIOS misconfigurations, insufficient storage, and firmware quirks that Microsoft’s own upgrade tool barely explains. This guide walks through every real hurdle — and exactly what you can do about each one.

Why Windows 11 Compatibility Is Trickier Than Microsoft Lets On

BIOS UEFI screen showing TPM 2.0 enabled for Windows 11 upgrade eligibility

When Microsoft launched Windows 11 in October 2021, it published a deceptively short list of minimum system requirements: a 1 GHz dual-core 64-bit processor, 4 GB of RAM, 64 GB of storage, a DirectX 12-compatible GPU, a 720p display, UEFI Secure Boot, and TPM 2.0. Simple on paper — confusing in practice.

The PC Health Check tool flags many machines as incompatible without giving a clear reason. That is because there is not one gatekeeper; there are several, and they interact. Understanding each one separately is the only way to diagnose a blocked upgrade and decide whether to fix it, bypass it, or invest in new hardware.

The Full Windows 11 Requirements Checklist

Before you can upgrade to Windows 11, every item on this list must be satisfied:

  • Processor: 1 GHz or faster, 2 cores minimum, 64-bit, on Microsoft’s approved CPU list (Intel 8th Gen+ or AMD Ryzen 2000+)
  • RAM: 4 GB minimum (8 GB strongly recommended for day-to-day use)
  • Storage: 64 GB free space on the system drive
  • TPM: Trusted Platform Module version 2.0, enabled in firmware
  • Firmware: UEFI with Secure Boot capability
  • GPU: DirectX 12 compatible with a WDDM 2.0 driver
  • Display: 720p, at least 9 inches diagonal, 8 bits per colour channel
  • Internet: Required for initial setup on Windows 11 Home

Each item above can independently block an upgrade. Let’s break down the ones that cause the most confusion.

TPM 2.0: The Requirement Everyone Knows About

CPU generation comparison illustrating Windows 11 compatibility requirements for upgrade

TPM 2.0 (Trusted Platform Module) is a dedicated security chip — or a firmware-based equivalent — that stores encryption keys and supports features like Windows Hello and BitLocker. It is built into virtually every CPU or motherboard made after 2016, but it is frequently disabled by default in BIOS/UEFI settings, which is why so many machines fail the check even when the hardware is present.

How to Check and Enable TPM 2.0

  1. Press Win + R, type tpm.msc, and press Enter.
  2. If the console shows “Compatible TPM cannot be found,” TPM is either disabled or not present.
  3. Restart your PC and enter BIOS/UEFI (usually Del, F2, or F10 at boot).
  4. Look for PTT (Intel Platform Trust Technology) or fTPM (AMD firmware TPM) and set it to Enabled.
  5. Save and reboot, then re-run tpm.msc — it should now report Version 2.0.

If your system genuinely has no TPM 2.0 support at all — common on pre-2016 hardware — you will need either a discrete TPM module (if your motherboard has a header for one) or a registry-based bypass for an in-place upgrade.

CPU Generation: The Hidden Windows 11 Compatibility Wall

This is the requirement that catches the most people off guard. Microsoft does not just require any dual-core 64-bit processor — it requires a processor from its approved list. That list starts at Intel 8th Generation Core (Coffee Lake) and AMD Ryzen 2000 series. An Intel Core i7-7700K — an excellent 2017 CPU — is officially unsupported, even though it is technically capable of running Windows 11 without issue.

Checking Your CPU Generation

Press Win + Pause/Break or search “About your PC” in the Start menu. The processor model number tells you the generation: on Intel, the first one or two digits after the hyphen indicate the generation (e.g., i7-8700 = 8th Gen, i5-10400 = 10th Gen). On AMD, the first digit of the Ryzen number is the generation (Ryzen 5 3600 = 3rd Gen, which is supported).

If your CPU predates those cutoffs, the official upgrade path is blocked — but Microsoft did release a registry workaround that bypasses both the TPM and CPU checks for an in-place upgrade. Note that doing so means your machine is unsupported, so you may not receive future feature updates.

BIOS vs UEFI: Secure Boot and Firmware Conflicts

Windows 11 requires UEFI firmware with Secure Boot, not the older Legacy BIOS mode. Many machines from 2012–2018 have UEFI firmware but boot in Legacy/CSM mode with an MBR-partitioned drive, which blocks the upgrade entirely.

How to Switch to UEFI Without Reinstalling

  • Open Disk Management and check whether your system disk uses MBR or GPT partitioning. GPT is required for UEFI boot.
  • If your disk is MBR, use Microsoft’s built-in mbr2gpt.exe tool (run from an elevated command prompt) to convert it non-destructively before switching BIOS mode.
  • Then enter UEFI settings, disable CSM/Legacy mode, and enable Secure Boot.
  • Reboot — Windows 10 should still start normally, and the upgrade path to Windows 11 will now be clear.

Secure Boot conflicts are also common after adding a new GPU or storage controller. If Secure Boot was recently enabled and Windows fails to boot, hold Shift while clicking Restart to access the recovery environment and roll back the setting.

