# Windows 11 install preflight: UEFI, Secure Boot, TPM 2.0 and 10 checks

> Run these ten checks before you boot Windows 11 setup: firmware mode, Secure Boot, TPM, CPU support, disk, network, backup, licence and recovery.

**Tested on**

- Build: 26300.9457
- Edition: Pro (26H2)
- Architecture: x64
- Evidence: E2
- Verified: 2026-10-28
- Test machine: PVE 9.2.2 VM 361; OVMF, vTPM 2.0, Secure Boot; Windows 11 Pro 26H2

## The short answer

Windows 11 setup fails for boring reasons: firmware in Legacy mode, Secure Boot off, TPM disabled, an unsupported CPU, a disk in the wrong mode, or no network driver for OOBE. Check these **before** you delete a partition.

msinfo32 on lab VM 361: UEFI, Secure Boot On, Windows 11 Pro. This is the state to reproduce before setup, not after. Click to open full size.

## The ten checks

| # | Check | Pass condition | How to check |
|---|---|---|---|
| 1 | Firmware mode | UEFI, not Legacy/CSM | `msinfo32` → BIOS Mode |
| 2 | Secure Boot | On and capable | `msinfo32`, firmware setup |
| 3 | TPM | 2.0, enabled, ready | `tpm.msc`, `Get-Tpm` |
| 4 | CPU | On the supported list | Vendor + Microsoft list |
| 5 | RAM | 4GB minimum, 8GB+ practical | Task Manager / `systeminfo` |
| 6 | System disk | 64GB minimum, 128GB+ practical | Disk Management |
| 7 | Disk mode | AHCI/NVMe, not RAID without driver | Firmware storage settings |
| 8 | Network | Windows can see Ethernet/Wi-Fi | Device Manager, OOBE test |
| 9 | Backup | Files and BitLocker key saved elsewhere | Your backup, not the same disk |
| 10 | Recovery | USB media and a way to boot it | Test before wiping |

## Firmware, Secure Boot and TPM

- **UEFI vs Legacy.** Windows 11 requires UEFI. If `msinfo32` says Legacy, converting an existing installation is possible but risky; a clean install is usually the honest path.
- **Secure Boot.** “Capable” is not “enabled”. Enable it in firmware. If you dual boot Linux, plan the MOK/shim path before you turn it on.
- **TPM 2.0.** `tpm.msc` should say the TPM is ready. If it says “not present”, enable the firmware TPM (Intel PTT / AMD fTPM) or install the discrete module. Do not use a bypass script.
- **Virtual machines.** Use OVMF, a vTPM 2.0 and Secure Boot. A BIOS/SeaBIOS VM with no TPM is not a Windows 11 reference machine.

```powershell
Get-Tpm | Select-Object TpmPresent, TpmReady, TpmEnabled, ManufacturerName
Confirm-SecureBootUEFI
```

`Confirm-SecureBootUEFI` can fail if you are not on UEFI; that failure is itself a useful signal.

## Disk and driver checks

1. Open **Disk Management** and note the disk number. Setup’s “Disk 0” is not always the disk you think.
2. Check whether the controller is Intel RST/RAID. If Windows Setup cannot see the disk, load the OEM storage driver rather than switching modes blindly.
3. For a VM, attach VirtIO drivers **before** setup if you use a VirtIO disk; otherwise Setup will show no disk.
4. Check the network adapter. OOBE may ask for a connection; a missing Wi-Fi driver can strand you.

## What to prepare before booting

- A full backup of files, browser profiles and licence keys.
- The BitLocker recovery key, saved outside the machine.
- The Windows ISO **and** a second copy of the install media if possible.
- The OEM storage/network driver on a second USB.
- The Microsoft account or local-account decision (see the first-hour page).

> **Caution: Do not “fix” unsupported hardware with a script**
>
> TPM/Secure Boot bypasses move the machine outside the supported configuration. We do not document them. If the hardware is below the floor, stay on a supported build or replace it.

## Lab note

VM 361 uses OVMF, vTPM 2.0 and Secure Boot, and reports UEFI/Secure Boot On. That is why the clean install can follow the supported path. A VM without a TPM is useful for other tests, but not for “Windows 11 supported” evidence.

## Hardware requirements and firmware

The install path above assumes the machine can actually run Windows 11. If you are checking a machine before wiping it — or you are about to change TPM/Secure Boot/CSM — read these first:

- [Hardware requirements by Windows version](https://windows.homes/en/hardware/buy/os-hardware-matrix/) — one matrix for 26H2, LTSC and Server.
- [UEFI settings that change how Windows behaves](https://windows.homes/en/hardware/build/uefi-settings/) — and the order to change them.
- [Used PC checklist](https://windows.homes/en/hardware/buy/used-checklist/) — when the machine is not new.

## Sources

- [Microsoft — Windows 11 requirements](https://learn.microsoft.com/en-us/windows/whats-new/windows-11-requirements)
- [Microsoft — TPM fundamentals](https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/tpm-fundamentals)
- [Microsoft — UEFI/GPT-based hard drive partitions](https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/configure-uefigpt-based-hard-drive-partitions)

---

Source: https://windows.homes/en/windows/install/preflight/