Windows 11 Readiness Checker
Windows 10 stopped getting free security updates on 14 October 2025. Find out whether a PC can move to Windows 11, what to switch on if it's nearly there, and what your options are if it can't.
- Microsoft's processor lists
- TPM, UEFI and Secure Boot
- Nothing leaves your device
Check a PC
Enter what you know. The PowerShell check below can fill everything in for you.
Fill it in with PowerShell
On the PC you want to check, open PowerShell, paste this in and press Enter. It only reads information: it changes nothing and sends nothing anywhere.
- Right-click the Start button and choose Terminal (Admin) on Windows 11 or Windows PowerShell (Admin) on Windows 10. Running as administrator is only needed for the TPM line; everything else works in a normal PowerShell window.
- Copy the check below, paste it into the window (right-click pastes) and press Enter.
- Copy the lines it prints, from "Processor" to "TPM", and paste them into the box underneath.
# Windows 11 readiness check from osir.co.uk. Read-only: it only reads information and changes nothing.
$admin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
$cpu = Get-CimInstance Win32_Processor | Select-Object -First 1
$os = Get-CimInstance Win32_OperatingSystem
"Processor : $($cpu.Name.Trim()) ($($cpu.NumberOfCores) cores, $($cpu.MaxClockSpeed) MHz, $($cpu.AddressWidth)-bit)"
"Memory (RAM) : $([math]::Round((Get-CimInstance Win32_PhysicalMemory | Measure-Object Capacity -Sum).Sum / 1GB)) GB"
try {
$d = Get-Partition -DriveLetter $env:SystemDrive[0] -ErrorAction Stop | Get-Disk -ErrorAction Stop
"System disk : $([math]::Round($d.Size / 1e9)) GB, $($d.PartitionStyle) partitions"
} catch { "System disk : $([math]::Round((Get-CimInstance Win32_LogicalDisk -Filter "DeviceID='$env:SystemDrive'").Size / 1e9)) GB" }
"Firmware : $env:firmware_type"
$sb = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\State' -ErrorAction SilentlyContinue
"Secure Boot : $(if ($null -eq $sb) { 'not available' } elseif ($sb.UEFISecureBootEnabled -eq 1) { 'On' } else { 'Off' })"
"Windows : $($os.Caption) $($os.OSArchitecture), build $($os.BuildNumber)"
if ($admin) {
$t = Get-CimInstance -Namespace root/cimv2/Security/MicrosoftTpm -ClassName Win32_Tpm -ErrorAction SilentlyContinue
if ($t) { "TPM : version $(($t.SpecVersion -split ',')[0].Trim()), enabled: $($t.IsEnabled_InitialValue), activated: $($t.IsActivated_InitialValue)" }
else { "TPM : none found (it may be turned off in the firmware settings)" }
} else { "TPM : run PowerShell as administrator to see this line" }
- Processor, memory, disk, firmware and Secure Boot work in any PowerShell window. Secure Boot is read from the registry, the same place Windows Security gets it from.
- TPM needs an administrator window, because Windows only lets administrators read the TPM. Microsoft's own
Get-TpmandConfirm-SecureBootUEFIcommands also need administrator rights. - Not allowed to run PowerShell on a work PC? Ask your IT team, or use the manual steps further down.
Result
What to do next
- Back up your files first: OneDrive, an external drive, or both.
- On Windows 10, go to Settings > Update & Security > Windows Update. If the Windows 11 upgrade is offered, choose Download and install. It's free and keeps your files and apps.
- Not offered yet? Microsoft's Windows 11 Installation Assistant (on microsoft.com) upgrades the PC in place. Run Microsoft's PC Health Check app first for a final check.
- The PC needs to be on Windows 10 version 2004 or later to upgrade this way.
- Already on Windows 11? Make sure it's on version 25H2 or later: version 24H2 Home and Pro stopped getting updates on 13 October 2026.
What to do next
- Make the changes listed above in the PC's firmware settings. See how to turn on TPM and Secure Boot below.
- Back in Windows, run Microsoft's PC Health Check app again, or the PowerShell check above, to confirm.
- Then upgrade through Settings > Update & Security > Windows Update.
What to do next
The processor is supported, so a small upgrade may be worth it. Check the PC maker's support site for which memory or drive fits. If the upgrade isn't possible or costs too much, see the options for PCs that can't run Windows 11 below.
What to do next
Download Microsoft's free PC Health Check app on the PC and run it. It knows the exact rules Windows Update uses. If it says the PC can't run Windows 11, see the options below.
Your options
This processor can't run current Windows 11 at all. From version 24H2, Windows 11 won't start without the SSE4.2 and POPCNT processor instructions, which this chip doesn't have. Workarounds that skip the other checks don't get past this one.
- Extended Security Updates (ESU) for Windows 10: buys time. Home users get security updates until 12 October 2027, free if you sync your PC settings with a Microsoft account, for 1,000 Microsoft Rewards points, or for a one-off payment of about $30 in your local currency. Look for Enroll now in Windows Update. Businesses pay per device per year, for up to three years.
