Since the launch of Windows 11 on October 5, 2021, Microsoft has emphasized the importance of security features such as Trusted Platform Module 2.0 (TPM 2.0), Virtualization Based Security (VBS) and Secure Boot. If these elements are already present, they are mandatory for security purposes.
Microsoft requires these features for Windows 11.
Microsoft’s official documentation update specifically addresses automatic device encryption via bitlock, known as “Auto-DE”. The document explains the reasons why TPM 2.0 and Secure Boot are necessary.
Where the old documents only indicated whether the necessary conditions were met or not, the new documents specifically detailed several potentially unmet conditions.
So the first one is related to TPM 2.0 which may not be present or enabled in BIOS or UEFI. The second is related to the Windows Recovery Environment (WinRE) which must be configured correctly. Finally, the PCR7 link may not be supported if Secure Boot is disabled or if external devices are connected at boot time.
The document also mentions the Platform Configuration Register (PCR), i.e. the TPM’s memory area that stores the hashing algorithm. The PCR7 profile used by BitLock ensures that the cryptographic key is only loaded at a specific time during startup. Intercepts during the Secure Boot process: Its purpose is to verify the Microsoft Windows PCA 2011 certificate during startup. If the signature is invalid, it causes Bitlock to use other profiles.
Microsoft asks you to buy a new PC.
If Microsoft is making these specifications, it’s because with the release of the 24H2 update for Windows, automatic device encryption requirements have been relaxed. There are even Windows Home PCs.
The Redmond firm has also published a BitLocker Key Backup and Recovery Guide, which explains why it’s a good idea to keep the document. Third-party vendors such as Acronis adapt their backup solutions accordingly.
So Microsoft confirms the importance of using a fully compatible PC with Windows 11 with this documented update. Simply put, the company’s position is clear: if your machine is too old, you need to buy a new one. The Redmond firm maintains that TPM 2.0 is a non-negotiable obligation for its operating system.