Storage: The 64 GB Floor and Why Speed Matters Too

Laptop screen displaying Windows 11 requirements checklist for a successful upgrade

The 64 GB storage requirement for Windows 11 compatibility is a hard floor, not a recommendation. The upgrade process itself needs roughly 20–30 GB of temporary space on top of whatever the OS occupies, so a 64 GB drive that is 70% full will fail mid-upgrade and potentially leave your installation in an inconsistent state.

Beyond capacity, storage speed affects whether Windows 11 feels snappy or sluggish after the upgrade. Microsoft’s own testing indicates that machines running Windows 11 on a traditional spinning hard drive score significantly lower on the Windows Experience Index than those on an SSD. If your PC qualifies in every other way but runs on a mechanical drive, upgrading to a SATA or NVMe SSD is the single most impactful hardware change you can make — the OS installation process itself becomes faster, and boot times can drop from over 60 seconds to under 15.

RAM: 4 GB Is the Limit, Not the Target

Windows 11 requires 4 GB of RAM to install, but that figure is misleading for assessing real Windows 11 upgrade eligibility. The OS itself uses roughly 2–3 GB at idle, leaving almost nothing for open applications on a 4 GB system. For any practical workload — a browser with a few tabs, a document editor, background antivirus scanning — 8 GB is the realistic minimum, and 16 GB is comfortable for most users.

If your machine has 4 GB of DDR4 RAM and is otherwise compatible, check whether the memory is soldered or seated in upgradable DIMM slots. A RAM upgrade is often one of the cheapest ways to ensure the upgrade to Windows 11 actually delivers an improvement in day-to-day performance rather than just a new interface on a struggling system.

Running the PC Health Check — and Reading the Results Properly

Microsoft’s free PC Health Check app gives a pass/fail result but rarely explains which specific requirement failed. Here is how to interpret its output:

  • “The PC must support TPM 2.0” — check BIOS for PTT/fTPM setting (see above).
  • “The processor isn’t supported” — CPU is below the 8th Gen Intel / Ryzen 2000 threshold.
  • “The PC must support Secure Boot” — firmware is in Legacy/CSM mode; convert disk to GPT and enable UEFI boot.
  • “The PC doesn’t meet storage requirements” — free up space on the system drive to at least 64 GB, ideally more.

For a more detailed diagnosis, download and run WhyNotWin11 — a free open-source tool that checks each requirement individually and colour-codes the results, making it far easier to identify exactly what is blocking your upgrade.

What to Do If Your PC Fails Windows 11 Eligibility

If your hardware cannot be made compatible through BIOS tweaks alone, you have three realistic options:

  1. Use the registry bypass — Microsoft’s official workaround disables the CPU and TPM checks for an in-place upgrade. The machine remains unsupported, and Microsoft warns that future updates are not guaranteed, but many users are running Windows 11 on older hardware without issue.
  2. Clean install via bootable USB — a clean install from a Windows 11 ISO skips the Health Check entirely when you choose not to enter a product key during setup. You will need to activate Windows afterwards with a valid licence key.
  3. Upgrade the hardware — if the machine is otherwise solid, a new motherboard and CPU may be more cost-effective than a full replacement, especially if RAM and storage can be reused.

Whichever route you take, you will need a valid Windows 11 licence to activate the installation. Buy Now Key offers genuine Windows 11 licences at competitive prices — including Microsoft Windows 11 Home OEM from €9.65 and Microsoft Windows 11 Pro OEM from €12.90 — so you can get the OS activated properly without overpaying.

Upgrade to Windows 11 Before Windows 10 Support Ends

Microsoft ends mainstream support for Windows 10 on 14 October 2025. After that date, Windows 10 machines will stop receiving free security patches, leaving them exposed to unpatched vulnerabilities. That deadline is the single biggest reason to resolve your Windows 11 compatibility issues now rather than later — security updates are not optional for any internet-connected machine.

If your current machine passes the Windows 11 requirements checklist, the free upgrade from Windows 10 is still available via Windows Update as of mid-2025. If it does not pass, this guide gives you the tools to fix, bypass, or plan around every blocker on the list.

Frequently Asked Questions

Can I upgrade to Windows 11 if my CPU is not on Microsoft’s supported list?

Yes, but unofficially. Microsoft released a registry hack that bypasses both the CPU generation check and the TPM 2.0 requirement for an in-place upgrade from Windows 10. The resulting installation will not carry a “supported” status, which means Microsoft may exclude it from future feature updates — though security patches have continued to reach these machines so far. Proceed with a full backup before attempting the bypass.

Does enabling TPM 2.0 in BIOS delete my data?

No. Toggling the TPM setting in UEFI firmware (enabling PTT on Intel or fTPM on AMD) does not erase your files, applications, or Windows installation. The only exception is if you already had BitLocker enabled and then clear the TPM — in that case you would need your BitLocker recovery key to regain access. If BitLocker is off, enabling TPM is entirely safe.

What is the difference between UEFI and Legacy BIOS for Windows 11 requirements?

