PC Health Check is a Windows utility that checks whether a device meets the hardware and security requirements for Windows 11. It reports compatibility against items such as TPM, Secure Boot, processor support, memory and storage, without changing the system itself.
What PC Health Check actually tells you
PC Health Check is a compatibility and readiness utility, not a remediation tool. Its value is that it turns Windows 11 prerequisites into a simple pass or fail view so users and support teams can quickly see where a device falls short, such as firmware settings, processor support, memory, or storage capacity.
That makes it useful during upgrade planning, device refresh decisions, and help desk triage. The result is a snapshot of eligibility, so it should be treated as a starting point for investigation rather than proof that a device is healthy in every security sense.
Which requirements it commonly evaluates
The utility focuses on hardware and security gates that matter to Windows 11 installation and supportability. In practice, that means checks around trusted platform support, secure boot capability, CPU compatibility, and basic resource thresholds.
Those checks matter because modern Windows builds assume a minimum security posture from the platform itself. A device can be physically functional and still fail eligibility if its firmware, boot chain, or processor class does not meet Microsoft’s baseline.
For home users comparing upgrade options, NHIMG’s Windows 10 End of Support for Home Users Guide provides the broader context around eligibility checks, replacement decisions, and the risk of continuing on unsupported hardware.
Why eligibility checks matter for security posture
PC Health Check is relevant to security because Windows 11 requirements are partly designed to reduce exposure from weaker hardware and legacy configuration paths. When a device fails a check, the issue is often not just compatibility, but a missing control surface that supports stronger platform assurance.
That is why a failed result should trigger a closer look at whether the device can be remediated safely, whether a configuration change is enough, or whether the hardware is simply below the supported security baseline. The output is especially important in mixed estates where older devices linger because they still appear usable.
Device eligibility also ties into broader posture decisions. NHIMG’s Device Trust and Posture Guide explains how endpoint health signals support access and compliance decisions beyond a one-time upgrade check.
How to use the result in practice
Use the result to separate a simple upgrade blocker from a deeper endpoint governance issue. If a device fails because of firmware or boot configuration, the next step may be a controlled change. If it fails because the platform itself is unsupported, the practical answer may be replacement rather than exception handling.
This is also why the utility should be paired with inventory discipline. Knowing which endpoints fail, why they fail, and whether they are internet-facing, business-critical, or personally owned helps organisations prioritise the right response instead of treating every failure the same way.
Where unsupported hardware or inconsistent baseline enforcement is the real problem, NHIMG’s PingCastle Active Directory Assessment Guide is a useful adjacent reference for understanding how environment health checks become part of a wider risk picture.
Risk and Threat Considerations
A failed PC Health Check result is not itself a security incident, but it can mark a device that is easier to keep out of a stronger security baseline. The main risk is lingering on older hardware or settings that cannot support the platform protections expected by Windows 11, which can increase exposure over time.
Failure mechanism: Devices that cannot meet the required security and hardware baseline may remain on weaker configurations, stay out of the supported upgrade path, or accumulate exception handling that hides real exposure. That creates a control gap between what the estate appears to support and what it can actually enforce.
Impact: The result can be delayed remediation, increased support burden, and a larger population of endpoints that are harder to standardise, monitor, or defend consistently.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 provides the primary governance reference for this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | CM-2 — Baseline Configuration | PC Health Check compares devices to a required Windows baseline. |
| IA-3 — Device Identification and Authentication | The utility checks platform capabilities that support trusted device use. | |
| CM-8 — System Component Inventory | Eligibility checks depend on knowing which devices exist and what they can run. | |
| Recommendation — Use CM-2 to keep endpoint baselines aligned with required platform settings. Use IA-3 to require trusted device characteristics before granting access. Use CM-8 to inventory endpoints and track which ones fail platform requirements. | ||
Practitioner Guidance
What to watch for: Treat a failed check as a routing signal, not a verdict. The useful question is whether the device failed because of a fixable setting, a missing firmware capability, or a hardware limitation that should push the asset into refresh planning.
Governance implication: Keep the output tied to device ownership and lifecycle decisions. A one-off check is less important than a repeatable process that records the failure reason, the remediation path, and whether the endpoint should remain in service.
Practitioner takeaway: PC Health Check is most valuable when it feeds an inventory and upgrade decision workflow, not when it is used as a standalone reassurance screen.
Related resources from NHI Mgmt Group
- How can operators tell whether a health check is actually useful?
- What breaks when remote access MFA does not check device health and session context?
- How should organisations perform a segregation of duties health check in Oracle ERP environments?
- What happens when health check logs are left in the stream instead of being excluded?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org