Windows 10 free security updates ended on October 14, 2025. For the roughly quarter of Windows users still on the aging OS, the official upgrade path to Windows 11 is blocked by Microsoft’s strict hardware requirements—most commonly a missing Trusted Platform Module (TPM) 2.0 or an unsupported processor. But that doesn’t mean you have to buy a new PC today. Well-documented workarounds exist, and they use Microsoft’s own installation media. The catch? Those bypasses come with real, long-term trade-offs that every user should understand before clicking “Install.”

The Windows 11 Compatibility Cliff

Windows 11 demands three things Windows 10 never did: a 64-bit processor on Microsoft’s supported list, UEFI firmware with Secure Boot turned on, and TPM 2.0. The PC Health Check app spells out which of these your machine fails. For most older PCs, the TPM check is the blocker—but many desktop and laptop motherboards have a firmware TPM (fTPM on AMD, Intel PTT on Intel) that’s simply disabled in the BIOS. Turning it on and enabling Secure Boot is often all it takes to go from “incompatible” to “compatible.”

However, even when a PC passes those checks, a newer class of roadblock has appeared with Windows 11 version 24H2. Microsoft now enforces that the CPU supports the POPCNT and SSE4.2 instructions. These are low-level features you can’t fake with a setting or a registry tweak. If your processor lacks them, the operating system simply won’t boot—regardless of any bypass you attempt.

The Official Upgrade Paths for Supported PCs

For machines that do meet the requirements, Microsoft provides three free, supported ways to move from Windows 10 to 11. All preserve your files, apps, and importantly, your entitlement to future updates.

  • Windows Update – The simplest route. Go to Settings > Update & Security > Windows Update, hit Check for updates, and if the staged offer is ready you’ll see “Upgrade to Windows 11.” Click through, and the upgrade runs in the background.
  • Windows 11 Installation Assistant – If Windows Update hasn’t offered the upgrade yet, download the assistant from Microsoft’s Download Windows 11 page, run it, accept the terms, and it will download and install Windows 11 while keeping your apps and settings.
  • Media Creation Tool or ISO – For clean installs or upgrades on multiple PCs, use the Media Creation Tool to build a USB installer, or download the multi-edition ISO directly, mount it, and run setup.exe. Choose “Keep personal files and apps” when prompted.

These methods are safe, predictable, and fully backed by Microsoft. But they only work if your PC passes the compatibility check.

When Your PC Is Flagged ‘Incompatible’: The Bypass Options

If the PC Health Check app shows a red X, two widely used community techniques can still get you to Windows 11. Both rely on official Microsoft ISOs and modify the installer’s behavior, not the operating system itself. They are unsupported, and Microsoft warns that unsupported installs “won’t be entitled to receive updates.” In practice, many machines have continued to get cumulative updates, but that’s not guaranteed.

Registry Override for In-Place Upgrades (MoSetup)

A single DWORD value tells Windows Setup to ignore CPU and TPM checks. Open regedit as administrator, navigate to HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup (create the MoSetup key if it doesn’t exist), add a 32-bit DWORD called AllowUpgradesWithUnsupportedTPMOrCPU, and set it to 1. Then mount the Windows 11 ISO or run the Installation Assistant and start the upgrade. The process keeps your apps and files, just like a normal in-place upgrade. The limitation: this bypass works only for in-place upgrades, not clean installs from bootable media.

Rufus: A Relaxed USB Installer

Rufus, the popular open-source tool for creating bootable USB drives, includes an option to strip the hardware checks during the creation process. Download the official Windows 11 ISO from Microsoft, download Rufus from its official site, plug in a USB drive (at least 8 GB), select the ISO, and before writing, check “Remove requirement for 4GB+ RAM, Secure Boot and TPM 2.0.” The resulting USB drive can then be used to perform an in-place upgrade by running setup.exe from within Windows 10, or to do a clean install from boot. Rufus automates the same registry modifications and boot configuration changes that more technical users once made manually.

Both methods sidestep the TPM, Secure Boot, and RAM checks. Neither can add missing CPU instruction support—so if your processor fails the POPCNT/SSE4.2 requirement, these tricks won’t help.

