AboutFree templates
How-to · Windows

Check Windows 11 compatibility

At the end you will know whether each PC meets Microsoft's minimum requirements for Windows 11, which requirement blocks the ones that do not, and whether the blocker is a setting you can turn on (TPM or Secure Boot) or hardware that needs replacing.

Updated 9 steps7 official sources
Start hereBack to the playbook
Before you start

What you need before step 1

Applies to: Windows 10 PCs being assessed for an upgrade to Windows 11, one at a time or across an Intune-managed fleet, as documented by Microsoft

Admin roles you need

  • A local administrator account on the PC (needed for Confirm-SecureBootUEFI and to install PC Health Check)
  • Fleet check, to turn on endpoint analytics: an Intune role with Endpoint Analytics read/write such as School Administrator, or a custom role with Endpoint Analytics/Read, Endpoint Analytics/Create, Update, Delete, Organization/Read, Managed Devices/Read and Device configurations/Create, Read, Assign
  • Fleet check, to read the reports: Help Desk Operator, Read Only Operator, Endpoint Security Manager or School Administrator in Intune, or the Reports Reader role in Microsoft Entra ID

Licences

  • Single PC: none
  • Fleet: each device in endpoint analytics needs a valid Microsoft Intune licence (or Configuration Manager with tenant attach)

Download

PC Health Check appMicrosoft's download link for Windows 10 PCshttps://aka.ms/GetPCHealthCheckAppDownload

Web portals you will use (nothing to install)

Microsoft Intune admin centerReports > Endpoint analytics > Work from anywhere for a fleet viewhttps://intune.microsoft.comOpen

Reference documentation

Windows 11 requirements (Microsoft Learn)The minimum hardware list and the compatible processor lists it links tohttps://learn.microsoft.com/en-us/windows/whats-new/windows-11-requirementsRead

Also have ready

  • Fleet: devices running Windows Pro, Pro Education, Enterprise or Education, managed by Intune, co-managed, or Configuration Manager with tenant attach
  • Fleet: the Connected User Experiences and Telemetry service (DiagTrack) running on devices, and devices able to reach https://*.events.data.microsoft.com
  • Windows 11 runs only on Windows PCs; there is no macOS route for these checks
Step by step

9 steps

  1. 1

    Check the current Windows 10 version

    Where: On the PC: Start > type winver > Enter

    Microsoft says a Windows 10 PC can upgrade directly to Windows 11 only if it runs Windows 10 version 2004 or later and has the 14 September 2021 security update or later. If it is older, update Windows 10 first through Settings > Update & Security > Windows Update.

    winver
    You should see: The About Windows box shows Version 22H2 (or another version 2004 or later) and an OS Build number.
  2. 2

    Install PC Health Check

    Where: On the PC, in Microsoft Edge or another browser

    Go to https://aka.ms/GetPCHealthCheckApp and follow the prompts to download and install the app. It may already be installed; search the Start menu for PC Health Check first.

    You should see: PC Health Check appears in the Start menu and opens to a page with a Windows 11 section at the top.
  3. 3

    Run the Windows 11 eligibility check

    Where: On the PC: Start > PC Health Check

    Select Check now. The app compares the PC with the Windows 11 minimum system requirements and explains which ones it meets and which it does not.

    You should see: Either a message that the PC meets Windows 11 requirements, or a list of the requirements it does not meet (for example TPM 2.0 or Secure Boot) with what you can do.
  4. 4

    Compare with the minimum requirements

    Where: Microsoft Learn: Windows 11 requirements page, side by side with PC Health Check

    Microsoft's minimum hardware for Windows 11 is: a 1 GHz or faster processor with two or more cores on a compatible 64-bit processor or system on a chip; 4 GB of memory or more; 64 GB or more of available storage; a DirectX 12 compatible graphics card with a WDDM 2.0 driver; UEFI firmware that is Secure Boot capable; TPM version 2.0; and a 720p display larger than 9 inches with 8 bits per colour channel. Check the processor model against the compatible processor list linked from the requirements page. Use the commands to read the processor, memory and free space.

