October 2025 will mark the end of mainstream security updates for Windows 10, thrusting an estimated 240 million PCs worldwide into a precarious limbo. For the first time, a Windows feature upgrade enforces a rigid hardware baseline—TPM 2.0, UEFI Secure Boot, and an approved CPU—that disqualifies a substantial chunk of otherwise capable machines. Yet the free upgrade to Windows 11 remains available, and with the right approach, even owners of officially incompatible hardware can make the leap. This guide distills every supported path from Microsoft, the single dominant unsupported workaround, and the risks you must honestly weigh before you click install.

Check Compatibility First: The PC Health Check App

Before touching any upgrade tool, run Microsoft’s PC Health Check app. It’s the authoritative arbiter of eligibility, testing for TPM 2.0 presence, Secure Boot state, processor support, RAM, and storage. Download it from the official support page, run it, and note exactly which requirement—if any—blocks your machine. A green “eligible” message clears you for all three official paths. A red “incompatible” verdict means you’ll either need a firmware tweak, a hardware change, or the unsupported route.

The Quick Hardware Checklist

  • TPM 2.0: Firmware TPM (fTPM) on modern CPUs or a discrete module must be enabled in UEFI. Many AMD systems label this “fTPM”; Intel calls it “PTT.”
  • UEFI Secure Boot: Legacy BIOS mode disqualifies you immediately. Confirm your system disk uses GPT and boot is set to UEFI.
  • Supported CPU: Microsoft maintains a strict list of Intel (8th gen and newer, plus select 7th gen), AMD (Ryzen 2000 and newer), and Arm processors. Being off the list is a hard block for official upgrades.
  • RAM & Storage: 4 GB and 64 GB minimum; real-world usability demands more.
  • DirectX 12 / WDDM 2.0 graphics: Nearly any GPU from the last decade meets this, but older integrated graphics may not.

Three Official, Free Paths for Eligible PCs

When your system passes the check, you have three no-cost methods that preserve updates, support, and warranty. All are in-place upgrades that keep files and apps unless you deliberately perform a clean install.

1. Windows Update—The Zero-Friction Option

If Microsoft’s phased rollout has reached your device, Windows 11 appears inside Settings > Update & Security > Windows Update as a “Download and install” prompt. This is the safest route: it handles compatibility checks silently, downloads the full feature update in the background, and minimizes disruption. The catch: staged rollouts mean you may not see the offer for weeks or even months after your hardware is eligible.

Advantages: No external media, no manual steps beyond accepting the prompt, and guaranteed official support.

Limitation: Rollout timing is opaque; impatient users should consider the Installation Assistant if they meet requirements.

2. Windows 11 Installation Assistant—Guided and Immediate

When Windows Update remains silent, the Installation Assistant from Microsoft’s Download Windows 11 page forces the upgrade. Download the executable, run it, accept the license, and the tool checks compatibility, downloads the necessary files, and launches the upgrade. You can continue using the PC during the process; a single reboot finishes the job. This is ideal for anyone who wants a hand-holding upgrade without building media.

Key Steps:
1. Visit Microsoft’s official download page and click Download now under the Windows 11 Installation Assistant section.
2. Run Windows11InstallationAssistant.exe.
3. Click Accept and install.
4. Restart within the 30-minute countdown.

Downside: It upgrades only the current machine and doesn’t create reusable installation media.

3. Media Creation Tool and ISO—Maximum Flexibility

For enthusiasts, IT pros, or anyone upgrading multiple machines, the Media Creation Tool generates a bootable USB drive (8 GB minimum) or an ISO file. This lets you perform a clean installation—often the best cure for years of accumulated system cruft—or upgrade in-place by running setup.exe from within Windows. The tool itself is downloaded from the same page and walks you through language, edition, and media selection.

Power-user tips:
- If mounting an ISO, right-click and select Mount, then run setup.exe.
- During the upgrade, you can choose to keep personal files and apps, keep only personal files, or nothing (clean install).
- A single USB crafted with the Media Creation Tool can update an unlimited number of compatible PCs.

Why this method matters: It’s the only official way to stockpile installation media for offline use or emergency recovery, and it’s the gateway to the unsupported bypass if you later need it.

The Unsupported Route: Rufus and the Registry Bypass

For the millions of PCs that fail the official checks—typically older CPUs lacking TPM 2.0 or machines stuck in legacy BIOS mode—the community has coalesced around two workarounds. Both are explicitly unsupported by Microsoft, and neither guarantees future updates or system stability.

Rufus: The Sledgehammer Approach

The free, open-source tool Rufus can write the official Windows 11 ISO to a USB drive while stripping out the checks for TPM 2.0, Secure Boot, and minimum RAM. When you run setup.exe from that USB on the target machine, the installer no longer enforces those requirements.

Step-by-step summary:
1. Download the official Windows 11 ISO from Microsoft.
2. Launch Rufus and select the ISO.
3. Choose “Standard Windows installation” as the image option.
4. Click START. A pop-up offers the crucial checkbox: “Remove requirement for 4GB+ RAM, Secure Boot, and TPM 2.0.” Check it.
5. Rufus creates the patched media. Boot from it or run setup.exe inside Windows.

The Registry Tweak: A Lighter Touch

An alternative method creates a single registry key before launching an ISO-based upgrade. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup, create a DWORD named AllowUpgradesWithUnsupportedTPMOrCPU, and set it to 1. Then run setup.exe from the mounted ISO. This tells the installer to forgo hardware checks. It’s less transparent than Rufus but avoids rewriting installation media.