UEFI is a modern firmware interface that supports GPT disk partitioning, Secure Boot, and faster boot times. Legacy BIOS (also called CSM mode) is the older standard that uses MBR partitioning and does not support Secure Boot. Windows 11 requires UEFI with Secure Boot enabled. Many older PCs have UEFI firmware but are configured to boot in Legacy mode — switching them to UEFI mode (after converting the disk from MBR to GPT) is usually sufficient to satisfy this requirement.

Will a clean install of Windows 11 skip the compatibility checks?

A clean install from a bootable Windows 11 USB drive does bypass the PC Health Check that runs during an in-place upgrade, but the installer still checks for TPM and Secure Boot by default. To skip those checks during a clean install, you need to add a specific registry key to the installer environment or use a modified ISO. Microsoft’s own documentation describes the registry method for in-place upgrades; for clean installs, the process is slightly different and involves editing the installer’s configuration before booting.

How do I know if my PC has enough free storage for the Windows 11 upgrade?

Open File Explorer, right-click your C: drive, and select Properties. You need at least 64 GB of total storage and enough free space for the upgrade process — aim for at least 20–30 GB of free space beyond your current OS footprint. If you are short, use the built-in Disk Cleanup tool or Storage Sense to remove temporary files, old Windows update caches, and the Windows.old folder from any previous upgrade before retrying.

TPM chip piracy crackdown securing Windows activation with hardware trust
August 6, 2026

TPM Chip Piracy Crackdown: What Microsoft’s Move Means for You

Post By administrator Microsoft, Windows , , , , , No Comments

Microsoft’s TPM chip piracy crackdown is real, it’s rolling out now, and it fundamentally changes how Windows activation fraud is detected and blocked. If you manage a business network, run a KMS server, or you’re simply curious whether your Windows copy is genuine, this is essential reading.

What Is the TPM Chip Piracy Crackdown?

Diagram of TPM activation security flow for KMS Hardware-Secured Windows licensing

Microsoft has introduced a feature called KMS Hardware-Secured, which uses Trusted Platform Module (TPM) attestation to verify that a Key Management Service (KMS) host is running on genuine, uncompromised hardware before it can activate any Windows device. In plain terms: the activation server now has to prove it’s a real physical (or properly certified virtual) machine — not a software-spoofed imitation — before Microsoft’s licensing system accepts activation requests from it.

This is a meaningful escalation. Previously, piracy tools could mimic a KMS host entirely in software, tricking Windows into believing it was legitimately activated by a corporate volume-licensing server. TPM attestation closes that loophole by anchoring the entire chain of trust to a hardware root that cannot be faked in software alone.

According to Microsoft’s own IT Pro blog announcement, KMS Hardware-Secured is rolling out for Windows Server environments and will progressively become the required standard for KMS hosts.

How TPM Activation Security Actually Works

TPM activation security works by tying the identity of an activation server to a cryptographic certificate stored inside its TPM chip — a tamper-resistant piece of silicon soldered to the motherboard. Here’s the step-by-step flow:

  1. TPM attestation request: The KMS host generates a cryptographic proof using its TPM chip, demonstrating its hardware identity to Microsoft’s attestation service.
  2. Microsoft verification: Microsoft’s servers validate that proof. If the hardware is genuine and unmodified, verification succeeds.
  3. Activation rights granted: Only once the KMS host is verified does it receive permission to activate client machines on its network.
  4. Ongoing checks: The attestation is not a one-time event — the hardware integrity can be re-validated, making it much harder for a compromised host to continue operating undetected.

This is the same family of technology used in Windows Hello biometric sign-in and BitLocker drive encryption — both of which already depend on TPM hardware to store keys that cannot be exported or spoofed. Extending it to KMS activation was a logical next step.

Windows Piracy TPM: Why This Approach Is Different

TPM chip piracy crackdown versus software KMS spoof side-by-side comparison graphic

Previous anti-piracy measures focused on the software side — detecting known crack signatures, blacklisting activation keys, or invalidating product keys found in leaked databases. The Windows piracy TPM approach is different because it moves the trust anchor into hardware. Software can be patched, reverse-engineered, or replaced; a TPM chip cannot be trivially cloned or emulated at scale.

It’s worth noting that the piracy community has already begun adapting. A method called TSforge has reportedly emerged as a workaround, and in 2025 Microsoft closed the older “KMS38” loophole that had allowed activations to be spoofed until the year 2038. This is the usual cat-and-mouse cycle — but TPM-based attestation raises the technical floor significantly, meaning only more sophisticated attacks will have any chance of working, and those are far beyond the reach of casual piracy.

Does the KMS Piracy Block Affect Legitimate Users?

For the vast majority of home users with a retail or OEM Windows licence, the answer is no — this change does not affect you at all. Retail and OEM activations go through a completely separate pathway (HWID or online activation) that does not touch KMS. You won’t see any change in how your PC activates.

The groups who need to pay attention are:

  • Enterprise IT administrators running on-premises KMS servers for volume licensing. They will need to ensure their KMS host hardware has a TPM 2.0 chip and that TPM attestation is enabled and working.
  • Managed service providers (MSPs) running KMS infrastructure for clients. The same applies — hardware must be TPM 2.0 compliant.
  • Anyone currently using pirated volume activation. If your “KMS activator” is a software tool rather than a genuine licensed KMS server, this crackdown is specifically aimed at you.

