How to Enable TPM 2.0 and Secure Boot in Windows

To enable TPM 2.0 and Secure Boot, turn on the corresponding options in your computer’s UEFI firmware. First check Windows, because both features may already be active; then save your BitLocker or device-encryption recovery key, enable firmware TPM, switch from Legacy/CSM to UEFI only when necessary, and enable Secure Boot. Do not change boot modes blindly: a Windows installation configured for Legacy boot can stop starting if you select UEFI without preparing the disk and boot configuration.

Check whether TPM 2.0 and Secure Boot are already enabled

You may not need to change firmware at all. Windows 11 normally requires TPM 2.0 and Secure Boot support, but a feature can be enabled even when a particular application reports a problem.

Before starting, gather:

• A Windows 10 or Windows 11 installation with administrator access
• The ability to restart the computer and enter its UEFI setup screen
• Access to your Microsoft account or another place where your recovery key is stored
• The computer’s manufacturer or motherboard manual if the firmware menu is unfamiliar

1. Check TPM in Windows Security. Open Windows Security, select Device security, and look for Security processor. Open Security processor details if it appears. The specification version should say 2.0.
2. Check TPM with the management console. Press Windows+R, enter tpm.msc, and press Enter. Under TPM Manufacturer Information, look for Specification Version: 2.0. If the console says that a compatible TPM cannot be found, TPM may be disabled in firmware, unsupported by the hardware, or unavailable because of a firmware configuration issue.
3. Check Secure Boot and boot mode. Press Windows+R, enter msinfo32, and press Enter. In System Information, find BIOS Mode and Secure Boot State. A ready configuration normally shows UEFI for BIOS Mode and On for Secure Boot State.
4. Record the results before changing anything. Legacy for BIOS Mode means Secure Boot cannot be enabled until Windows is booted through UEFI. If TPM specification version 2.0 and Secure Boot State On are already present, leave the firmware settings alone and retry the application that requested them.

Save your recovery key before changing BIOS settings

Firmware changes can cause BitLocker or Windows device encryption to ask for its recovery key at the next boot. This is normal protection: Windows detects that the trusted boot environment changed and refuses to unlock the drive automatically until you prove ownership. A firmware update, TPM reset, changes to boot mode, or Secure Boot key changes can all trigger that check.

1. Check your encryption status. Open Settings, go to Privacy & security > Device encryption on supported Windows editions, or open Control Panel > System and Security > BitLocker Drive Encryption. You can also search for Manage BitLocker.
2. Save the recovery key using an available option. Store it in your Microsoft account, print it, or save it to a separate USB drive or another safe location. Do not save the only copy on the encrypted Windows drive.
3. Confirm that you can retrieve the key before entering UEFI. A recovery-key prompt displays a key identifier; use that identifier to select the matching saved key. A password, Windows PIN, or ordinary product key cannot replace the BitLocker recovery key.

Do not clear or reset the TPM merely because you are enabling TPM 2.0. Clearing it can remove stored encryption protectors and may require the recovery key or affect credentials and applications that use the TPM.

If you cannot access the recovery key, stop here. Changing firmware with no recovery key can leave the files on an encrypted drive inaccessible.

Enable firmware TPM and Secure Boot in UEFI

Firmware menus differ by manufacturer, but the relevant settings use familiar names. Intel systems commonly call firmware TPM Intel PTT or Platform Trust Technology. AMD systems commonly use AMD fTPM, AMD PSP fTPM, or Firmware TPM. Secure Boot is usually under a Boot, Security, or Authentication menu.

1. Restart Windows and enter UEFI setup. Use the manufacturer’s displayed key during startup, commonly Delete, F2, F10, or Esc. You can also use Windows recovery options: Settings > System > Recovery > Advanced startup > Restart now, then choose Troubleshoot > Advanced options > UEFI Firmware Settings.
2. Enable the firmware TPM. Look under Advanced, Security, Trusted Computing, CPU Configuration, or a similarly named menu. Set Intel PTT, Intel Platform Trust Technology, AMD fTPM, AMD PSP fTPM, or Firmware TPM to Enabled. The expected result is that the firmware exposes TPM 2.0 to Windows. Do not choose an option that clears the TPM.
3. Check the current boot mode before changing it. Find Boot Mode, CSM, or Legacy Support. If Windows already reports UEFI, leave the mode as UEFI. If Windows reports Legacy, do not simply disable CSM and save; first make sure the system disk and Windows boot configuration are ready for UEFI.

Changing a Legacy installation to UEFI is consequential. Back up important files and confirm that the recovery key is available before preparing the disk.

4. If Windows is installed in Legacy mode, prepare the installation from Windows before switching firmware modes. Back up important files, confirm that the recovery key is available, and use Microsoft’s supported mbr2gpt procedure to validate and convert the system disk when it meets the tool’s requirements. From an elevated Command Prompt, validation is performed with the following command, replacing the disk number if Windows is not on disk 0.

mbr2gpt /validate /disk:0 /allowFullOS

A successful validation does not itself change the disk. The conversion command is a separate, consequential step; follow Microsoft’s current documentation for your Windows version and disk layout rather than running it on an unverified system. After a successful conversion, set firmware to UEFI and make Windows Boot Manager the first boot entry.

