From what I've read in this post, I'm glad I've never bothered with Secure Boot and TPM. Many of my older systems do not come with a TPM module on the motherboard or eTPM built into the CPU. I can still run Windows 10 Pro 32-bit on ancient Athlon 64 systems and I'm perfectly happy with Windows 10 Pro 64-bit on my 3800X and 7950X until October 2025.
To make swapping drives between motherboards and booting multiple OS versions on one PC, I disable motherboard Secure Boot and TPM before installing Windows. This also stops Microsoft from offering to update compatible systems to Windows 11. I know it's less secure, but it's a risk I'm prepared to take. I have a number of "sacrificial" machines and run new software in Hyper-V images or Windows Sandbox, before commiting to more important systems.
I use Rufus to modify the Microsoft Windows ISO and bypass the need for Secure Boot and TPM. When necessary, I install older versions of Windows 11 that still allow you to create a Local Account, instead of demanding a Microsoft Account. I want to choose the name of my main User Account, instead of some arbitrary account name chosen by Microsoft based on my email address. Yes I know I could create a Local Account at a later date after the initial installation with a Microsoft Account.
If you only have one computer and don't back up your data, disabling TPM and Secure Boot is probably not a good idea, but if you want to make life easier when swapping motherboards, use Rufus to knobble additional security.