IT Admins: What You Need to Do Now

IT admin verifying TPM 2.0 chip status for Windows KMS activation security compliance

If you manage a legitimate enterprise KMS environment, the action items are straightforward. Microsoft is not removing KMS — it is hardening it. Here’s what to check:

  • Verify TPM 2.0 is present and enabled on your KMS host server. In Windows, open the TPM Management console (tpm.msc) and confirm the chip is active and the specification version reads 2.0.
  • Update your KMS host software to the latest version that supports Hardware-Secured mode. Older KMS host installations will not be capable of completing TPM attestation.
  • Check virtual KMS hosts — if your KMS server runs in a VM, confirm that your hypervisor passes through vTPM support and that the guest OS can see a TPM 2.0 device.
  • Test attestation in a staging environment before the feature becomes mandatory in your Windows Server build.
  • Review your volume licensing agreement with Microsoft to ensure your client counts and activation scopes are still within compliance.

Organisations that already run modern, properly licensed infrastructure will find the transition largely painless. The heavy lifting falls on those running outdated or improperly configured KMS hosts.

TPM Activation Security and the Bigger Windows 11 Picture

This move makes more sense when you remember that TPM 2.0 has been a mandatory system requirement for Windows 11 since its launch in October 2021. Microsoft has spent years seeding TPM hardware across the global PC fleet — and now it is beginning to use that infrastructure for licensing enforcement, not just security features like BitLocker and Secure Boot.

In other words, the TPM requirement that frustrated so many users trying to upgrade to Windows 11 is now paying dividends from Microsoft’s perspective: nearly every Windows 11 machine in the world already has the hardware needed to participate in TPM-backed activation. The groundwork was laid quietly; the enforcement is only now becoming visible.

This also signals where Windows licensing is heading. Expect future versions of Windows to lean even more heavily on hardware attestation, making purely software-based licence bypasses increasingly impractical.

The Case for a Genuine Windows Licence

Beyond the technical risks of running pirated software — malware bundled in activation tools, missing security patches, sudden deactivation — the TPM chip piracy crackdown adds a new practical risk: your activation simply stops working as Microsoft closes each successive loophole. Chasing workarounds is a treadmill, not a solution.

A genuine Windows licence is a one-time purchase that delivers permanent, hardware-bound activation. At Buy Now Key, you can pick up a Microsoft Windows 11 Pro Retail licence for just €17.90 — a fraction of what most people spend on a monthly streaming subscription — or a full guide to all legal Windows activation methods is available on the blog if you want to explore every option before deciding.

For users who need both the OS and a productivity suite, there’s also a Windows 11 Pro + Office 2024 Professional Plus bundle available for €27.80 (regular price €37.85) — genuine, lifetime-activated, and delivered instantly.

FAQ: TPM Chip Piracy Crackdown

Will my currently activated Windows 11 Home or Pro installation stop working?

No. If you activated Windows 11 through a retail key, OEM licence, or a legitimate digital entitlement, your activation is not affected by the KMS Hardware-Secured changes at all. This change targets KMS volume activation servers, not individual retail or OEM devices. Your PC will continue to activate normally.

What is KMS and why do pirates use it?

Key Management Service (KMS) is Microsoft’s volume-licensing system designed for large organisations to activate many Windows machines internally without each one connecting to Microsoft’s servers individually. Piracy tools mimicked this system in software, creating fake KMS “servers” that tricked Windows into believing it was legitimately activated under a corporate licence. The TPM activation security changes specifically target these fake servers.

Does my home PC need a TPM 2.0 chip because of this?

Your home PC already needs TPM 2.0 to run Windows 11 — that requirement predates this change. The KMS Hardware-Secured feature applies to servers that act as KMS hosts, not to the client machines they activate. For home users, nothing changes in terms of hardware requirements.

Can pirates bypass the TPM chip piracy crackdown?

Technically sophisticated workarounds will likely emerge over time — the TSforge method is an early example — but TPM-based attestation raises the bar considerably. Casual or automated piracy using off-the-shelf activator tools will become much less reliable. Each successive bypass also becomes easier for Microsoft to detect and close, making piracy an increasingly unstable choice.

How do I check if my Windows licence is genuine right now?

Open Settings, go to System > Activation, and look for the status message. A genuine, properly activated copy will show “Windows is activated” along with your licence type. You can also run slmgr /xpr in an elevated Command Prompt for detailed licence expiry information. Our Windows licence check guide walks through exactly what each status message means.

TPM 2.0 chip powering Windows activation enforcement on a secure server
July 29, 2026

TPM Activation Enforcement in 2026: What Really Changes for Windows Users

Post By administrator Microsoft, Windows , , , , , No Comments

TPM activation enforcement is the buzzword dominating tech headlines in mid-2026 — and understandably so. Microsoft announced it will require TPM 2.0-backed hardware attestation for Key Management Service (KMS) hosts starting in August 2026. But here is the critical detail most coverage glosses over: this change targets enterprise KMS servers, not individual home users running a retail or OEM Windows licence. If you bought a genuine Windows key, your day-to-day experience changes very little. Read on for the full picture.