Microsoft’s Stance and the Real Risks

Microsoft does not mince words: “Installing Windows 11 on a device that does not meet Windows 11 minimum system requirements is not recommended.” Unsupported installs may carry a desktop watermark reminding users of the non-compliant state. More critically, Microsoft explicitly warns it “will not be entitled to receive updates, including but not limited to security updates.” While many unsupported systems have received cumulative patches in practice, there is no guarantee, and the company could cut off updates at any time.

Additionally, TPM 2.0 and Secure Boot are not arbitrary hurdles. TPM underpins Windows Hello, BitLocker key protection, and System Guard runtime attestation; removing it leaves hardware-rooted security on the table. Secure Boot defends against bootkits. Bypassing these weakens the platform’s resilience to firmware-level attacks.

Practical Risks, Trade-offs, and Mitigations for Unsupported Upgrades

Security and Updates

Without guaranteed patches, an unsupported Windows 11 installation becomes a zero-day magnet. Even if Microsoft continues delivering updates for now, the company’s policy gives it the right to block them. Enterprises should treat these configurations as non-compliant by default.

Mitigation: Maintain a rigorous backup routine independent of Windows. Consider a third-party endpoint protection suite, though it won’t replace missing OS-level mitigations.

Driver and Stability Issues

Older hardware may lack signed drivers for Windows 11’s driver model. Expect potential graphics glitches, broken sleep states, poor battery life on laptops, or non-functional audio and networking. Community forums are littered with reports of blue screens after forcing the upgrade on unsupported chipsets.

Mitigation: Check your OEM’s support page. Some manufacturers have released BIOS updates that enable fTPM and Secure Boot, turning an “incompatible” system into a fully eligible one. Always update the firmware before resorting to a bypass.

Warranty, Compliance, and Enterprise Risk

A company-issued laptop upgraded via Rufus will almost certainly violate IT policies and may fail compliance audits. For personal machines, it won’t void the hardware warranty on its own, but any troubleshooting the user performs while on an unsupported OS may be denied.

Alternatives When Upgrading Isn’t Viable

If your hardware is firmly blocked and you cannot accept the risks of an unsupported install, you have options that don’t involve a trip to the electronics recycler.

  • Buy a new Windows 11 PC: The surest path to long-term support. Trade-in and recycling programs can offset the cost. Modern systems also benefit from hardware-based security advances.
  • Extended Security Updates (ESU): Microsoft announced a consumer ESU program that will offer critical security patches for a fee, likely for up to three years. Pricing details remain sparse, but it’s a temporary bridge, not a permanent solution.
  • ChromeOS Flex: A lightweight, cloud-centric OS that installs on older laptops and desktops, turning them into Chromebook-like devices. Ideal for web browsing, email, and streaming, but incompatible with Windows desktop apps.
  • Linux distributions: Ubuntu, Linux Mint, or Fedora can breathe new life into aging hardware and receive regular security updates. The learning curve is real, and Windows-only software may require emulation or alternatives.
  • Cloud PCs (Windows 365): For organizations, offloading the desktop to Azure means the local device becomes a thin client. Consumer-oriented services are less common, but remote desktop solutions exist.

Pre-Upgrade Checklist for Every Path

No matter which method you choose, these steps are non-negotiable:

  1. Back up everything: A full system image (via Windows Backup and Restore or a tool like Macrium Reflect) plus a separate file copy to an external drive.
  2. Fully update Windows 10: Install all pending updates—cumulative, driver, and optional—to minimize intermediary conflicts.
  3. Update BIOS/UEFI firmware: A firmware update often resolves missing TPM or Secure Boot issues and improves overall compatibility.
  4. Have a rollback plan: Keep a Windows 10 recovery USB or installation media handy; the built-in rollback option (Settings > Update & Security > Recovery) works for only 10 days.
  5. Know your product key or Microsoft Account: Windows 11 activation should be automatic with a digital license, but have recovery options ready.

Method-Specific Quick Start

Windows Update / Installation Assistant (Supported, Easiest)

  • Run PC Health Check → green light.
  • Check Windows Update; if offered, click Download and install.
  • If not, download the Installation Assistant, run it, and restart.

Media Creation Tool / ISO (Flexible)

  • Download the Media Creation Tool or ISO from Microsoft.
  • Use an 8 GB+ USB for the tool, or mount the ISO and run setup.exe.
  • Choose to keep files and apps or go clean.

Unsupported Install with Rufus (Advanced, Risky)

  • Obtain the official Windows 11 ISO.
  • Run Rufus, check the bypass option, create USB.
  • Run setup.exe from the USB; accept the risk acknowledgments.
  • Plan a fallback to Windows 10 if stability suffers.

The Bottom Line

Windows 10’s countdown is real, and the upgrade landscape in 2025 is defined by a clear split: supported paths that keep you on the update track, and unsupported hacks that dangle Windows 11 in front of older hardware—with strings attached. For the majority whose PCs sail through the PC Health Check, opening Windows Update or launching the Installation Assistant is a 30-minute exercise with almost zero downside. For those stuck on the wrong side of the compatibility line, a BIOS update may be the simplest rescue before reaching for Rufus.

If you do go the unsupported route, you’re trading away guarantees: of updates, of driver compatibility, of the very hardware security that prompted these requirements in the first place. For a secondary machine used offline or for experimentation, that trade may be acceptable. For a daily driver holding sensitive data, the calculus should lean heavily toward a supported solution—even if it means investing in new hardware or subscribing to ESU as a bridge.

Whatever path you choose, prepare thoroughly. The difference between a smooth upgrade and a data-loss disaster is often a single full backup and 20 minutes of firmware updates. Microsoft won’t bend its requirements, but with the right preparation, you don’t have to leave a working PC behind.