- Replace the PC: the safest long-term option. Back up first, then wipe the old drive before you sell, donate or recycle it.
- ChromeOS Flex or Linux: free systems that run well on older PCs and still get security updates. ChromeOS Flex suits web-based work; Ubuntu or Linux Mint suit people who want a full desktop. Try either from a USB stick before installing, and check your apps and printer work.
- Unsupported Windows 11 installs: possible with workarounds, but Microsoft says these PCs "aren't guaranteed to receive updates", may malfunction, show a watermark, and damage isn't covered by the maker's warranty. Not suitable for business PCs or for Cyber Essentials.
For businesses: Cyber Essentials fails any device running an unsupported operating system, unless paid ESU is active. Check every PC and phone with our End-of-Support Checker.
How to find these details without PowerShell
- Processor, memory, BIOS mode and Secure Boot: press Windows key + R, type
msinfo32and press Enter. Look for Processor, Installed Physical Memory (RAM), BIOS Mode (UEFI or Legacy) and Secure Boot State. - TPM: open Windows Security, then Device security. If you see Security processor, open its details and check the Specification version is 2.0. If it's missing, the TPM is probably turned off. Or press Windows key + R and type
tpm.msc(needs an administrator). - Drive size: Settings > System > Storage, or right-click the C: drive in File Explorer and choose Properties.
- Microsoft's own check: the free PC Health Check app from microsoft.com gives a yes or no and says what's missing.
How to turn on TPM and Secure Boot
- Open the firmware settings: on Windows 10, go to Settings > Update & Security > Recovery (on Windows 11, Settings > System > Recovery), then Restart now under Advanced startup. Choose Troubleshoot > Advanced options > UEFI Firmware Settings > Restart. Or press the maker's key while the PC starts, often F2, F10, F12 or Delete.
- TPM: usually under Security or Advanced. Look for Intel PTT (Platform Trust Technology), AMD fTPM, AMD CPU fTPM, Security Device Support or TPM Device, and set it to Enabled.
- UEFI: if the boot mode is Legacy or CSM, convert the disk first (see below), then set Boot Mode to UEFI and turn off CSM.
- Secure Boot: usually under Boot or Security. It only appears once the PC is in UEFI mode.
- Save and exit (often F10). Ask your IT support or the PC maker if you're unsure: their support sites have model-specific steps.
Switching from Legacy BIOS to UEFI
- Windows installed in Legacy mode uses an MBR disk, which won't start in UEFI mode. Convert the disk to GPT before switching the firmware to UEFI.
- Microsoft's MBR2GPT tool does this without wiping files. Back up first, then in an administrator Command Prompt run
mbr2gpt /validate /allowFullOS. If it passes, runmbr2gpt /convert /allowFullOS. - Then restart into the firmware settings, switch to UEFI and turn on Secure Boot.
- BitLocker users: suspend BitLocker before converting and have your recovery key ready. Microsoft says the existing BitLocker protectors then need to be removed and added again.
Good to know
- Microsoft's processor lists are written for PC makers building new computers. Microsoft says later processors that meet the same standards count as supported even when they're not listed yet.
- We checked Microsoft's Intel, AMD and Qualcomm lists for Windows 11, 24H2 and 25H2 on 14 October 2026. Microsoft hadn't published lists for 26H2.
- This checker can't see the PC's hardware itself: browsers don't reveal it. Results depend on the details you enter. The browser can only tell Windows 10 from Windows 11, in Edge and Chrome.
- Need a full picture of a PC for your IT support? Use our Support Snapshot. To test the keyboard, camera, microphone and screen, try the Device Tester.
If your PC can't run Windows 11
Can I keep using Windows 10?
It still works, but without security updates every new flaw stays open, so it gets riskier every month. Enrol in Extended Security Updates (ESU) to get security fixes until 12 October 2027 while you plan what's next. Without ESU, avoid online banking and shopping on it, and don't use it for work.
How do I get ESU?
On Windows 10 version 22H2 with the latest updates, go to Settings > Update & Security > Windows Update and choose Enroll now. It's free if you back up your PC settings to a Microsoft account, or costs 1,000 Microsoft Rewards points or a one-off payment. One enrolment covers up to 10 PCs on the same account. Businesses buy ESU through Microsoft volume licensing or a partner instead; the consumer version can't be used for business.
Is it safe to install Windows 11 with a workaround?
It often works, but Microsoft says unsupported PCs aren't guaranteed updates, including security updates, and that problems aren't covered by the warranty. Some older processors can't run version 24H2 or later at all. It's a reasonable experiment on a spare home PC, but not for a PC you depend on or a business device.
What about ChromeOS Flex or Linux?
Both are free and keep older PCs safe for years. ChromeOS Flex from Google turns a PC into a Chromebook: simple, fast and good for web apps, but it can't run Windows programs. Linux Mint and Ubuntu are full desktops with free office software. Both can be tried from a USB stick without changing the PC first.
Does my PC need Secure Boot turned on?
Microsoft only requires that the PC supports Secure Boot, which almost every UEFI PC sold since 2012 does. Turning it on is still recommended, because it stops some malware from loading before Windows starts.