What Is TPM Activation Enforcement, Exactly?

Detailed diagram of a TPM 2.0 chip on a modern motherboard with labels showing hardware attestation flow to a KMS server, clean tech-infographic style, no dates visible

TPM activation enforcement refers to Microsoft’s new rule requiring that servers responsible for activating Windows across large networks — called KMS (Key Management Service) hosts — must possess a verified, uncompromised Trusted Platform Module 2.0 chip before they can issue activation tokens. According to Microsoft’s own Windows IT Pro Blog post on strengthening KMS with hardware-based trust, TPM attestation will become mandatory for KMS Hardware-Secured activation with the next Windows Server LTSC release, with readiness messages appearing from August 2026.

In plain terms: the KMS server must prove to Microsoft’s cloud infrastructure that its hardware hasn’t been tampered with. A fake or software-emulated TPM will no longer pass the check. This is a server-side enforcement mechanism, not a new gate installed on your personal PC.

How KMS Activation Works — and Where Piracy Entered the Picture

KMS activation is the method large organisations use to activate hundreds or thousands of Windows installations without entering individual product keys on every machine. An IT department sets up a KMS host server; client PCs on the network contact that server every 180 days to renew their activation status.

The piracy angle emerged because bad actors set up rogue KMS servers — software tools that mimic legitimate KMS hosts — allowing unregistered Windows copies to “phone home” to a fake server rather than Microsoft’s own infrastructure. These tools have circulated for years, and some estimates from security researchers put the number of enterprise environments unknowingly running pirated volume licences in the hundreds of thousands globally.

  • Legitimate KMS host: a Windows Server 2025 machine with a valid Volume Licence Agreement and a genuine TPM 2.0 chip, registered with Microsoft.

  • Rogue KMS emulator: software running on any machine, spoofing the KMS protocol to hand out fake activation tokens.

  • New enforcement: from August 2026, the KMS host must pass a TPM attestation check; a software emulator cannot provide a real TPM signature, so it fails.

The result is that KMS-based piracy in enterprise environments becomes significantly harder to sustain. Whether it eliminates the problem entirely remains to be seen — determined attackers often find workarounds — but the barrier to entry rises considerably.

Does TPM Activation Enforcement Affect Home Users?

Side-by-side comparison graphic showing enterprise KMS server environment versus a home user desktop setup, highlighting which is affected by TPM activation enforcement in 2026, flat vector illustration style

No — and this is where conflicting reports have created unnecessary panic. Windows activation for home users relies on a completely different path called online activation or phone activation, tied to a retail or OEM product key. Your PC contacts Microsoft’s activation servers directly over the internet; no KMS host is involved at any point. The August 2026 KMS TPM requirement simply does not touch this flow.

As TechSpot’s coverage of Microsoft’s TPM crackdown on Windows piracy makes clear, the enforcement specifically targets KMS hosts used in volume-licence environments. Home users, small business owners buying retail keys, and OEM device owners are unaffected.

What does apply to every consumer PC running Windows 11 is the pre-existing TPM 2.0 requirement introduced at launch in 2021. Windows 11 has always required a TPM 2.0 chip to install and activate — that’s not new, and it hasn’t changed. If your machine already runs Windows 11, it already has a functioning TPM 2.0.

Windows Activation Methods: Which One Do You Use?

Understanding your own Windows activation method removes any lingering uncertainty. There are three main types:

  1. Retail / Digital Licence: You purchased a product key directly, or Windows was pre-activated on a new device and tied to your Microsoft account. Activation is handled peer-to-peer with Microsoft’s servers. Unaffected by KMS enforcement.

  2. OEM: A key embedded in your PC’s firmware by the manufacturer at the factory. Permanent, device-locked, and completely independent of KMS infrastructure. Unaffected.

  3. Volume / KMS: Used by businesses and educational institutions with Microsoft Volume Licensing agreements. This is the method under scrutiny. From August 2026, the KMS host server must pass TPM 2.0 attestation.

If you’re a home user or a small business owner who purchased individual Windows keys, you fall into category one or two. The new KMS TPM 2.0 requirement is irrelevant to your setup. To double-check your current activation status on any Windows 11 machine, go to Settings → System → Activation. A status of “Windows is activated with a digital licence” or “Windows is activated” confirms you’re on a retail or OEM path.

What Changes for IT Admins and Enterprise Teams

Screenshot-style illustration of a Windows 11 Pro genuine activation confirmation screen on a modern laptop, showing a valid licence status indicator, no calendar dates visible

For IT professionals managing Windows environments at scale, the August 2026 timeline demands attention. Windows Server 2025 KMS hosts will begin displaying TPM readiness messages from that date, and when the next Windows Server LTSC release ships, TPM attestation transitions from optional to mandatory.

Practical steps for enterprise teams include:

  • Audit all KMS hosts for TPM 2.0 presence and firmware TPM health — use the tpm.msc console or PowerShell’s Get-Tpm command.

  • Ensure KMS hosts are running Windows Server 2025 with the latest cumulative updates applied.

  • Verify that Volume Licensing agreements are current and that KMS host keys are properly registered with Microsoft.

