Why Windows 11 has such strict hardware requirements, according to Microsoft

Windows 11 promises to refine window management, run Android apps, and to unify the look and feel of the operating system's built-in apps after years of frustrating hodgepodge. But none of that matters if your computer can't run the software, and Microsoft has only promised official Windows 11 support for computers released within the last three or four years. Anyone else will be able to run the operating system if they meet the performance requirements, but they'll need to jump through the hoop of downloading an ISO file and installing the operating system manually rather than grabbing it through Windows Update.

This is a break from previous versions of Windows, which up until now have had more or less the same system requirements for a decade. Microsoft actually used the ability to run on older hardware as a selling point for Windows 10, making it available as a free upgrade to all computers running Windows 7 and Windows 8—if you get as many people as possible using the newest version of Windows, the reasoning went, it would be easier to get developers to take advantage of the latest features.

Microsoft's rationale for Windows 11's strict official support requirements—including Secure Boot, a TPM 2.0 module, and virtualization support—has always been centered on security rather than raw performance. A new post from Microsoft today breaks down those requirements in more detail and also makes an argument about system stability using crash data from older PCs in the Windows Insider program.

Drivers and stability

Microsoft says that Insider Program PCs that didn't meet Windows 11's minimum requirements "had 52% more kernel mode crashes" than PCs that did and that "devices that do meet the system requirements had a 99.8% crash-free experience." According to Microsoft, this mostly comes down to active driver support. Newer computers mostly use newer DCH drivers, a way of packaging drivers that Microsoft began supporting in Windows 10. To be DCH-compliant, a driver must install using only a typical .INF file, must separate out OEM-specific driver customizations from the driver itself, and must distribute any apps that accompany your driver (like a control panel for an audio driver or GPU) through the Microsoft Store. DCH drivers are common for hardware made in the last four or five years but rare to nonexistent for hardware that shipped in the Windows 8 or Windows 7 eras.

Certainly, computers from 2012 or 2014 are going to be running outdated drivers that cause crashes—using Windows 7-era drivers on older computers running Windows 10 can lead to instability or general weirdness. But Microsoft's numbers make no distinction between these older systems and newer computers that nearly, but don't quite, miss the system requirements, like 6th- and 7th-generation Intel Core systems and first-generation Ryzen systems that include TPM 2.0 modules and still enjoy active DCH driver support from Intel, AMD, and (in many cases) the companies that manufactured the computers. Presumably, installing Windows 11 manually on these PCs will feel more or less as stable as installing it on an officially supported device, but it's something we'll need to test for ourselves.

A towering stack of security acronyms

That's where the security requirements come back into play. Microsoft goes to greater lengths to explain the benefits of using Secure Boot and TPM 2.0 modules, but the key may actually be the less-discussed virtualization requirement and an alphabet soup of acronyms. Windows 11 (and also Windows 10!) uses virtualization-based security, or VBS, to isolate parts of system memory from the rest of the system. VBS includes an optional feature called "memory integrity." That's the more user-friendly name for something called Hypervisor-protected code integrity, or HVCI. HVCI can be enabled on any Windows 10 PC that doesn't have driver incompatibility issues, but older computers will incur a significant performance penalty because their processors don't support mode-based execution control, or MBEC.

And that acronym seems to be at the root of Windows 11's CPU support list. If it supports MBEC, generally, it's in. If it doesn't, it's out. MBEC support is only included in relatively new processors, starting with the Kaby Lake and Skylake-X architectures on Intel's side, and the Zen 2 architecture on AMD's side—this matches pretty closely, albeit not exactly, with the Windows 11 processor support lists.

It's easiest to think of MBEC as hardware acceleration for the memory integrity feature, sort of like how AES-NI instructions sped up encryption operations a decade or so ago. Computers without AES-NI can still use BitLocker drive encryption, for example, it just comes with a more noticeable performance penalty. The same thing is true of the memory integrity feature and MBEC—PCs without processors that support MBEC rely on software emulation called "Restricted User Mode," which does get you the security benefits but affects performance more. Some users who have tested the HVCI feature in Windows 10 on processors without MBEC support have noticed performance reductions of up to 40 percent, though this will depend on the tasks you're doing and the computer you're using.