ErrorFix
Windows PC Errors

How to Fix Windows Update Error 0x80090011 (TPM / Secure Boot)

By ErrorFix · Updated October 19, 2026 · 8 min read

Error 0x80090011Plain English: Windows tried to install an update or upgrade to Windows 11, but your PC failed the hardware security check — TPM 2.0 or Secure Boot is switched off or missing.
Quick answer: Press Windows key + R, type tpm.msc, and check whether a TPM 2.0 is ready. If it is missing, restart into your BIOS or UEFI settings and enable TPM 2.0 (called fTPM on AMD boards, PTT on Intel boards), then turn on Secure Boot. Most 0x80090011 cases clear the moment both are active.

What error 0x80090011 means

Windows 11 has two non-negotiable hardware security requirements: a Trusted Platform Module (TPM) at version 2.0, and Secure Boot. The TPM is a small security chip — or a firmware feature built into modern processors — that verifies your system has not been tampered with before Windows starts. Secure Boot makes sure only trusted software can load during startup. Error 0x80090011 is Windows Update reporting that it checked your machine against these requirements and one of them failed. It shows up most often during a Windows 11 upgrade attempt, but it can also appear when a regular feature or quality update re-checks your hardware eligibility.

Here is the encouraging part: a large share of PCs that hit 0x80090011 actually have the hardware. The TPM is present but switched off in the BIOS, or Secure Boot was disabled when the machine shipped with an older OS. That is why this error is usually a settings problem, not a shopping problem. The steps below walk through checking what you have, flipping the right firmware switches, and clearing the update pipeline so Windows re-checks your machine with a clean slate.

Common causes

How to fix error 0x80090011 — step by step

Work through these fixes in order. Most people clear this error by step 3.

  1. Check whether your PC actually passes the Windows 11 requirements. Before changing any settings, confirm what is missing. Press the Windows key and R together, type tpm.msc, and press Enter. If the TPM Management window says the TPM is ready for use and lists specification version 2.0, your TPM is fine and the problem is almost certainly Secure Boot or the update pipeline itself. If it says a compatible TPM cannot be found, the chip is either disabled in firmware or missing from your hardware. Also download the PC Health Check app from Microsoft to get a plain list of what fails.
  2. Enable TPM 2.0 in your BIOS or UEFI settings. Restart the PC, and during startup press the firmware key repeatedly, usually Delete or F2, or go to Settings, then Update and Security, then Recovery, then Advanced startup, and choose UEFI Firmware Settings to open it from inside Windows. Look for a Security or Advanced tab, then a Trusted Computing or TPM option. Set the TPM Device to Enabled or Available. On AMD boards this may be labeled fTPM, and on Intel boards it may be labeled PTT, both count as TPM 2.0 when enabled. Save and exit. Then check tpm.msc again to confirm the TPM is now ready for use.
  3. Turn on Secure Boot. Open the firmware settings again and find the Secure Boot option, usually under the Boot or Security tab. Set Secure Boot to Enabled. If the option is grayed out, first disable any Legacy or CSM boot mode and make sure the boot mode is set to UEFI rather than Legacy. Some boards also need the Secure Boot mode set to Standard rather than Custom. Save and exit, then press the Windows key and R, type msinfo32, and check that Secure Boot State shows On and BIOS Mode shows UEFI. Those two lines are the definitive confirmation.
  4. Update your BIOS or UEFI firmware. Old firmware can misreport the TPM to Windows, leaving the chip invisible even though it is enabled. Go to your motherboard or laptop manufacturer's support page, find your exact model, and download the latest BIOS update. Follow the manufacturer's instructions exactly, usually copying the file to a USB drive and using the firmware's built-in updater, and keep the PC on stable power the whole time. After the update, recheck tpm.msc and msinfo32, since a firmware update can reset BIOS settings and you may need to re-enable TPM and Secure Boot.
  5. Reset the Windows Update components and retry. If TPM and Secure Boot are both correct and 0x80090011 still appears, the error may now be a stale failure the updater is repeating rather than a real hardware problem. Right-click Start and choose Terminal as Admin. Run net stop wuauserv, net stop cryptSvc, net stop bits, and net stop msiserver. Then rename the download cache with ren SoftwareDistribution SoftwareDistribution.old from the Windows folder, and rename catroot2 to catroot2.old from the System32 folder. Restart the services with net start wuauserv, net start cryptSvc, net start bits, and net start msiserver. Then check for updates again, the updater will rebuild a clean cache and re-evaluate your hardware from scratch.
  6. If your hardware genuinely cannot pass, know your options. Some older PCs have no TPM 2.0 at all, and no BIOS setting can add one. Microsoft documents a registry value, AllowUpgradesWithUnsupportedTPMOrCPU, that lets the Windows 11 installer proceed on unsupported hardware, but Microsoft warns these devices may not receive updates, including security updates, and the PC loses the protection TPM was meant to provide. The safer choice on a daily-use PC is to stay on Windows 10, which is fully supported by these fixes for update errors, and replace the machine when you can. Do not use the bypass on a work computer, ask the IT admin first.

Did this fix it? Quick checklist

If the error persists after all six steps, check how much free space is on the system drive — upgrades need tens of gigabytes of working room, and a cramped drive can abort the process with a misleading error. Also try a clean boot (type msconfig, hide all Microsoft services, disable the rest plus startup items, restart) before retrying the update; this rules out third-party software interfering with the upgrade check. If a work PC is involved, ask the IT admin whether TPM or Secure Boot settings are locked by policy — managed machines can hide firmware options that you cannot change yourself.

Frequently asked questions

What does Windows Update error 0x80090011 mean?

Error 0x80090011 means Windows Update or the upgrade assistant checked your PC against the Windows 11 hardware security requirements and found that TPM 2.0 or Secure Boot was not active. The update is blocked until the security check passes.

Why does Windows say my PC is unsupported when it has a TPM chip?

The chip is probably switched off in firmware, which is the most common cause of 0x80090011. On AMD boards it is labeled fTPM and on Intel boards PTT, and both must be enabled in BIOS. Another possibility is that the chip is TPM 1.2 rather than 2.0, or that an old BIOS is misreporting it to Windows.

Is it safe to bypass the TPM check to install Windows 11?

Microsoft documents a registry bypass for unsupported hardware, but warns those devices may not receive updates, including security updates, and you lose the boot protection TPM provides. It is acceptable for a test machine, but risky as a daily driver, and you should never use it on a work PC without the IT admin's approval.

Will I lose my files when fixing 0x80090011?

No. Enabling TPM and Secure Boot and resetting the update components do not touch your documents, apps, or settings. A BIOS update does not touch your files either, though keeping the PC on stable power during the flash is essential, since a power cut mid-update can leave the board unusable.

Related fixes