The Hidden Costs of Bypassing Windows 11 Requirements

Skipping the hardware checks isn’t just a one-time hack; it changes your long-term maintenance posture. Here’s what you’re signing up for:

  • Update uncertainty: Microsoft’s position is unambiguous—unsupported installs aren’t entitled to updates, including security patches. While cumulative updates have often continued to appear, the company can block them at any time, and safeguard holds have been observed on certain unsupported configurations.
  • Watermark and nagging: Once installed, the desktop displays a “System requirements not met” watermark, and the Settings app regularly nags you about the incompatibility.
  • Driver and firmware mess: Older hardware may not have Windows 11–compatible drivers for audio, networking, or graphics. You might need to hunt down legacy drivers, and some features may never work correctly.
  • Weakened security: TPM 2.0 and Secure Boot anchor modern security features like virtualization-based security (VBS), hypervisor-protected code integrity (HVCI), and measured boot. Bypassing those checks removes those hardware-backed protections—even if your device technically has a TPM that isn’t being used properly.
  • No vendor support: OEMs and Microsoft support won’t help you if something breaks while running Windows 11 on unsupported hardware.

How We Got Here: Microsoft’s Security Baseline Push

Microsoft introduced the hardware requirements with the Windows 11 announcement in June 2021, framing them as necessary for the “new era of security” in a hybrid-work, cyberthreat-heavy world. TPM 2.0 enables seamless BitLocker encryption, Windows Hello biometrics, and tamper-resistant credential storage. Combined with Secure Boot, it ensures the PC boots with trusted code. At the time, the move sparked outcry—many capable PCs from 2017 or earlier found themselves locked out.

Over the subsequent years, Microsoft has only tightened the requirements. Windows 11 22H2 increased the number of processor generations required, and the 24H2 update introduced the POPCNT/SSE4.2 enforcement. Meanwhile, Windows 10’s end-of-support date drew closer. In response, Microsoft announced the Extended Security Updates (ESU) program, which lets consumers pay for an additional year of critical patches on their existing Windows 10 machines—a lifeline for those who need more time before a hardware upgrade.

What to Do Now: A Practical Decision Guide

Your next move depends on your machine’s actual capabilities and how you use it.

If the PC Health Check says “compatible”

You’re in the best position. Use Windows Update, the Installation Assistant, or the Media Creation Tool. This keeps your system fully supported, with no surprises.

If the only blockers are TPM 2.0 or Secure Boot

Before trying any bypass, enter your UEFI/BIOS settings (usually by pressing F2, Del, or Esc during startup). Look for a “Security” or “Advanced” tab. Enable Intel Platform Trust Technology (PTT) or AMD fTPM, and set Secure Boot to “Enabled.” Save, reboot, and run the PC Health Check again. Most modern motherboards released after 2015 support these features, and turning them on often resolves the issue.

If your CPU is unsupported but has POPCNT/SSE4.2

You have a choice. The registry or Rufus bypass will work, and you’ll get Windows 11 today. But you accept the risks listed above. This path makes sense for secondary PCs used for light browsing or hobby projects, or as a short-term bridge while you save for a new machine. Always take a full disk image backup first, and understand you may need to roll back if updates eventually break.

If your CPU lacks POPCNT/SSE4.2

Don’t bother. No bypass can overcome a missing hardware instruction set. Your realistic options are: stay on Windows 10 with ESU, switch to a Linux distribution, or replace the computer.

For IT admins managing fleets

Regulatory compliance and security audits generally require supported, updatable systems. Bypasses aren’t suitable for production environments. Instead, evaluate the ESU program for Windows 10, plan a hardware refresh, or consider Windows 11 virtual desktops in Azure for legacy-application needs.

For developers and testers

If you need a Windows 11 sandbox on older hardware without touching your main OS, a virtual machine with Windows 11 Enterprise evaluation or a clean install on a spare drive using the Rufus method is a common approach. Just don’t rely on that machine for day-to-day sensitive work.

Outlook: The Road Ahead for Older Hardware

Microsoft’s trajectory is clear: the hardware bar for Windows will continue to rise. Future feature updates may introduce additional requirements, and the company could begin enforcing update blocks for unsupported installations more aggressively. Meanwhile, PC component prices remain volatile, meaning a full system replacement isn’t a trivial expense.

For now, the bypass methods work—but they’re a holding pattern, not a permanent solution. If you go that route, mark a calendar reminder for 12 months out to reassess. By then, you’ll want a definitive path back to fully supported, secure hardware.