  • Replace or upgrade any server hardware that lacks a hardware-rooted TPM 2.0 chip.

  • Test KMS attestation readiness in a staging environment before the mandatory deadline.

Organisations that have inadvertently inherited rogue KMS infrastructure — sometimes brought in by a previous IT contractor — should treat this as an urgent remediation task. Failing the attestation check means client machines in the network will lose their KMS-granted activation on next renewal, which occurs every 180 days.

How to Get a Genuine Windows Licence the Right Way

Whether you’re a home user who wants peace of mind or a small business looking to bring devices into compliance, sourcing a legitimate Windows licence is the cleanest long-term solution. Genuine retail keys activate directly with Microsoft, are unaffected by any KMS enforcement changes, and remain valid for the lifetime of the device.

At Buy Now Key, you’ll find competitive pricing on genuine retail and OEM Windows licences. For example, a Microsoft Windows 11 Pro – Retail licence is available for just €17.90 — a fraction of the full Microsoft Store price — and activates directly with Microsoft’s servers in minutes. If you’re running Windows 10 and not yet ready to upgrade, a Microsoft Windows 10 Pro OEM key (€8.90) keeps you fully activated and secure until the October 2025 end-of-support date.

Choosing a legitimate licence means your activation is always tied to Microsoft’s own infrastructure — no KMS host, no attestation gamble, no surprise deactivation when enforcement tightens.

Will Microsoft Ever Extend TPM Enforcement to Consumer Activation?

It’s a fair question, and the honest answer is: not announced, but not impossible. The KMS TPM attestation rollout gives Microsoft a proven technical framework for hardware-rooted verification. Whether that framework eventually extends to retail activation channels is speculative at this stage. Microsoft has made no such announcement for consumer products.

What we do know is that TPM 2.0 is already required on every Windows 11 device, so the hardware foundation is in place across the modern PC ecosystem. If Microsoft ever chose to layer additional attestation onto the consumer activation flow, most Windows 11 machines would already comply. For Windows 10 users still on older hardware without TPM 2.0, that theoretical future scenario would be an additional incentive to upgrade.

For now, the practical implication is simple: own a genuine licence, keep your Windows updated, and you have nothing to worry about regardless of how Microsoft’s activation architecture evolves.

FAQ

Will TPM activation enforcement deactivate my current Windows installation?

Only if your Windows was activated through a rogue or unauthorised KMS server in an enterprise environment. If you’re a home user with a retail or OEM licence activated directly with Microsoft, nothing changes. Your activation is independent of the KMS infrastructure being targeted by the new TPM rules.

What is the difference between KMS activation and retail activation?

KMS activation is a volume-licencing method used by businesses and institutions. Client machines contact an internal KMS host server every 180 days to maintain activation. Retail and OEM activation ties a product key directly to your device and your Microsoft account via Microsoft’s global servers. The TPM 2.0 requirement applies only to KMS hosts — not to retail or OEM keys.

How do I check whether I have a genuine Windows licence right now?

Open Settings → System → Activation. If it reads “Windows is activated with a digital licence” or “Windows is activated” without a KMS-related note, you’re using a standard retail or OEM licence. You can also run slmgr /xpr in Command Prompt: a permanent-licence message confirms you’re not on a time-limited KMS renewal cycle.

Does TPM 2.0 requirement apply to Windows 10?

Windows 10 does not require TPM 2.0 to install or activate — that requirement was introduced with Windows 11 in October 2021. However, the new KMS TPM attestation rules apply to KMS hosts running Windows Server 2025, regardless of which Windows client version those hosts are activating. Windows 10 clients in a KMS environment are indirectly affected if their host server fails attestation.

When exactly does the mandatory KMS TPM enforcement begin?

Windows Server 2025 KMS hosts will start showing TPM readiness warning messages from August 2026. Full mandatory enforcement arrives with the next Windows Server LTSC release. Microsoft has signalled organisations should treat the August 2026 readiness phase as preparation time before enforcement becomes absolute.

Windows 10 hardware compatibility check showing compatible and blocked PC systems
July 28, 2026

Windows 10 Hardware Compatibility: Why 30% of PCs Still Can’t Upgrade

Post By administrator Windows , , , , , , No Comments

Windows 10 hardware compatibility is the reason roughly 30% of the world’s PCs are still locked out of Windows 11 — and HP’s frank admission has finally put a number on a problem millions of users already know firsthand. CPU generation walls, mandatory TPM 2.0 chips, and minimum RAM thresholds combine to create one of the strictest OS upgrade barriers Microsoft has ever erected. If your machine is on the wrong side of that wall, this guide explains exactly why, and what your realistic options are before the extended Windows 10 support window closes in October 2027.

What HP’s Data Actually Tells Us About Hardware Compatibility

Three hardware compatibility barriers blocking Windows 11 upgrade on older PCs

HP — one of the world’s largest PC manufacturers — publicly acknowledged that around 30% of its active Windows install base is still running Windows 10, not by choice but because those machines fail Microsoft’s minimum hardware requirements for Windows 11. That is an enormous proportion when you consider HP alone ships tens of millions of units annually. Scale that across the entire global market and you are looking at hundreds of millions of PCs that are, by Microsoft’s own definition, incompatible with its current flagship OS.

