TPM 2.0 Explained: What It Is and How to Enable It in BIOS

TPM 2.0 is a Trusted Platform Module, version 2.0: a dedicated security chip (or firmware equivalent) that generates and locks away cryptographic keys, verifies that your PC booted with untampered software, and underpins Windows 11's security model. It became a mainstream search term because Windows 11 requires it and because several of 2026's biggest multiplayer games now lean on the same Secure Boot chain it protects, so a disabled or missing TPM can block an OS upgrade or stop a game from launching at all.

What Is TPM 2.0, Exactly?

A TPM is a microcontroller built specifically to handle cryptographic operations in isolation from the rest of the PC. According to Microsoft Learn's Trusted Platform Module technology overview, the chip "includes multiple physical security mechanisms to make it tamper-resistant," and software running on the PC cannot reach in and tamper with its security functions. Microsoft lists three core jobs for the TPM: generating, storing and limiting the use of cryptographic keys; authenticating the device itself using a unique RSA key burned into the chip at manufacture; and measuring and recording the boot process so the system can later prove how it started.

That last function is what matters most for day-to-day security. During boot, firmware and OS components are measured and those measurements are sealed inside the TPM. A key can then be configured so it is simply unusable unless those measurements match — Microsoft Learn specifically frames this as a phishing mitigation, since "the key [cannot] be copied and used without the TPM." The chip also has a built-in lockout: too many wrong authorization attempts and its "dictionary attack logic" starts refusing further guesses.

The actual specifications come from the Trusted Computing Group (TCG), the industry body Microsoft Learn points to for version differences. TCG's own TPM summary describes the chip as something that can "securely store artifacts used to authenticate the platform," including passwords, certificates and encryption keys, and stresses that the TPM itself does not decide policy — "other applications" are the ones that set and enforce how its stored secrets get used. In practice that list of applications is long: BitLocker drive encryption, Windows Hello, VPN and Wi-Fi credential storage, digital signing, and acting as a hardware-backed substitute for a physical smart card.

Why Windows 11 Requires TPM 2.0

Microsoft's official Windows 11 specifications page spells the requirement out plainly: a PC must have "Trusted Platform Module (TPM) version 2.0," plus firmware that is "UEFI, Secure Boot capable." Both boxes have to be checked, because Secure Boot (which only allows trusted, signed bootloaders to run) and the TPM's boot-measurement function work together — Secure Boot stops untrusted code from loading, and the TPM records and attests to what actually did load.

This pairing is also why TPM 2.0 shows up constantly in searches tied to BIOS troubleshooting rather than a standalone security topic. If you're mid-upgrade and Windows Setup refuses to continue, or a PC assembled a few years ago suddenly can't take the Windows 11 upgrade, a TPM that exists on the motherboard but is switched off in firmware is the single most common cause. It's the same category of "hidden switch" that trips people up with other BIOS-gated features — Resizable BAR is a good comparison, since both are capabilities many motherboards ship with but don't enable out of the box.

TPM 2.0 also sits underneath Microsoft's broader push toward hardware-backed security on newer PCs. The Copilot+ PC requirements Microsoft set for its newest AI-capable laptops build on the same TPM-and-Secure-Boot foundation that Windows 11 introduced, rather than replacing it.

TPM 2.0 vs. TPM 1.2: What Actually Changed

Windows had supported the older TPM 1.2 specification for years before Windows 11 made TPM 2.0 mandatory. Microsoft Learn's own device-health-attestation support table shows exactly where the line is drawn across Microsoft's current platforms:

Microsoft Learn adds one more technical wrinkle that explains a lot of BIOS confusion: "TPM 2.0 requires UEFI firmware. A device with legacy BIOS and TPM 2.0 won't work as expected." In other words, enabling a TPM 2.0 setting isn't enough on its own if the motherboard is still booting in legacy/CSM mode instead of native UEFI — both settings typically need to be switched together.

Discrete TPM vs. fTPM vs. Intel PTT

Not every TPM 2.0 implementation is a separate physical chip soldered to the motherboard. Microsoft's own support documentation for enabling TPM lists the firmware menu labels PC makers use, and they map to two different approaches:

• Discrete TPM: a physical security chip, separate from the CPU, on the motherboard — labeled "Security Device," "Security Device Support," or "TPM State" in some firmware menus.
• AMD fTPM: a firmware TPM implemented inside AMD's Platform Security Processor, shown in BIOS as "AMD fTPM switch" or "AMD PSP fTPM."
• Intel PTT: Intel's equivalent firmware TPM, labeled "Intel PTT" or "Intel Platform Trust Technology."

All three satisfy the Windows 11 TPM 2.0 requirement; which one a given PC has depends on the motherboard and CPU vendor, not on anything the user chooses beyond flipping the right switch in firmware. A firmware TPM and a discrete TPM aren't functionally different from Windows' point of view — both report a Specification Version and both get checked the same way — so there is no advantage to seeking out a discrete module unless a specific enterprise security policy calls for one.

