What is a TPM, secure boot and GPT partitioning and why is it required for Windows 11?
Windows 11 requires TPM 2.0, Secure Boot, and GPT partitioning to ensure a secure and modern system foundation. Originally this was just for Microsoft however it has now become a mandatory addition to online gaming as some major game studios are requiring this security to be enabled as well.
TPM stands for Trusted Platform Module.
This is a hardware or firmware-based security component that stores cryptographic keys. It can be a physical device you plug into your motherboards dedicated TPM port or it is a firmware-TPM that is embedded within a coprocessor of your CPU (which is used by most vendors)
Purpose:
- Protects sensitive data (e.g., BitLocker encryption)
- Verifies system integrity during startup
- Supports secure authentication (Windows Hello)
- In the future it will also support passwords and additional measures for security.
Requirement Reason:
Enhances protection against malware, ransomware, and credential theft.
It also protects your software as it can also block hardware DMA (Direct Memory Access) attempts to your system and thus limit hacking on your device.
Secure Boot is a UEFI firmware feature that allows only trusted, signed operating system components to load at startup. Typically this is anything that is whitelisted by Microsoft. This also has an expiration timeline as well of certain dates to allow software even if its allowed right now.
Purpose:
- Blocks unauthorized bootloaders and rootkits
- Ensures operating system integrity
Requirement Reason:
Prevents low-level malware from loading before Windows and also disables the ability for other operating systems to take over your PC or place your current installation in a virtual machine mode for someone to bypass all software on your system.
Hard drive GPT (GUID Partition Table) is a modern disk partitioning system required for UEFI-based systems. It is the future of drive partitioning tables and should not be confused with NTFS file systems.
Purpose:
- Supports larger drives and more partitions
- Enables UEFI boot mode (required for Secure Boot)
Requirement Reason:
Provides compatibility with Secure Boot and improved reliability over legacy MBR.
Conclusion
These three components work together to establish a more secure windows system. These mainly only work with Windows though other modern operating systems have their own methods for security in a similar way.
- GPT enables UEFI boot
- Secure Boot verifies trusted startup
- TPM 2.0 protects system integrity and encryption keys
This security baseline is required for Windows 11 to reduce vulnerabilities and improve system protection. It is also required for the OS to function with the majority of its features available to the end user.