This is not a software problem or a reluctance to upgrade. It is a fundamental PC upgrade compatibility ceiling imposed by hardware that was perfectly capable and even premium-grade just a few years ago. An Intel Core i7 from the 7th generation, for example, ran demanding workloads without complaint in 2018 — yet it fails Microsoft’s approved CPU list for Windows 11 entirely.

The Three Hardware Walls Blocking Your Windows Upgrade

Understanding exactly which requirements create the bottleneck helps you diagnose your own machine quickly. There are three primary blockers, and most incompatible PCs fail on at least two of them simultaneously.

1. CPU Generation: The Biggest Barrier to Windows Upgrade Requirements

Microsoft’s official Windows 11 specifications restrict compatibility to Intel 8th-generation Core processors (Coffee Lake, 2017) and newer, or AMD Ryzen 2000 series and newer. Any CPU older than those cut-off generations is simply not on the approved list — regardless of its clock speed, core count, or actual performance capability. This single rule disqualifies an enormous wave of 2015–2017 hardware that is otherwise fully functional.

The stated reasoning involves silicon-level security features and instruction sets that older CPUs lack — including hardware-enforced stack protection and certain virtualisation capabilities that Windows 11’s security model depends on.

2. TPM 2.0: The Chip Most Users Didn’t Know They Needed

Trusted Platform Module (TPM) 2.0 is a dedicated security chip — either a discrete component soldered to the motherboard or a firmware-based implementation baked into the CPU. Microsoft made TPM 2.0 a non-negotiable requirement for Windows 11, citing its role in BitLocker encryption, Windows Hello, and Secure Boot authentication.

Many business-class machines manufactured before 2018 either have no TPM chip at all, have TPM 1.2 (which does not satisfy the requirement), or have TPM 2.0 disabled in the BIOS by default. The third scenario is actually fixable — enabling TPM 2.0 in UEFI firmware settings costs nothing and takes under five minutes — but the first two scenarios represent genuine hardware compatibility dead-ends without a motherboard replacement.

3. RAM: The 4 GB Floor

Windows 11 requires a minimum of 4 GB of RAM. This sounds modest by modern standards, but millions of older budget laptops and corporate thin-client machines shipped with just 2 GB or 3 GB. While RAM is often upgradeable, many of these machines also use soldered memory modules that cannot be expanded — so even willing users have no path forward without buying new hardware.

Why Microsoft Extended Windows 10 Support to October 2027

Windows 10 hardware compatibility check result showing PC upgrade requirements failed

Originally, Microsoft set October 14, 2025 as the end-of-life date for Windows 10. When it became clear that hundreds of millions of devices simply could not meet Windows 11’s hardware requirements, the company quietly extended its free Extended Security Update (ESU) programme by a full year, then extended it again to October 12, 2027 — giving users an additional two years of critical security patches beyond the original deadline.

This extension is a direct acknowledgement of the scale of the Windows 10 hardware compatibility crisis. Microsoft could not realistically force a third of the world’s PC fleet onto unsupported hardware overnight. The ESU programme means Windows 10 Home and Pro users continue to receive security patches through October 2027 at no extra cost — though it is important to understand that this is a security-update lifeline, not a feature-development extension. No new features are coming to Windows 10.

How to Check Your PC’s Upgrade Compatibility Right Now

Microsoft’s own PC Health Check app is the fastest way to determine whether your machine meets Windows upgrade requirements. Download it directly from Microsoft’s website, run it, and it will return a pass/fail result along with the specific reason for failure — whether that is CPU, TPM, RAM, storage, or Secure Boot. The process takes under two minutes.

Alternatively, you can check manually:

  • CPU: Open Task Manager → Performance → CPU. Note the model name, then cross-reference it with Microsoft’s approved processor list.
  • TPM status: Press Win + R, type tpm.msc, and press Enter. If TPM 2.0 is present and active, you will see the version number.
  • RAM: Task Manager → Performance → Memory. 4 GB minimum is required.
  • Storage: You need at least 64 GB of free drive space.
  • Firmware: Confirm UEFI mode (not legacy BIOS) and that Secure Boot is enabled in your firmware settings.

Your Options If Your PC Fails Windows 11 Hardware Compatibility

PC upgrade compatibility decision paths from Windows 10 to Windows 11 for users

Failing the compatibility check does not mean you have to rush out and buy a new machine tomorrow. There are several practical paths, each with different cost and risk profiles.

Option 1: Stay on Windows 10 and Buy an Affordable Licence

If your hardware is otherwise performing well, staying on Windows 10 through October 2027 is a perfectly rational decision. The ESU extension means you will keep receiving security patches for over two more years. The key is ensuring you are running a fully activated, genuine copy so you receive all updates reliably. A legitimate Windows 10 licence from Buy Now Key starts from as little as €8.90 — far cheaper than rushing into new hardware before you need to.

