Windows 10 to Windows 11: Why Your Disk Layout (MBR vs GPT) and Secure Boot Might Be the Real Blocker
With Windows 10 now past its end of free support, I’m fielding a steady stream of calls from Coleraine, Portrush, and across the Causeway Coast from people who’ve tried the “Upgrade to Windows 11” button in Windows Update — only to be told their PC “doesn’t meet the system requirements.” Nine times out of ten, the CPU and RAM are perfectly fine. The actual blocker is something most people have never had to think about: whether their hard drive is set up as MBR or GPT, and whether Secure Boot and the TPM are switched on in the BIOS.
This post explains what’s actually going on, in plain terms, and what your options are.
Why Windows 11 cares about this at all
Windows 11 introduced firmware-level security requirements that Windows 10 never enforced. Two of the big ones are:
- A TPM (Trusted Platform Module), version 2.0 — a small security chip (or firmware equivalent) that stores encryption keys and helps protect against tampering.
- UEFI Secure Boot — a check that verifies the operating system loader hasn’t been tampered with before Windows even starts.
Both of these depend on your PC booting in UEFI mode rather than the older legacy BIOS/CSM mode. And UEFI booting, in turn, depends on your disk being partitioned as GPT, not the older MBR standard. This is where most upgrade failures actually originate — not the CPU, but this chain of firmware settings underneath it.
MBR vs GPT — the short version
- MBR (Master Boot Record) is the original partitioning scheme, dating back to the 1980s. It’s simple, but it’s limited: it only supports drives up to 2TB and a maximum of four primary partitions, and it has no built-in safeguards against boot-record corruption.
- GPT (GUID Partition Table) is the modern replacement. It supports much larger drives, allows many more partitions, keeps backup copies of its partition table for resilience, and — critically for this discussion — is what UEFI Secure Boot requires to function.
Most PCs sold since roughly 2018–2019 already ship with drives formatted as GPT and boot in UEFI mode by default. If your machine is older than that, or if it was set up by someone who left legacy settings in place, there’s a good chance it’s still running MBR with BIOS/CSM boot — which is exactly what Windows 11’s installer rejects.
What is CSM, and why does it get in the way?
CSM (Compatibility Support Module) is a feature in modern UEFI firmware that lets a computer boot as if it were an older legacy BIOS system — useful for older operating systems, older graphics cards, or hardware that expects legacy boot behaviour. The problem is that when CSM is enabled, UEFI Secure Boot is effectively disabled, because Secure Boot has nothing to verify in a legacy boot chain.
So the practical upgrade path usually involves three connected steps:
- Convert the disk from MBR to GPT (without losing data — more on that below).
- Disable CSM in the BIOS/UEFI settings so the board boots in native UEFI mode.
- Enable Secure Boot (and confirm TPM 2.0 is active, which on many boards is a firmware setting called fTPM or PTT that’s switched off by default).
Converting MBR to GPT without wiping the drive
This is the part that makes people nervous, understandably — converting a disk’s partition table sounds like exactly the kind of thing that goes wrong at 11pm on a Sunday. The good news is Microsoft has a built-in tool for this: MBR2GPT, run from the command line, which converts the disk in place without touching your files, provided the disk is a single boot drive with the standard partition layout Windows expects.
That said, I’d always recommend a full backup before this kind of change regardless of how well-supported the tool is. Firmware settings, drive health, and partition layouts vary enough between machines that “should be fine” and “is fine” aren’t always the same thing — and a backup turns a bad afternoon into a minor inconvenience.
Do you actually need to upgrade?
Worth saying plainly: not every Windows 10 machine needs to become a Windows 11 machine. If a computer is doing a specific, well-defined job — a till system, an old accounts package, a machine that only ever opens a browser — the security calculus is different than for a general-purpose office or home PC that’s on the open internet all day. For hardware that genuinely can’t meet Windows 11’s requirements even after a CSM/GPT/Secure Boot cleanup (usually because the CPU itself is on Microsoft’s unsupported list), the realistic choices are: keep it as-is with compensating controls (isolated network segment, no browser use, extended security updates where available), or budget for replacement hardware.
The short version
If Windows Update is telling you your PC isn’t eligible for 11, don’t assume you need a new computer. Check three things first:
- Is the disk MBR or GPT? (msinfo32 will tell you under “BIOS Mode” and “Boot device” details.)
- Is CSM enabled in the BIOS?
- Is Secure Boot and TPM 2.0 actually switched on?
More often than not, it’s a half-hour firmware and partition job rather than a hardware replacement — but it’s exactly the kind of job where getting one setting wrong can leave a machine unable to boot, so it’s worth having someone who does this regularly either do it for you or walk you through it.
If you’re in Portrush, Coleraine, or anywhere along the Causeway Coast and you’ve hit this wall, get in touch and I’ll take a look.