Installation & First Setup

Windows 11 Fundamentals

Chapter 2 · Installation & First Setup

Chapter 1 toured the interface a running Windows 11 machine presents. This chapter goes one step earlier — the requirements a machine has to meet before Windows 11 will install at all, the installation process itself, and the account decision every fresh install forces on day one. Build a New Development PC 11 already covered a freshly built machine's first boot and BIOS setup in general terms; this chapter is the OS-side half of that same moment — the specific settings inside that BIOS/UEFI screen Windows 11 actually requires to be enabled.

Hardware Requirements — Stricter Than Any Previous Windows Release

Windows 11 raised its minimum hardware bar meaningfully above Windows 10's — and, unlike most past Windows version bumps, some of the new requirements are about security architecture, not raw performance:

TPM 2.0 (Trusted Platform Module) — a dedicated security chip (or firmware-based equivalent) that stores encryption keys outside the reach of the operating system itself. Required, not merely recommended, for a supported install.
Secure Boot — a UEFI firmware feature that only allows cryptographically signed bootloaders to run, blocking a large class of boot-level malware before Windows itself ever starts.
A supported 64-bit CPU — a specific, Microsoft-published list of compatible processor generations, not simply "any 64-bit CPU."
4 GB RAM, 64 GB storage minimum — the raw baseline, on top of everything above.

TPM 2.0 and Secure Boot exist to support Windows 11's own deeper security features — Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI) among them, both covered from the defensive side in Chapter 9. The hardware requirement isn't arbitrary gatekeeping; it's the foundation those later features are actually built on.

Contrasting With Build a New Development PC 11's Own BIOS/UEFI Material

	What it covers	Why it matters here
Build a New Development PC 11	General first-boot BIOS/UEFI setup for a freshly assembled machine — boot order, XMP memory profiles, fan curves	Covers the BIOS/UEFI screen itself, in general terms, for any OS
This chapter	The specific toggles inside that same screen — TPM (sometimes labeled "PTT" on Intel or "fTPM" on AMD) and Secure Boot — that Windows 11 specifically requires	A machine can pass every check in Build a New Development PC 11's own setup and still fail Windows 11's installer, if these two toggles are left off

On many motherboards, TPM support exists in firmware already — as Intel PTT (Platform Trust Technology) or AMD fTPM — but ships disabled by default, precisely because Windows 10 never required it. A machine built specifically for a fresh Windows 11 install should have both toggles checked and enabled during that same first BIOS/UEFI visit, rather than discovered as an installer error afterward.

Installation Media

Two official routes exist:

Windows 11 Installation Assistant — an in-place upgrade tool for a machine already running a supported Windows version.
Media Creation Tool — downloads an ISO and can write it directly to a bootable USB drive, for a clean install or a new machine with nothing installed yet.

A clean install from bootable USB is the more reliable path for a genuinely new setup — it avoids carrying forward any leftover configuration, drivers, or clutter from a previous install, at the cost of needing to reinstall applications afterward.

The Out-of-Box Experience (OOBE)

First boot after installation walks through region, keyboard layout, a network connection, and — since Windows 11 22H2 — a network connection is required by default before setup will continue on the Home edition, specifically so the account-creation step that follows can push toward a Microsoft account.

Local vs. Microsoft Account — A Real, Ongoing Trade-Off

	Gains	Costs
Microsoft account	Settings sync across devices, OneDrive integration, Windows Hello credentials that follow you, easier password recovery	Requires internet during setup, ties the machine's identity to a cloud account, more data shared with Microsoft by default
Local account	No cloud dependency, works fully offline, no account-level data leaves the machine	No cross-device sync, password recovery is entirely local (no "forgot password" email flow), Microsoft has made this option progressively harder to find in the OOBE flow over successive updates

Checking TPM status on a running machine

Run tpm.msc from the Run dialog (Win + R) on any Windows 11 machine to open the TPM Management console directly — it reports the TPM's presence, version, and status without needing to reboot into the BIOS/UEFI screen at all.

Bypassing the requirements has real, lasting consequences

Registry-edit and setup-file workarounds to install Windows 11 on unsupported hardware do circulate, and Microsoft's own tolerance of them has shifted from release to release — treat any specific bypass method as temporary, not a documented feature. An install that bypasses the hardware check is explicitly marked unsupported by Microsoft, with no guarantee of continued update delivery. This is a real, practical distinction worth knowing before recommending it to anyone: it may work today and stop working at the next feature update with no warning.

Hands-On Exercises

Exercise 1

Explain why TPM 2.0 and Secure Boot are described in this chapter as "the foundation" for Windows 11's deeper security features, rather than security features in their own right.

📄 View solution

Exercise 2

A machine passes every check described in Build a New Development PC 11's own first-boot BIOS/UEFI walkthrough, but the Windows 11 installer still refuses to proceed. Using this chapter's own compare-table, explain the most likely cause and how to fix it.

📄 View solution

Exercise 3

A user wants to set up a new Windows 11 machine but has no interest in Microsoft account features and wants to avoid handing over an internet connection during setup at all. Using this chapter's own trade-off table, explain what they gain and lose by choosing a local account, and why Microsoft has made that option progressively harder to reach.

📄 View solution

Chapter 2 Quick Reference

TPM 2.0 + Secure Boot — required, and the foundation for VBS/HVCI, covered from the defensive side in Chapter 9
Often disabled by default in BIOS/UEFI as Intel PTT or AMD fTPM — check and enable both during the same first-boot visit Build a New Development PC 11 already covers
Clean install (bootable USB) vs. in-place upgrade (Installation Assistant) — a clean install avoids carried-over clutter
tpm.msc — checks TPM presence/version/status on a running machine without a reboot
Bypassing hardware requirements is explicitly unsupported and not guaranteed to keep working across updates
Next chapter: File Explorer & the File System