Selecting UEFI on a disk that still depends on Legacy/CSM boot can produce a “no boot device” message or send Windows into recovery. If validation fails, leave the firmware mode unchanged and fix the reported disk, partition, or encryption issue first.

5. Enable Secure Boot only after the system is using UEFI. In the Secure Boot menu, set Secure Boot to Enabled. Some firmware requires OS Type to be Windows UEFI Mode, or requires selecting Install default Secure Boot keys or Restore factory keys before the setting can be enabled. Use the default keys unless you intentionally manage a custom Secure Boot trust chain.
6. Save the changes and restart. The usual command is Save Changes and Exit, often mapped to F10. Do not change unrelated settings such as storage-controller mode, memory tuning, boot priority, or TPM clearing options.

Confirm Windows still starts and both features are active

Windows should start normally after the restart. If BitLocker asks for a recovery key, enter the saved key that matches the identifier on screen; do not repeatedly power off the computer while guessing.

1. Confirm the TPM version again. Open tpm.msc and verify that the TPM is ready for use and that Specification Version is 2.0.
2. Confirm Secure Boot and UEFI mode. Open msinfo32 and check for BIOS Mode: UEFI and Secure Boot State: On.
3. Check Windows Security. Open Windows Security > Device security. The Security processor area should be available, and Secure Boot should be shown as active where supported by that Windows build.
4. Retry the program that required the features. Windows 11 eligibility checks, some anti-cheat systems, and other security-sensitive applications generally look for a TPM 2.0 device and an active UEFI Secure Boot chain. They may need a full restart before recognizing the change.

A successful setup has all of these conditions: Windows boots from Windows Boot Manager, msinfo32 reports UEFI and Secure Boot On, and tpm.msc reports TPM specification version 2.0. Custom bootloaders, unsigned drivers, older operating systems, and some dual-boot configurations may not work with Secure Boot until their boot components support a trusted signature.

What to do if Secure Boot is missing or Windows will not boot

If you cannot find Secure Boot, first check msinfo32. Secure Boot is normally unavailable while BIOS Mode is Legacy, and some firmware hides it until CSM or Legacy Support is disabled. It can also be absent on older hardware that does not support UEFI Secure Boot.

If the option is present but greyed out, look for CSM, Legacy Boot, OS Type, and Secure Boot key management. Set the operating system type to a Windows UEFI option and disable CSM only after confirming that Windows uses a GPT system disk and has a UEFI boot entry. Do not delete existing keys or install custom keys unless you know which bootloader needs them.

Custom bootloaders, unsigned drivers, older operating systems, and some dual-boot configurations can be incompatible with Secure Boot. Leave Secure Boot disabled until every required boot component supports a trusted signature; do not force it on merely because an application requests it.

If Windows will not boot after changing modes, return to UEFI and restore the previous boot mode rather than making random changes. If the installation was Legacy-based, re-enable Legacy/CSM so you can start Windows and correct the disk and boot configuration. If it was converted successfully, choose Windows Boot Manager as the first boot entry. Windows recovery tools may repair the boot files, but preserve the recovery key and avoid reinstalling Windows until you have confirmed that the files are backed up.

If you cannot enter the firmware menu, use Windows Advanced startup and UEFI Firmware Settings. If that option is absent, the computer may use legacy firmware, the manufacturer may provide a different restart method, or fast-startup behavior may be interfering. Shut down fully and try the documented setup key immediately after powering on; check the manufacturer’s instructions for the exact key.

If a BitLocker recovery screen appears, use the saved key matching its identifier. After Windows starts, suspend BitLocker protection before another planned firmware update or hardware change when Microsoft’s instructions call for it, then resume protection afterward. Never clear the TPM or disable encryption as a first response to a boot problem.

Conclusion

The setup is complete when `tpm.msc` reports TPM specification version `2.0`, `msinfo32` reports `BIOS Mode: UEFI` and `Secure Boot State: On`, and Windows boots from **Windows Boot Manager**. Keep the recovery key somewhere you can reach without the PC, especially before firmware updates or hardware changes. If the machine uses a custom bootloader, dual-boot setup, or older hardware, keep Secure Boot disabled until you have confirmed that every required boot component supports it; forcing the setting is not worth losing access to Windows or another operating system.

Frequently Asked Questions

Can I enable Secure Boot without TPM 2.0?

Usually yes, because Secure Boot and TPM are separate firmware features. Some applications require both, however, and older hardware may support one but not the other.

Will enabling TPM 2.0 erase my files?

Enabling an already supported firmware TPM normally does not erase files. Clearing or resetting the TPM is different: it can affect encryption protectors, credentials, and applications, and can require the recovery key. Do not select that option casually.

Why does Secure Boot still say Off after I enabled it?

Check that BIOS Mode is `UEFI`, CSM or Legacy Support is disabled, and the default Secure Boot keys are installed if the firmware requires them. Custom bootloaders or unsigned components can also prevent Secure Boot from becoming active. If the setting is missing entirely, the hardware may not support UEFI Secure Boot.