    Get-CimInstance Win32_Processor | Format-List Name,NumberOfCores,MaxClockSpeed
[math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1GB, 1)
Get-PSDrive C | Format-List Used,Free
    You should see: The processor name and core count, memory in GB (4 or more), and free space on C: in bytes.
  5. 5

    Check the TPM with tpm.msc

    Where: On the PC: press Windows key + R

    Type tpm.msc and choose OK. If the window says the TPM is ready for use, check Specification Version under TPM Manufacturer Information. You can also check Settings > Update & Security > Windows Security > Device Security > Security processor details.

    tpm.msc
    You should see: TPM Manufacturer Information shows Specification Version 2.0. If you see Compatible TPM cannot be found, the TPM may be turned off in firmware (step 7).
  6. 6

    Check Secure Boot

    Where: Windows PowerShell on the PC, run as administrator (right-click > Run as administrator)

    Run Confirm-SecureBootUEFI. Microsoft says it returns True when the PC supports Secure Boot and it is on, False when it supports Secure Boot but it is off, and an error on a BIOS (non-UEFI) PC or one that does not support Secure Boot. It must run as administrator.

    Confirm-SecureBootUEFI
    You should see: True. False means Secure Boot is supported but off (turn it on in firmware). Cmdlet not supported on this platform means the PC is not booting in UEFI mode or does not support Secure Boot.
  7. 7

    Turn on TPM or Secure Boot in firmware if they are off

    Where: On the PC: Settings > Update & Security > Recovery > Restart now, then Troubleshoot > Advanced options > UEFI Firmware Settings > Restart

    Firmware menus differ by manufacturer. Microsoft says the TPM option may be labelled Security Device, TPM State, AMD fTPM switch, AMD PSP fTPM, Intel PTT or Intel Platform Trust Technology. Turn it on, save and restart, then repeat steps 3 and 5. For Secure Boot, follow the PC maker's instructions.

    You should see: After restart, tpm.msc shows Specification Version 2.0 and PC Health Check no longer lists TPM as a blocker.
  8. 8

    Fleet: turn on endpoint analytics in Intune

    Where: Microsoft Intune admin center (https://intune.microsoft.com) > Reports > Analytics > Endpoint analytics

    For Collect device data from, choose All cloud-managed devices or Selected devices, then select Start. Intune assigns a configuration profile named Intune data collection policy to the targeted devices. To change the target later, go to Devices > Configuration > Intune data collection policy > Properties > Assignments > Edit.

    You should see: The Endpoint analytics Overview page opens. Microsoft says it can take up to 24 hours after a restart for data to appear.
  9. 9

    Fleet: open the Work from anywhere report

    Where: Microsoft Intune admin center > Reports > Endpoint analytics > Work from anywhere

    On the Work from anywhere Overview page select Windows to open the flyout showing how many devices meet the Windows 11 minimum requirements and which requirements are the top blockers. Open the Windows tab for a device-by-device view and read the Windows 11 readiness status and Windows 11 readiness reason columns. Export to CSV for your hardware replacement list.

    You should see: Each device shows Capable, Not capable, Upgraded or Unknown; Not capable devices list the failed requirements in the reason column.
From experience

Expert tips

Check firmware settings before writing a PC off

Many PCs that fail on TPM or Secure Boot have the feature but it is switched off. Microsoft lists TPM options such as Intel PTT and AMD fTPM in firmware. Run tpm.msc and Confirm-SecureBootUEFI first; a False result for Secure Boot means it is supported but off, which is a setting, not a hardware fault.

The processor is the blocker you cannot fix

Memory, storage, TPM and Secure Boot can often be fixed. An unsupported processor cannot. Check the CPU model against the compatible processor list linked from Microsoft's requirements page and put those PCs straight on the replacement list.

