Reports are mounting that Microsoft’s latest Windows 11 feature update, version 24H2, is being offered to PCs that clearly fail the company’s own minimum hardware requirements—including devices with TPM 2.0 disabled or absent entirely. This anomaly, observed across both consumer notebooks and enterprise-managed fleets, directly contradicts Microsoft’s repeated public insistence that TPM 2.0 is a “non-negotiable” pillar of Windows 11 security. The disconnect between Microsoft’s firm policy and real-world upgrade behavior has left IT administrators and home users questioning whether the offer is a bug, a silent policy shift, or an unintended consequence of firmware updates.

Microsoft itself has been unequivocal. In a December 2024 blog post, Steven Hosking, a senior product manager, declared: “TPM 2.0 is a non-negotiable standard for the future of Windows.” The company explained that a hardware TPM is essential for enabling features like Credential Guard, Windows Hello for Business, BitLocker drive encryption, and Secure Boot—all cornerstones of the modern Windows security baseline. Hosking emphasized that TPM 2.0 “plays a crucial role in enhancing identity and data protection,” and that it helps future-proof the OS as AI capabilities evolve. This stance was reinforced by Microsoft’s tightening of compatibility checks in the 24H2 update itself, which now mandates CPU support for SSE4.2 and has removed previously known registry workarounds for bypassing hardware checks.

Despite that hard line, independent evidence gathered since spring 2025 tells a different story. Community forums, tech outlets, and a widely circulated German blog post have documented cases where Windows Update pushed the 24H2 upgrade to machines with TPM deliberately disabled in UEFI/BIOS settings. Some reports involve consumer Lenovo IdeaPad models; others describe corporate PCs managed via WSUS or Windows Update for Business, where administrators had expected strict control over feature updates. In several instances, the upgrade appeared without explicit admin consent, raising alarms about the integrity of deployment pipelines.

The Importance of TPM 2.0

A Trusted Platform Module is a dedicated hardware component—either a discrete chip or firmware-based (fTPM via Intel PTT or AMD’s equivalent)—that securely stores cryptographic keys and performs isolated cryptographic operations. Windows 11 leverages TPM 2.0 to bind core protections:
- BitLocker encryption uses the TPM to seal encryption keys, preventing offline attacks.
- Windows Hello stores biometric and PIN credentials within the TPM’s shielded environment.
- Virtualization-based security (VBS) and Hypervisor-Protected Code Integrity (HVCI) rely on the TPM for attestation and key protection.
- Secure Boot ensures the boot chain’s integrity by validating digital signatures before loading system code.

Without TPM 2.0, these safeguards are weakened or become unavailable. Microsoft’s official documentation states that unsupported configurations may not receive all future updates, potentially exposing users to unpatched vulnerabilities. This is why the company has consistently pointed consumers to its PC Health Check tool and stressed that only CPUs released from 2018 onward are formally supported.

Reports from the Field: Unsupported PCs Getting the Offer

The first clear signal came from a German-language tech blog that shared screenshots of a Windows 11 upgrade notification on a laptop with TPM 2.0 disabled. The article, later picked up by mainstream outlets, triggered a wave of similar accounts across Reddit, Microsoft Answers, and enterprise IT forums. Administrators described devices moving toward 24H2 in environments where feature updates had been deferred via Group Policy, and some noted that the offers appeared shortly after an OEM firmware update was installed through Windows Update.

These independent reports align on key details:
- The upgrade was offered through the standard Windows Update channel, not via a manual ISO or a bypass tool.
- Affected machines spanned consumer-grade laptops and business-class desktops from multiple OEMs.
- In managed environments, admins reported that WSUS synchronization logs initially showed no pending feature update, yet the offer materialized on endpoints.

Microsoft’s own release-health status page for Windows 11 24H2 acknowledges the use of safeguard holds—temporary blocks that prevent a feature update from being offered when known compatibility issues exist. The existence of these holds demonstrates Microsoft’s granular control over rollout targeting, making it all the more surprising that devices lacking TPM 2.0 would slip through.

Why Is This Happening? Possible Explanations

No official explanation has been provided, but several plausible technical mechanisms could produce the observed behavior:

  1. Detection logic bugs: The server-side eligibility check that matches devices to update offers may have a flaw. If the detection code misinterprets TPM status—perhaps confusing a disabled TPM with an absent one—it could incorrectly flag an incompatible device as eligible. Past Windows Update rollouts have suffered analogous glitches, making this a top suspect.

