Fix Standard Hardware Security Not Supported on Windows 11

If Windows 11 shows “Standard hardware security not supported” in Windows Security, it means your PC’s firmware or CPU lacks one or more required security features—most commonly TPM 2.0, Secure Boot, or Virtualization-Based Security. The fix is to enable these features in your UEFI/BIOS settings, or if they are genuinely absent, replace the hardware or bypass the check (not recommended). Below is a complete guide to diagnosing and resolving this error.

What Does This Message Actually Mean?

Windows 11 uses a set of hardware-backed security features to protect against firmware attacks, credential theft, and malicious code running below the operating system. When Windows Security reports “Standard hardware security not supported,” it is not saying your PC is broken—it is saying that at least one of these core protections is missing or disabled:

TPM 2.0 (Trusted Platform Module) – a dedicated chip or firmware module that stores encryption keys and performs cryptographic operations.
Secure Boot – a UEFI feature that prevents unauthorized operating systems or bootkits from loading during startup.
Virtualization-Based Security (VBS) – uses the CPU’s virtualization extensions to isolate a secure region of memory from the normal operating system.
Hypervisor-Protected Code Integrity (HVCI) – a VBS feature that only allows signed, trusted drivers to run in kernel mode.

The message appears in the Device security section of Windows Security (Settings > Privacy & Security > Windows Security > Device security). It is a warning, not a fatal error—Windows 11 will still run, but your system is more vulnerable to certain attacks.

Why Does Windows 11 Require These Features?

Microsoft made TPM 2.0 and Secure Boot mandatory for Windows 11 to raise the baseline security across all PCs. The reasoning is straightforward: many modern attacks exploit the boot process or steal credentials from memory. By requiring hardware roots of trust, Windows 11 can better protect against:

Bootkits and rootkits that load before the OS.
Password theft from memory (via credential guard).
Driver vulnerabilities that let malware run in kernel mode.
Firmware attacks that persist even after reinstalling Windows.

If your PC does not support these features, it likely predates 2016 or uses a low-end CPU that lacks the necessary instructions. However, in many cases the hardware is capable, but the features are simply turned off in the firmware settings.

Step-by-Step Fix: Enable the Missing Features

Before buying anything, check if your PC actually supports these features. Most PCs from 2016 onward do, but the firmware may have them disabled by default. Follow these steps:

Open Windows Security – Go to Settings > Privacy & Security > Windows Security > Device security. Look for the “Security processor” and “Secure Boot” sections. Note which ones say “Not supported” or “Off”.
Enter your UEFI/BIOS – Restart your PC and press the key shown on the boot screen (often Del, F2, F10, or Esc). If you are not sure, check your motherboard or laptop manual.
Enable TPM – Look for a setting named “Intel Platform Trust Technology (PTT)” on Intel systems or “AMD Platform Security Processor (PSP)” on AMD systems. Set it to “Enabled”. This is the firmware-based TPM 2.0.
Enable Secure Boot – Find “Secure Boot” under the Boot or Security tab. Set it to “Enabled”. If it is grayed out, you may need to set a BIOS password or switch from Legacy/CSM to UEFI mode first.
Save and exit – Press F10 to save changes and restart. Windows will boot normally.
Re-check Windows Security – After booting, go back to Device security. The message should change to “Your device meets the requirements for standard hardware security” or similar.

If you cannot find these settings, consult your PC manufacturer’s support page or manual. The exact menu names vary widely between brands.

What If the Features Are Missing Entirely?

If your CPU or motherboard truly lacks TPM 2.0 or Secure Boot support, you have a few options:

Add a discrete TPM 2.0 module – Many desktop motherboards have a TPM header (usually labeled “TPM” or “SPI TPM”). You can buy a TPM 2.0 module that matches your motherboard model and install it. This is a physical hardware upgrade.
Replace the motherboard/CPU – For very old PCs, this is the only way to get full support. This is a major upgrade and may not be worth it for an old machine.
Use a bypass – There are unofficial registry hacks that let you install Windows 11 on unsupported hardware. This is not recommended because you will not receive security updates and the system may be unstable.

Before buying a TPM module, check if your CPU has firmware TPM (Intel PTT or AMD PSP) that can be enabled in BIOS. Many users mistakenly think they lack TPM when it is actually just disabled.

Common Misconceptions and Pitfalls

There are several misunderstandings about this error that lead people to wrong fixes:

“My PC is too old” – Not necessarily. Even some 2015-era CPUs support firmware TPM. Check the official Microsoft list of supported CPUs, but note that some CPUs on the list still need TPM enabled.
“TPM is a separate chip I must buy” – Most modern CPUs include a firmware TPM. You only need a discrete module if your CPU is very old or the firmware TPM is disabled and cannot be enabled.
“Enabling Secure Boot will break my PC” – It can, if you are using a Linux distribution or a custom bootloader that does not support Secure Boot. But for a standard Windows installation, it is safe.
“The message means I need to reinstall Windows” – No. Reinstalling will not help if the features are disabled in firmware. The fix is in the BIOS, not the OS.
“I can ignore it” – You can, but you lose important protections. If you use your PC for banking or work, it is worth fixing.

How to Verify the Fix Worked

After enabling the features, you should verify that Windows 11 recognizes them correctly:

Open Windows Security > Device security.
Under “Security processor”, click Security processor details. It should show TPM version 2.0 and a spec version of 1.16 or higher.
Under “Secure Boot”, it should say “Secure Boot is on”.
Under “Core isolation”, check that “Memory integrity” is enabled. If it is not, click “Core isolation details” and turn it on. This requires a restart.

If the message persists, try the following:

Update your BIOS/UEFI firmware to the latest version. Manufacturers often add TPM support or fix Secure Boot settings in updates.
Reset your BIOS to defaults (look for “Load Optimized Defaults”). This can re-enable hidden security features.
Check if your storage drive is set to UEFI mode. If your disk is formatted as MBR and you are using Legacy BIOS mode, Secure Boot cannot be enabled. You would need to convert the disk to GPT and switch to UEFI, which is a more advanced procedure.

Frequently Asked Questions

Can I install Windows 11 without TPM 2.0?

Officially, no. Microsoft requires TPM 2.0 for all Windows 11 installations. There are unofficial workarounds that bypass the check during installation, but they are not supported and you will not receive security updates. It is safer to enable TPM in your BIOS or upgrade your hardware.

What is the difference between TPM and Secure Boot?

TPM is a cryptographic module that stores keys and attests to the integrity of the system. Secure Boot is a firmware feature that verifies the digital signature of the bootloader and kernel before allowing them to run. They work together: Secure Boot prevents malicious code from starting, and TPM protects encryption keys and provides a trusted measurement of the boot process.

Why does my PC say TPM is not supported even though it has a TPM chip?

This usually happens when the TPM is disabled in the BIOS, or when the system is running in legacy BIOS mode instead of UEFI. Check your BIOS settings for TPM (or Intel PTT/AMD PSP) and enable it. Also ensure your disk is GPT and you are booting in UEFI mode.

Will enabling Virtualization-Based Security slow down my PC?

VBS can cause a small performance hit, typically 5-10% in gaming or heavy workloads, because it adds a hypervisor layer. For most users, the security benefit outweighs the minor slowdown. You can turn off Memory Integrity if you need maximum performance, but the rest of VBS will still be active.

Is it safe to buy a cheap TPM 2.0 module from online marketplaces?

Be cautious. TPM modules are model-specific; a module for one motherboard may not work on another. Also, counterfeit modules may not have the correct firmware or may fail during the TPM initialization process. Buy from a reputable seller and confirm compatibility with your motherboard model.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →