How to Enable TPM 2.0 and Secure Boot for COD and Battlefield 6

To play Call of Duty: Black Ops 7, Warzone, the upcoming Modern Warfare 4, Battlefield 6 or Valorant on a Windows PC, you need two firmware security features turned on: TPM 2.0 and Secure Boot. Most PCs from the last several years already support both, but on many self-built desktops they are switched off. Enabling them takes about 10 minutes: check the current status in Windows, confirm your drive uses GPT and your firmware boots in UEFI mode, then switch both features on in the UEFI/BIOS menu.

Why do games now require TPM 2.0 and Secure Boot?

Both features make it harder for cheat software to load before Windows and the anti-cheat do. Secure Boot is a UEFI firmware feature that only lets trusted, digitally signed software run while the PC starts up. TPM 2.0 (Trusted Platform Module) is a hardware-backed security chip, or firmware equivalent, that Windows uses for features such as BitLocker and Windows Hello. Anti-cheat systems use it to check that the PC hasn’t been tampered with.

Publishers say this plainly. Activision’s TPM 2.0 and Secure Boot support article for Call of Duty says the two features “help protect your system against cheats and unauthorized access by verifying your PC’s integrity from startup to gameplay” and work alongside its RICOCHET anti-cheat. EA’s Battlefield 6 Secure Boot notice lists what it targets: kernel-level cheats and rootkits, memory manipulation and injection, hardware ID spoofing, virtual machines and tampering with its EA Javelin anti-cheat.

Which games need TPM 2.0 and Secure Boot?

This is what each publisher states on its own support pages as of September 2026:

Activision’s PC specifications for the Modern Warfare 4 beta said TPM 2.0 and Secure Boot “are required to play” the game, and the requirement continues into the full release on 23 October. Riot’s VAN 9001 support page explains that the error means “Vanguard currently requires TPM 2.0, but doesn’t detect TPM 2.0 as enabled on your PC,” while VAN 9003 means Secure Boot is not enabled.

Does my PC support TPM 2.0 and Secure Boot?

If your PC runs Windows 11, it almost certainly does. Microsoft requires TPM 2.0 for Windows 11, and Activision notes that Windows 11 PCs “likely already have both security features enabled”. On Windows 10 you may need to change some settings.

Activision lists these minimum requirements:

• Windows: Windows 10 version 22H2 or later, or Windows 11. Windows 10 itself stopped receiving free security updates on 14 October 2025, according to Microsoft.
• Intel: 8th Gen Core or newer, using Intel Platform Trust Technology (PTT).
• AMD: Ryzen 2000 series or newer, using AMD firmware TPM (fTPM).
• A discrete TPM 2.0 module (dTPM) also works.
• Boot mode: UEFI, not Legacy/CSM.
• System disk: GPT partition style, not MBR.

Microsoft’s Enable TPM 2.0 on your PC guide says most PCs shipped in the last five years can run TPM 2.0. It adds that most retail motherboards used in self-built PCs “ship with TPM turned off by default even though it is almost always available to be enabled.” That’s why custom desktops are the machines most likely to fail these checks.

Step 1: Check whether TPM and Secure Boot are already on

Check first, because you may not need to change anything.

Check Secure Boot

1. Press Windows + R, type msinfo32 and press Enter.
2. Select System Summary.
3. Find BIOS Mode. It should say UEFI.
4. Find Secure Boot State. It should say On.

EA’s help article explains the other results. If Secure Boot State is Off, you can enable it. If it says Unsupported, check your motherboard’s specifications. If BIOS Mode says Legacy, check your disk’s partition style first (Step 2).

Check TPM

1. Press Windows + R, type tpm.msc and press Enter.
2. If the status says The TPM is ready for use, look under TPM Manufacturer Information and confirm the Specification Version is 2.0.
3. If you see Compatible TPM cannot be found, the TPM is probably disabled in firmware. Microsoft says it can usually be enabled.

You can also go to Settings > Privacy & security > Windows Security > Device security (on Windows 10: Update & Security > Windows Security > Device security). If there is no Security processor section, the TPM may be disabled.

For Call of Duty, Activision’s Secure Attestation Wizard runs every check in one go. It’s a small .zip download from the Activision support article (version 1.2.0, updated 16 September 2026). Extract it, run CODSecureAttestationWizard.exe, accept the terms and start the scan. It reports which requirement you fail: TPM 2.0, Secure Boot, GPT partition or UEFI boot mode.

Step 2: Make sure your Windows drive uses GPT, not MBR

Secure Boot needs a disk that uses the GUID Partition Table (GPT). Older Windows installs, especially ones upgraded from Windows 7, sometimes still use a Master Boot Record (MBR) disk.

1. Press Windows + X and open Disk Management.
2. Right-click the disk that holds C: (on its left-hand label), then choose Properties and the Volumes tab.
3. Look at Partition style. If it says GUID Partition Table (GPT), go to Step 3.

If it says MBR, Windows includes a converter. Microsoft’s MBR2GPT documentation says the tool converts the system disk “without modifying or deleting data on the disk”. It normally runs in Windows PE, but the /allowFullOS switch lets it run from the Windows you’re using. Open PowerShell or Command Prompt as administrator and run:

1. mbr2gpt /validate /disk:0 /allowFullOS to check that the disk can be converted.
2. mbr2gpt /convert /disk:0 /allowFullOS to convert it.

Replace 0 with your system disk’s number from Disk Management. The tool checks the layout before changing anything. It refuses to convert a disk that has more than three primary partitions or has extended or logical partitions. If BitLocker is on, suspend it first. Once the disk is GPT, you must switch the firmware to UEFI boot mode (Step 5), or the PC won’t boot from that drive. Back up important files before you convert.

Step 3: Open your UEFI/BIOS settings

You can get into firmware settings from Windows, so you don’t need to press a key during startup:

1. Open Settings > System > Recovery and select Restart now next to Advanced startup. Save any open work first.
2. After the restart, choose Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.

The PC restarts into the manufacturer’s setup screen. Every brand lays it out differently. Many modern UEFI menus have a search box: EA’s guide shows one that opens with F9. The same menu also has your RAM’s XMP or EXPO profile, which we cover in our guide to checking RAM speed and enabling XMP or EXPO.

Step 4: Turn on TPM 2.0 (fTPM or PTT)

TPM is rarely labelled “TPM” in the menu. Microsoft lists the names it appears under: Security Device, Security Device Support, TPM State, AMD fTPM switch, AMD PSP fTPM, Intel PTT or Intel Platform Trust Technology. It’s usually under an Advanced, Security or Trusted Computing sub-menu.

• AMD Ryzen boards: look for AMD fTPM or AMD PSP fTPM and set it to Enabled.
• Intel boards: look for Intel PTT or Platform Trust Technology and set it to Enabled.
• Discrete TPM module: choose the discrete TPM option if your board has one installed.

Don’t leave firmware settings yet if Secure Boot is also off. You can do both before you save.

Step 5: Switch to UEFI mode and turn on Secure Boot

1. Go to the Boot tab (on some boards, Security). If there is a CSM (Compatibility Support Module) or Legacy boot option, disable it, or set the boot mode to UEFI only. Microsoft notes that if a board offers both UEFI and Legacy/CSM, UEFI must be the first or only option.
2. Find Secure Boot and set it to Enabled. If your board has an OS Type setting, EA’s guide says it should be set to Windows UEFI mode.
3. If Secure Boot shows as enabled but inactive, or you can’t change it, reset the Secure Boot keys to their factory values; the option is usually in a Key Management sub-menu. EA notes that some manufacturers require this reset, or a BIOS admin password, before the setting can be changed.
4. Go to Exit, choose Save Changes & Reset, and confirm.

Back in Windows, run msinfo32 and tpm.msc again to confirm both settings are on, then launch the game. EA says some Windows versions need one more restart before the change fully takes effect.

Troubleshooting: still getting the error?

Call of Duty still says TPM isn’t enabled

Activision’s support article says some PCs keep getting prompted even with TPM 2.0 enabled, and in that case the fix is a motherboard BIOS/firmware update. Download the latest BIOS from your board maker’s support page and follow its instructions. Then run the Secure Attestation Wizard again.

Secure Boot option is greyed out

This almost always means CSM/Legacy boot is still on, or the Secure Boot keys aren’t installed. Disable CSM, restore the factory keys, save, and check again.

The PC won’t boot after the change

This usually happens when the system disk is still MBR while the firmware is now UEFI-only. Go back into firmware settings, turn CSM back on so Windows starts, convert the disk with MBR2GPT (Step 2), then turn CSM off again.

Valorant shows VAN 9001 or VAN 9003

Riot’s support pages say VAN 9001 means Vanguard can’t detect TPM 2.0 and VAN 9003 means Secure Boot isn’t enabled. The fix is Step 4 or Step 5 above, then a restart.

Playing inside a virtual machine

EA lists virtual machines and emulation among the cheating methods its Battlefield protections target, so turning on TPM and Secure Boot inside a VM is not a supported way to play.

A note on the 2026 Secure Boot certificate update

Microsoft’s Windows 11 and Secure Boot support page says it is updating the Secure Boot certificates first issued in 2011, which “are set to expire starting in June 2026.” On a supported version of Windows the update happens automatically through Windows Update. That’s another reason to keep Windows current: an older Windows 10 build may already fail Activision’s 22H2 minimum, and if you plan to upgrade anyway, our guide to moving from Windows 11 24H2 to 25H2 covers the latest release.

Bottom line

For most people with a PC from the last few years, this is a one-time, 10-minute change: enable fTPM or PTT, disable CSM, enable Secure Boot, save. The only step with any real risk is converting an MBR disk to GPT. Back up first, validate before converting, and switch the firmware to UEFI straight afterwards. If you plan to play Modern Warfare 4 on PC at launch on 23 October, do it now so you aren’t stuck in firmware menus on launch night.

Written byJonah Reyes

Jonah Reyes leads Pandromeda's gaming coverage: console and handheld hardware, release dates, pricing changes, patch notes and the business moves behind the biggest franchises. He sources every date and price from the platform holders and publishers themselves, and says plainly when something is still only a rumour.

More from Jonah ReyesAll Gaming coverage