Use the fleet report for more than a handful of PCs

Work from anywhere shows Capable, Not capable, Upgraded and Unknown for every managed device, plus the reason. Microsoft says data can take up to 24 hours after a restart, and a device must have sent an event in the past 29 days to appear. Turn endpoint analytics on early in the project so the data is ready when you plan.

Mind the numeric CSV values

An exported Work from anywhere CSV shows numbers, not labels: in UpgradeEligibility, 3 is Capable, 2 Not capable, 1 Unknown and 0 Upgraded. Map them before sharing the sheet.

Update Windows 10 before upgrading

Microsoft says a direct upgrade needs Windows 10 version 2004 or later with the 14 September 2021 security update or later. A PC that passes the hardware check but runs an older build needs Windows Update first.

Check it worked

How to confirm it worked

  • PC Health Check reports that the PC meets Windows 11 requirements.

  • tpm.msc shows Specification Version 2.0 and Confirm-SecureBootUEFI (as administrator) returns True.

  • In the Work from anywhere report, the device's Windows 11 readiness status is Capable. In an exported CSV, the UpgradeEligibility column is 3 for Capable, 2 for Not capable, 1 for Unknown and 0 for Upgraded.

Undo

How to reverse it

Rollback:

The checks change nothing. To remove PC Health Check, uninstall it from Settings > Apps. To stop endpoint analytics collecting data, change or remove the assignment of the Intune data collection policy profile under Devices > Configuration. Firmware changes to TPM or Secure Boot can be reversed in the same firmware menu.

Troubleshooting

Errors you might see

Compatible TPM cannot be found

Cause: The TPM is missing or turned off in firmware.

Fix: Open UEFI firmware settings and turn on the TPM option (Intel PTT, AMD fTPM or similar), then check tpm.msc again.

Cmdlet not supported on this platform

Cause: Confirm-SecureBootUEFI ran on a BIOS (non-UEFI) PC or one that does not support Secure Boot.

Fix: Check whether the firmware can boot in UEFI mode; Windows 11 needs UEFI firmware that is Secure Boot capable.

Unable to set proper privileges. Access was denied.

Cause: Confirm-SecureBootUEFI was run in a PowerShell window that is not elevated.

Fix: Close PowerShell, right-click it and select Run as administrator, then rerun the command.

Devices show Unknown in the Work from anywhere report

Cause: Microsoft says Unknown devices are usually inactive: a device appears only if it uploaded an endpoint analytics event in the past 29 days.

Fix: Check the device's last check-in time in Intune, make sure it is targeted by the Intune data collection policy, and restart it.

FAQ

Questions

Can a PC in S mode upgrade?

Microsoft says S mode is only supported on Windows 11 Home. Other editions in S mode must switch out of S mode first, which needs internet access and cannot be reversed.

Does Windows 11 Home need a Microsoft account?

Yes. Microsoft says Windows 11 Home needs an internet connection and a Microsoft account to complete setup on first use.

Why is an eligible PC not offered the upgrade yet?

Microsoft may hold the upgrade with a compatibility safeguard hold until a known issue is fixed.

Which Windows editions does the Work from anywhere report cover?

Endpoint analytics supports Windows Pro, Pro Education, Enterprise and Education devices that are Intune-managed, co-managed or attached from Configuration Manager.

Sources

Official sources

Vendors change menus and requirements. Confirm on the source before you rely on a detail. Last checked 4 Nov 2026.

Microsoft Support: How to use the PC Health Check appMicrosoft Learn: Windows 11 requirementsMicrosoft Support: Enable TPM 2.0 on your PCMicrosoft Learn: Confirm-SecureBootUEFIMicrosoft Learn: Endpoint analytics prerequisitesMicrosoft Learn: Configure endpoint analyticsMicrosoft Learn: Work from anywhere report