guide · static export
PC · windows-update

Find Out What Blocks a Windows 11 Upgrade

The upgrade assistant says no and the compatibility app says nothing useful. TPM, Secure Boot, disk layout and CPU support are all readable with built-in commands, and each has its own fix.

by@guidox updated:11/01/26 time:20 min level:Intermediate tested on:Windows 11 24H2 works on:Windows 10, Windows 11 tools:PowerShell as administrator, Firmware settings
TL;DR

Check **Get-Tpm**, **Get-SecureBootUEFI**, **Get-Disk** and the CPU model. Those four answers cover almost every blocker, and each one needs a different fix in firmware or on the disk.

Before you start

Requirements

  • Admin rights
  • Access to the firmware settings
  • 20 minutes
Step by step

Instructions

01

Record the four hard requirements

TPM 2.0, UEFI with Secure Boot, GPT and CPU support decide eligibility. Reading them before touching anything prevents the trial-and-error loop with the upgrade assistant.

Get-Tpm | Select-Object TpmPresent,TpmReady,TpmEnabled,ManufacturerVersion
Get-CimInstance Win32_Processor | Select-Object Name,NumberOfCores,MaxClockSpeed
Get-Disk | Select-Object Number,FriendlyName,PartitionStyle,Size
02

Check the firmware mode, not the BIOS name

**$env:firmware_type** reports UEFI or BIOS for the running system. Secure Boot state comes from the UEFI variables, and a machine in BIOS mode cannot enable it without a disk conversion.

$env:firmware_type
Confirm-SecureBootUEFI
Get-SecureBootUEFI -Name SetupMode
msinfo32
03

Look for the TPM in firmware before blaming Windows

A TPM that is present but not ready is usually disabled in the firmware or owned by another OS. **tpm.msc** shows the state and the specification version in one dialog.

tpm.msc
Get-CimInstance -Namespace root\cimv2\security\microsofttpm -ClassName Win32_Tpm | Select-Object SpecVersion,IsActivated_InitialValue,IsEnabled_InitialValue
04

Check free space and the partition layout

The upgrade needs room for the old installation and the new image. A disk with a legacy MBR layout must be converted before Secure Boot can be enabled.

Get-PSDrive C | Select-Object Used,Free
Get-Partition | Select-Object DiskNumber,PartitionNumber,DriveLetter,Type,Size
Get-Volume | Select-Object DriveLetter,FileSystem,SizeRemaining
05

Fix the blockers in the right order

Enable the TPM and UEFI in the firmware first, convert the disk, then enable Secure Boot. Reversing the order produces a machine that will not boot.

:: firmware: enable TPM (fTPM or dTPM), set boot mode to UEFI, save and reboot
mbr2gpt /validate /disk:0 /allowFullOS
mbr2gpt /convert /disk:0 /allowFullOS
Confirm-SecureBootUEFI
⚠ warningConverting the disk requires a full backup and a boot in UEFI mode afterwards. A power loss in the middle leaves the disk unusable.
06

Confirm the verdict with a second tool

The PC Health Check app and the compatibility appraiser in Task Scheduler report an independent result. A machine that passes both is eligible without a registry workaround.

Get-ScheduledTask -TaskName 'Microsoft Compatibility Appraiser' | Select-Object TaskName,State
dism /online /get-targeteditions
Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber
Troubleshooting

Common issues

Get-Tpm reports no TPM at all

Firmware TPM is disabled or the board has none. Enable PTT or fTPM in the firmware; a discrete module needs the correct header and a BIOS update.

Secure Boot is greyed out in the firmware

The disk is still MBR or the boot mode is legacy. Convert the disk and switch the boot mode to UEFI before the option becomes available.

The CPU is not on the supported list

There is no supported workaround. A machine that old usually runs better with a lightweight Linux or stays on Windows 10 with its remaining updates.

The upgrade fails at 60 percent without a reason

Read C:\$WINDOWS.~BT\Sources\Panther\setupact.log. A driver or a language pack is the usual cause, and the log names it.

FAQ

Frequently asked

Is TPM 1.2 enough?

No. Windows 11 requires 2.0, and the check reports the version. Most boards from 2016 onwards can switch between them in the firmware.

Do I need a Microsoft account for the upgrade?

The upgrade itself does not. The out-of-box experience of Windows 11 Pro asks for a connection, which a local account or a domain join can avoid.

Can I bypass the checks with a registry key?

Yes, and the machine then runs unsupported without security updates for the new requirements. Treat it as a temporary measure on a test device.

How to undo this

Firmware changes are reverted in the firmware itself. A disk conversion cannot be reverted with mbr2gpt; restore the backup you took before converting.

Changelog · 1 entry
  1. 2026-10-31
    First version
Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress