Windows 11 Says Your Computer Isn’t Good Enough, Then Pins a Tracker to It Forever

Your PC is sitting right there, working fine. It runs the software you need. It’s got the RAM, the storage, the screen. But Windows 11 looks at it and declares it unfit to run, because of a hardware checkbox you can’t see, on a chip you didn’t choose, that Microsoft made mandatory for reasons that have nothing to do with what your computer can actually do.

And the moment you make it comply, you get a permanent hardware tracker you can never turn off.

The checkbox you can’t uncheck

Windows 11’s headline requirement is TPM 2.0, a Trusted Platform Module, alongside Secure Boot and a “supported” CPU. On paper it’s a security feature: a cryptoprocessor that stores encryption keys and proves the machine hasn’t been tampered with. In practice, Microsoft used it as a hard gate. If your hardware lacks a TPM 2.0 chip, or has a perfectly capable CPU that happens not to be on Microsoft’s blessed list, Windows 11 refuses to install at all. It doesn’t matter that the machine runs everything else fine. The checker says no.

So the story of installing Windows 11 on “unsupported” hardware became a game of whack-a-mole. Users found registry tweaks to skip the check, tools like Rufus that build install media with the requirements disabled, and a long-running trick of swapping in an older compatibility file to fool the installer. Microsoft responded by patching the bypasses, closing the appraiser file swap, and fighting a running battle against every workaround. Each patch made the next workaround harder. The clear message: your hardware doesn’t meet our definition of worthy, and we’ll make sure you can’t quietly ignore it.

The chip that’s been tracking you all along

Here’s the part that makes the whole thing feel less like security and more like a leash. Every TPM has an endorsement key: a cryptographic key pair injected by the manufacturer when the chip is made. The private half can never leave the chip. The public half, and its hash, identify that specific TPM, and therefore that specific computer, and it cannot be changed. Clear the TPM, wipe the keys, reinstall Windows, none of it changes the endorsement key. It is a hardware identity burned into silicon, issued once, permanent.

That unchangeable identifier is the “tracker.” It’s what lets Windows attest that this is a real, specific machine. And it’s tied to your Microsoft account through device health attestation and sign-in. The chip that Microsoft made mandatory is also the chip that gives the OS an unerasable handle on which computer you’re using, that it can read no matter how many times you reset, reinstall, or move.

PowerShell will show you exactly what the chip is holding. Run these from an elevated prompt:

# basic TPM status and capabilities
Get-Tpm

# the endorsement key info (public key, hash, certificates)
Get-TpmEndorsementKeyInfo -Hash "Sha256"

# extract the raw public endorsement key
(Get-TpmEndorsementKeyInfo).PublicKey

The public key and its hash are readable to any admin, and the private key never leaves the silicon. That asymmetry is the whole point: Microsoft reads the identifier freely, but you can’t change it, remove it, or keep it from identifying your machine.

The good idea that became a gate

A TPM genuinely is a good thing. BitLocker encryption, hardware-backed keys, attestation that a machine hasn’t been tampered with, all real and all worthwhile. The enshittification isn’t the technology. It’s the choice to turn a security feature into a wall that gates an entire operating system, excludes working hardware, and installs an unremovable hardware fingerprint as the price of admission.

It’s the same playbook as the rest of the series: take a legitimate improvement, wire it into a lock-in, and make the exit more expensive than the entrance. You can’t use the new OS without the chip, the chip carries an identifier you can’t change, and the identifier is bound to the account Microsoft keeps pushing you toward. Each link of that chain is defensible on its own. The chain itself is the problem.

The receipt

• The scam: A security chip you never chose is made a hard requirement, excluding working hardware, and it carries a permanent, unchangeable identifier.
• The mechanism: The TPM endorsement key, a manufacturer-issued hardware identity that can’t be reset or removed, read via PowerShell and bound to Windows device attestation and your account.
• Why it’s still running: Each requirement link is individually defensible as “security,” so the lock-in compounds without ever looking like a single bad decision.
• The fix that’s missing: Security that doesn’t exclude capable hardware or install an unerasable machine fingerprint as the price of the OS.

---

This is a real and widely-documented barrier. The video below walks through installing Windows 11 on hardware Microsoft says is unsupported.

Watch: Yet Another Way to Install Windows 11 Without a TPM (Ask Leo!)