Option 2: Fix What Is Fixable (TPM and Secure Boot)

If TPM 2.0 and Secure Boot are the only obstacles — and your CPU is on the approved list — you may simply need to enable them in your UEFI/BIOS settings. Restart your PC, enter BIOS (usually Del, F2, or F10 at boot), locate the Security or TPM section, and enable both features. Then re-run the PC Health Check. Many users discover this is their only blocker.

Option 3: Upgrade to Windows 11 on a Compatible Device

If your machine genuinely cannot be made compatible and you need Windows 11’s features, the cleanest path is a new or refurbished device with a fresh licence. At Buy Now Key, Microsoft Windows 11 Pro Retail is available from €17.90 — meaning the software cost of stepping up is genuinely low. The bigger investment is hardware, but in many cases a modest refurbished business PC will easily meet Windows 11’s requirements and cost far less than a brand-new machine.

Option 4: The Unofficial Bypass Route (With Caveats)

Various registry edits and third-party tools exist to install Windows 11 on unsupported CPUs. Microsoft has explicitly warned that devices running Windows 11 outside the official PC upgrade compatibility list may not receive future updates and could encounter stability issues. In December 2024, Microsoft confirmed it would not relax hardware requirements. Proceed with this route only if you fully understand and accept the risks — it is not a path Buy Now Key recommends for production or business machines.

What This Means for Businesses Managing Large PC Fleets

For IT administrators, the HP data point is a sobering reality check. If 30% of consumer PCs fail Windows upgrade requirements, enterprise fleets — which tend to run hardware on longer refresh cycles — could see even higher incompatibility rates. Microsoft’s own guidance recommends using tools like Microsoft Intune or Endpoint Configuration Manager to audit TPM 2.0 compatibility across your estate before planning a bulk migration.

The October 2027 deadline, while welcome, is not a permanent stay of execution. Businesses that have not begun phased hardware refresh planning risk facing a last-minute crunch with supply constraints, budget pressures, and a hard deadline for security patch coverage all converging at once. Starting that conversation now — even if rollout is 18–24 months away — is strongly advisable.

Will Microsoft Ever Relax Its Hardware Compatibility Rules?

The short answer is almost certainly not. Microsoft confirmed in December 2024 that it has no plans to lower or remove the CPU, TPM 2.0, or RAM requirements. The official reasoning centres on the security architecture underpinning Windows 11 — features like hardware-enforced stack protection, Pluton security processors, and future Secured-Core PC capabilities all depend on these hardware minimums being present. Relaxing them would, in Microsoft’s view, undermine the entire security proposition of Windows 11.

The more pragmatic reading is that Microsoft also has commercial incentives for a hardware refresh cycle. Regardless of motive, the requirements are not changing — which makes understanding your own machine’s hardware compatibility position more important than ever.

FAQ

Which CPUs are incompatible with Windows 11?

Any Intel CPU older than 8th-generation Core (2017 Coffee Lake) and any AMD CPU older than Ryzen 2000 series (2018) is officially unsupported. This includes the very popular Intel 6th and 7th generation Core processors that powered millions of business laptops and desktops sold between 2015 and 2017. Microsoft publishes a full approved CPU list on its Windows 11 specifications page.

Is TPM 2.0 always a hardware problem, or can it be enabled in software?

Often it is a BIOS setting, not a missing chip. Many machines manufactured after 2016 include TPM 2.0 in firmware (called fTPM on AMD systems or PTT on Intel), but it is disabled by default. Entering your UEFI settings and enabling it costs nothing. If the chip is truly absent or only TPM 1.2 is present, however, you would need a discrete TPM module or a motherboard that supports firmware TPM — which means a hardware upgrade or replacement.

How long will Windows 10 receive security updates?

Microsoft extended free consumer Extended Security Updates (ESUs) to October 12, 2027. This covers critical security patches for Windows 10 Home and Pro. After that date, no further security updates will be issued for Windows 10, and continuing to use it represents a genuine security risk. Feature updates stopped with Windows 10 version 22H2 in 2022.

Can I upgrade my RAM or add a TPM chip to make my PC compatible?

It depends on your hardware. If your RAM is in standard DIMM or SO-DIMM slots (not soldered), upgrading to 4 GB or more is straightforward and inexpensive. Discrete TPM 2.0 modules exist and can be fitted to motherboards with a TPM header, but compatibility varies by board. The bigger problem is usually the CPU generation requirement — there is no upgrade path for that short of replacing the CPU and often the motherboard too, at which point a new system may be more cost-effective.

Is the free Windows 11 upgrade still available?

Yes — if your PC meets the hardware requirements, the upgrade from Windows 10 to Windows 11 remains free through Windows Update. Simply ensure your Windows 10 copy is activated and up to date, then check Settings → Windows Update → Check for Updates. Eligible machines will be offered the upgrade at no charge. If your machine is not on the compatible list, the free upgrade will not appear regardless of your Windows 10 activation status.

What is the cheapest way to get a genuine Windows licence?

Buy Now Key offers both Windows 10 licences from €8.90 and Windows 11 Pro from €17.90. These are genuine, permanently activated licences with instant digital delivery — far cheaper than buying through a retail box or directly from Microsoft’s storefront. If you are staying on Windows 10 through 2027, securing a proper licence now ensures uninterrupted update delivery.