How to enable TPM 2.0 and Secure Boot

To enable TPM 2.0, restart into your PC’s UEFI firmware settings and turn on the firmware TPM, usually called Intel PTT or AMD fTPM. Secure Boot is in the same settings, but if your PC boots in Legacy mode, read the warning below before you switch, or Windows may not start.

Last updated October 25, 2026 · Facts checked against Microsoft, Dell and ASUS support pages

The short version

Check first: tpm.msc for TPM, msinfo32 for BIOS Mode and Secure Boot State.
Windows 11 needs TPM version 2.0. A TPM 1.2 doesn’t meet the requirement.
The TPM switch can be called Intel PTT, Intel Platform Trust Technology, AMD fTPM, Security Device Support or TPM State, depending on the PC.
If BIOS Mode says Legacy, convert the disk with Microsoft’s MBR2GPT tool before switching to UEFI.

Before you start: back up your files. If BitLocker or device encryption is on, make sure you have your recovery key. Microsoft lists turning off or clearing the TPM, firmware updates and boot changes among the events that can make BitLocker ask for it. For a planned change, Microsoft suggests suspending BitLocker first.

Step 1: Check your TPM

Press Windows key + R, type tpm.msc and select OK.
If the TPM is ready for use, look at Specification Version under TPM Manufacturer Information. It needs to say 2.0.
If you see “Compatible TPM cannot be found”, the TPM may be turned off in the firmware. Continue with the steps below.

You can also open Windows Security and go to Device security. If there’s no Security processor section, Microsoft says the TPM may be disabled. If there is one, open Security processor details to see the version.

Step 2: Check Secure Boot and boot mode

Press Windows key + R, type msinfo32 and press Enter. On System Summary, check two lines:

BIOS Mode: UEFI is what Windows 11 needs. Legacy means the PC boots the old way, so read the warning section before changing anything.
Secure Boot State: On means it’s already enabled. Off means you can turn it on in the firmware.

TPM 1.2 vs TPM 2.0

A TPM (Trusted Platform Module) is a security component that stores encryption keys and helps Windows check that the PC started up safely. Windows 11 requires version 2.0. Microsoft says that if the specification version is lower, the PC doesn’t meet the Windows 11 requirements.

According to Microsoft, TPM 1.2 supports only the RSA and SHA-1 algorithms, while TPM 2.0 supports newer cryptographic algorithms. TPM 1.2 parts are separate chips on the motherboard. TPM 2.0 can be a separate chip, built into other components, or run as firmware on the processor’s platform, which is what Intel PTT and AMD fTPM are.

Microsoft also notes that TPM 2.0 isn’t supported in Legacy or CSM BIOS modes. The PC must be set to native UEFI. Whether an older PC can move from TPM 1.2 to 2.0 depends on its hardware, so check with the manufacturer.

Step 3: Open the UEFI firmware settings

In Windows 10, go to Settings → Update & Security → Recovery. In Windows 11, go to Settings → System → Recovery.
Under Advanced startup, select Restart now.
Choose Troubleshoot → Advanced options → UEFI Firmware Settings → Restart.

You can also press a key while the PC starts. Dell says to tap F2 at the Dell logo, and ASUS says to press Del at the ASUS or ROG logo. Other brands use different keys, so check your manual.

Step 4: Turn on TPM 2.0

Microsoft says the setting is usually in a submenu called Advanced, Security or Trusted Computing. Look for one of these names and set it to Enabled or On:

Intel PTT or Intel Platform Trust Technology
AMD fTPM switch or AMD PSP fTPM
Security Device or Security Device Support
TPM State

Brand	Where the vendor says to look
Dell	Press F2 at startup. In the Security settings, turn on Intel Platform Trust Technology, Trusted Platform Module, TPM 2.0 Security or Firmware TPM, depending on the model.
ASUS motherboards (Intel)	Press Del at startup. Go to Advanced → PCH-FW Configuration and enable PTT. Press F10 to save.
ASUS motherboards (AMD)	Press Del at startup. Go to Advanced → AMD fTPM configuration and set TPM Device Selection to Firmware TPM. Press F10 to save.
HP, Lenovo and others	Menus vary by model. Microsoft’s Enable TPM 2.0 on your PC article links to each manufacturer’s instructions.

Save, restart into Windows and run tpm.msc again to confirm the version is 2.0. If the option isn’t there, Dell suggests updating the BIOS to the latest recommended version.

Step 5: Turn on Secure Boot

In the same firmware settings, find the Secure Boot option and set it to Enabled, then save and exit. Microsoft says that if the firmware offers both UEFI and Legacy/CSM, UEFI should be first or the only option.

For a Windows 10 to Windows 11 upgrade, Microsoft says the PC must be Secure Boot capable, which means it’s running in UEFI mode. Microsoft suggests turning Secure Boot on for better security, but it’s optional for the upgrade.

Warning: switching from Legacy or CSM to UEFI

If msinfo32 shows BIOS Mode as Legacy, don’t just flip the firmware to UEFI. Microsoft says an operating system installed in legacy mode will stop booting when the BIOS mode is changed to UEFI. Dell’s guide gives the same warning and says Windows then has to be reinstalled. Microsoft’s MBR2GPT tool is the way around that.

The reason is the disk layout. Microsoft says legacy BIOS mode requires a drive using the MBR partition style, while booting in UEFI mode needs GPT. MBR2GPT, built into supported versions of Windows, converts the system disk from MBR to GPT without deleting the data on it.

Back up first. Microsoft’s tool warns that the conversion can’t be undone, and the PC won’t start properly until the firmware is switched to UEFI afterwards.

Check the disk’s partition style. In Disk Management, right-click the disk, choose Properties and open the Volumes tab. Partition style shows MBR or GPT.
If BitLocker is on, Microsoft says protection must be suspended before converting, and the protectors deleted and recreated afterwards.
Open Command Prompt as administrator and run mbr2gpt /validate /allowFullOS. This only checks whether the disk can be converted. Microsoft lists conditions, including no more than three primary partitions and no extended partitions.
If validation passes, run mbr2gpt /convert /allowFullOS.
Restart into the firmware settings, switch the boot mode to UEFI (turn off Legacy or CSM), then enable TPM and Secure Boot.

If validation fails, stop there. Your options are to leave the PC as it is, or back up and do a clean install of Windows in UEFI mode, which erases the drive.

Frequently asked questions

Is TPM 2.0 on the motherboard or the CPU?

It can be either. Microsoft says TPM 2.0 can be a separate chip, integrated alongside other components, or run as firmware in a trusted area of the main processor platform. Intel PTT and AMD fTPM are firmware TPMs, which is why many PCs have TPM 2.0 without a separate chip.

Is TPM 2.0 the same as Secure Boot?

No. TPM is a security component that protects encryption keys, while Secure Boot is a feature of UEFI firmware. Microsoft lists Secure Boot as working without a TPM. Windows 11 needs TPM 2.0 and a Secure Boot capable PC.

Why does tpm.msc say “Compatible TPM cannot be found”?

Microsoft says this message can mean the TPM is disabled. Turn it on in the UEFI settings as described above. If you can’t find the option, check your manufacturer’s support site or update the BIOS.

What if my processor isn’t supported?

Enabling TPM and Secure Boot won’t help if the processor itself isn’t on Microsoft’s list. See how to check your CPU generation and whether your PC can run Windows 11. If it can’t, Windows 10 ESU keeps security updates coming until October 12, 2027.