Buying a separate physical TPM module, something that briefly became a minor cottage industry during the original Windows 11 launch window when fTPM and PTT support was less universal, is rarely necessary on anything built in the last few years. Every current AMD and Intel consumer platform ships a firmware TPM by default; the remaining friction is almost always that it is present but switched off, not that the capability is missing outright.

Why PC Games Are Suddenly Asking for Secure Boot and TPM

A second wave of TPM 2.0 searches has nothing to do with upgrading Windows. Kernel-level anti-cheat software — the drivers modern competitive shooters use to catch cheats before they can tamper with the game process — increasingly checks the same Secure Boot chain that Windows 11 made mandatory. Riot Games is explicit about this for VALORANT: its support page on what Vanguard is states that the driver "automatically enables similar security standards to Windows Secure Boot while Vanguard is on," and that a system tray icon reports whether a PC currently meets "the requirements to run Vanguard."

That's also why searches like "Vanguard Secure Boot error" and "TPM 2.0 Battlefield 6" spike every time a major shooter patches in or tightens its anti-cheat: if Secure Boot gets disabled (sometimes as a side effect of a GPU driver install, a dual-boot setup, or a BIOS update resetting firmware defaults) or the TPM is switched off, the anti-cheat driver can refuse to load even though the game itself runs fine. The practical fix is almost always the same regardless of which game triggered it — confirm Secure Boot and TPM 2.0 are both enabled in firmware, since the two are generally checked together. Anti-cheat driver requirements have become enough of a factor in whether a game runs at all that they're now effectively part of the system-requirements conversation alongside GPU and CPU specs, the way Modern Warfare 4's PC requirements coverage had to account for Ricochet anti-cheat on top of raw hardware specs.

None of this means a player's hardware is insufficient — a PC with TPM 2.0 physically present but disabled, or Secure Boot toggled off by a firmware reset, looks identical to the game as a PC that genuinely lacks the chip. That distinction is exactly why the fix below (checking status, then re-enabling in firmware) resolves the overwhelming majority of these errors without any hardware changes at all.

How to Check If TPM 2.0 Is Already Enabled

Before touching the BIOS, it's worth confirming whether TPM 2.0 is already active — plenty of PCs built in the last several years have it on by default. Microsoft's support article on enabling TPM 2.0 on your PC gives two ways to check from inside Windows:

• Windows Security: Settings > Update & Security > Windows Security > Device Security. If there's no "Security processor" section listed, the TPM is likely disabled; if there is one, open "Security processor details" and confirm the Specification version reads 2.0.
• tpm.msc: Press Windows key + R, type tpm.msc, and press Enter. A message reading "Compatible TPM cannot be found" means it's off or missing; if it's active, the Specification Version appears under "TPM Manufacturer Information."

How to Enable TPM 2.0 in Your BIOS

If tpm.msc or Windows Security shows no TPM, Microsoft's support guidance walks through getting into firmware settings and flipping it on:

1. Go to Settings > Update & Security > Recovery, then select Restart now under Advanced startup.
2. On the blue menu, choose Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.
3. Once in firmware, look for a TPM-related option — Microsoft notes it's often tucked into an Advanced, Security, or Trusted Computing submenu.
4. Enable whichever label applies to the board: Security Device, Security Device Support, TPM State, AMD fTPM switch, AMD PSP fTPM, Intel PTT, or Intel Platform Trust Technology.
5. Save changes and exit (commonly F10), then let the PC boot normally and recheck with tpm.msc.

Microsoft's own guidance is explicit that menu wording varies by manufacturer, and it points users toward their PC maker's own support documentation — Asus, Dell, HP, Lenovo and Microsoft Surface are the vendors it names directly — if the option can't be found. Anyone already in the firmware for this reason may as well confirm the board is booting in native UEFI mode rather than legacy/CSM, since Microsoft Learn's warning about legacy BIOS breaking TPM 2.0 functionality applies here directly.

Common TPM 2.0 Problems and What They Usually Mean

What's Next

TPM 2.0 isn't a new standard, but it is becoming harder to avoid dealing with directly. Windows 11 already requires it, Microsoft's Copilot+ PC hardware tier builds further security features on top of it, and more PC game publishers are tying kernel-level anti-cheat drivers to the same Secure Boot foundation. Expect the troubleshooting side of this topic — "TPM 2.0 not enabled," "Secure Boot error," BIOS-specific enable guides — to keep showing up around every major Windows feature update and every big multiplayer launch, for the simple reason that most of the PCs affected had the hardware all along; the chip was just switched off.

Written byMara Lindqvist

Mara Lindqvist edits the hardware desk. She covers graphics cards, processors, memory and storage, the foundries and chip designers behind them, and what the numbers on a spec sheet mean for people choosing a PC. Specifications in her stories come from manufacturer spec pages and datasheets.

More from Mara LindqvistAll Hardware coverage