  2. OEM firmware updates enabling fTPM silently: Many users have reported that a recent UEFI firmware update, pushed by the manufacturer via Windows Update, toggled the fTPM setting from disabled to enabled without any user intervention. After such a firmware change, the device suddenly passes the compatibility check, prompting the 24H2 offer. In some cases, users later discovered that TPM was active in “Device Security” settings despite never having touched the BIOS.

  3. Undisclosed policy experimentation: Microsoft occasionally uses A/B testing or staged flighting to assess upgrade behavior. It’s conceivable that, with Windows 10 end-of-support looming in October 2025, the company is quietly expanding the eligibility window to accelerate migration. However, no public documentation supports this theory, and Microsoft’s official messaging remains unchanged.

  4. Residual installer bypass paths: Although Microsoft removed the well-known AllowUpgradesWithUnsupportedTPMOrCPU registry key and locked down the standard setup process, some installation paths—such as the /product server trick used in Windows Server setup or third-party tools like Flyby11—continue to work. It is possible that a subtle variation in how Windows Update triggers the upgrade could invoke different internal checks, inadvertently skipping the TPM requirement.

The Risks of Running Windows 11 Without TPM 2.0

Installing Windows 11 on hardware that lacks TPM 2.0 is possible in many situations, but it is not a supported configuration. The implications are significant:

  • Security degradation: Without the hardware root of trust, BitLocker keys may be stored in software and become more vulnerable to extraction. Credential Guard and VBS lose their hardware-backed attestation, potentially exposing credentials and sensitive data to sophisticated malware.
  • Update uncertainty: Microsoft’s policy warns that unsupported systems might not receive critical security patches in the future. While no such exclusions have yet been enforced, the risk is real.
  • Stability and driver issues: Unsupported CPUs and chipsets may lack proper driver support for Windows 11 24H2, leading to crashes, peripheral failures, or performance regressions. Safeguard holds exist specifically to prevent these outcomes.
  • Compliance violations: For enterprises, running unsupported OS configurations can breach regulatory requirements (HIPAA, GDPR, PCI-DSS) that mandate up-to-date, supported software.

What Should Users and Admins Do?

Until Microsoft clarifies the situation, the cautious path is to treat any unsolicited upgrade offer as a potential problem:

For home users:
- Do not accept the 24H2 upgrade if you know your device lacks TPM 2.0. Check TPM status by typing tpm.msc in the Start menu or navigating to Settings → Privacy & Security → Device Security.
- Create a full system backup before any major update.
- If you genuinely want Windows 11, first enable TPM in UEFI (if available), update the firmware from your OEM’s support site, and then run the upgrade. Avoid registry or ISO-based bypasses unless you accept the unsupported state.

For IT administrators:
- Immediately audit update history on all managed endpoints. Look for entries indicating a “Feature update to Windows 11, version 24H2” was offered or installed.
- Tighten update controls: use Group Policy or Windows Update for Business (WUfB) to defer feature updates for up to 365 days, or pause them entirely while you investigate.
- Verify WSUS/SCCM classification settings to ensure that feature updates are not being published to the wrong rings. Check whether recent firmware updates via Windows Update could have changed TPM status on fleet devices.
- Monitor Microsoft’s release-health dashboard for safeguard hold IDs that might explain anomalous behavior.

For OEMs and partners:
- Communicate clearly when a firmware update changes TPM state or other security-platform settings. Such changes directly alter a device’s upgrade eligibility and should be documented.

The Bigger Picture: Policy vs. Reality

The incident exposes a growing tension between Microsoft’s security-first messaging and the practical challenge of migrating hundreds of millions of Windows 10 machines. With only months left until Windows 10’s end-of-support, the pressure to move users onto Windows 11 is immense. A quiet relaxation of requirements would certainly accelerate adoption, but it would also undermine the very security narrative Microsoft has built over three years.

For now, the evidence points to a messy middle ground: Microsoft insists TPM 2.0 is mandatory, yet its own update machinery appears to be ignoring that rule in certain cases. Whether this is a transient bug or an intentional experiment, the burden falls on users and administrators to remain vigilant. The safest assumption remains that TPM 2.0 is a hard requirement for full Windows 11 support, and any upgrade on non-compliant hardware is a risk that should be avoided until Microsoft provides unambiguous guidance.