How to Check TPM 2.0 and Secure Boot on Windows 10

What TPM and Secure Boot are, and why Windows 11 asks for them

A TPM (Trusted Platform Module) is a small security component in the PC. It can be a separate chip or a function built into the processor platform. Microsoft's own page says Windows 11 uses it for features such as Windows Hello and BitLocker, and that TPM version 2.0 is required to run Windows 11.

Secure Boot is a startup check. Microsoft describes it as a feature that helps stop malicious software from loading when the PC starts, by letting only trusted, digitally signed software run during boot. It needs UEFI, the modern firmware that replaced the old BIOS. Microsoft notes that the firmware is commonly called UEFI and sometimes BIOS.

Windows 11 lists both in its minimum requirements: UEFI firmware that is Secure Boot capable, and TPM 2.0. The processor, memory and storage count too, so a pass here does not promise an upgrade.

Check the TPM

Two built-in checks give the same answer. Use whichever you find easier.

1. Windows Security: open Start, then Settings > Update & Security > Windows Security > Device Security. If you see a section called Security processor, open Security processor details and read the line Specification version. It must say 2.0.
2. TPM console: press the Windows key and R together, type tpm.msc and press Enter. If the window says "Compatible TPM cannot be found", the TPM may be switched off. If it shows a ready TPM, look under TPM Manufacturer Information for Specification Version. It must say 2.0.

Read only the line called Specification version. A version below 2.0 does not meet the Windows 11 requirement. If Device Security has no Security processor section at all, Microsoft says the PC may still have a TPM that is disabled.

A third route is the PC Health Check app from Microsoft. Press Check now, and it explains why the PC is or is not eligible. It also covers the processor, memory and storage, which the two checks above do not.

Check Secure Boot and UEFI mode

Right-click the Start button and open Windows PowerShell as administrator, or type PowerShell in the Start search, right-click it and choose Run as administrator. Type this and press Enter:

Confirm-SecureBootUEFI

Microsoft's reference for this command describes four possible results, including the administrator error. They are in the table in the next section. A normal window will not work: it must be run as administrator.

A second way: press the Windows key and R together, type msinfo32 and press Enter, then read the Secure Boot State line in System Summary. Microsoft says that On means Secure Boot is on. The label differs by language.

Capable is not the same as on. Microsoft states that the requirement to upgrade a Windows 10 PC is only that it is Secure Boot capable, which means UEFI is enabled. It adds that turning Secure Boot on is better for security.

Certificate renewal. Microsoft is replacing the Secure Boot certificates it issued in 2011, which start to expire in June 2026. On a supported version of Windows this normally happens through Windows Update. Windows 10 support ended on October 14, 2025, so Extended Security Updates (ESU) are needed for these updates. If Secure Boot is off, ask the PC maker about firmware updates before you change it. Source: Microsoft, Windows devices for home users, businesses and schools with Microsoft-managed updates.

Read your results

Match what you see to the first column, then follow the last one.

Turn them on in the firmware

Both settings live in the firmware, not in Windows, and menus differ from one maker to the next. Back up your files before you start.

1. Open Settings > Update & Security > Recovery and press Restart now under Advanced startup. On Windows 11 the path is Settings > System > Recovery.
2. After the restart choose Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.
3. For the TPM, look in a sub-menu called Advanced, Security or Trusted Computing. Microsoft lists these labels: Security Device, Security Device Support, TPM State, AMD fTPM switch, AMD PSP fTPM, Intel PTT and Intel Platform Trust Technology. Switch it on.
4. For Secure Boot, first check the boot mode. If the PC is set to Legacy (also called CSM), switch it to UEFI. If both are offered, Microsoft says to choose UEFI first or only. Secure Boot can only be enabled with UEFI, and some firmware settings make it look unavailable until the mode is right.
5. Save, exit, let Windows start, and run the checks again.

If you are not sure which menu entry is right, look at your PC maker's support page for the exact model.

Disk warning. A Windows installation made in Legacy mode usually sits on an older disk layout called MBR. UEFI mode goes with the newer layout, GPT. Microsoft's MBR2GPT page says the firmware must be set to UEFI after a disk is converted, so the two changes go together. Do not switch the boot mode on its own and hope Windows still starts.

Microsoft's MBR2GPT tool can convert a disk without deleting data, but a backup is still the sensible first step. Its check command only reads the disk and changes nothing:

mbr2gpt.exe /validate /disk:0

Disk 0 is the usual system disk, but confirm yours before relying on the result. Run the conversion itself only after the check passes and the backup is safe. Microsoft says it normally runs from Windows PE, with a switch for full Windows. If the drive is encrypted, find that out first and keep the recovery key somewhere else. That is general advice, not a statement from Microsoft's pages.

When the setting does not exist

Some PCs have no TPM entry anywhere in the firmware. Microsoft says most PCs shipped in the last 5 years can run TPM 2.0. The word to notice is capable: a PC can be able and still have it turned off. Microsoft adds that boards bought for home builds often ship with the TPM off, even though it is almost always available to switch on. Older office machines are the likely ones to have no TPM 2.0 at all.

The processor is the other common blocker. Windows 11 needs 1 GHz or faster, two or more cores, and a model on Microsoft's list of approved processors. Microsoft calls clock speed and core count components you cannot upgrade. Memory and storage are sometimes options. Microsoft publishes the lists for Intel and AMD, so look up your exact model. The PC Health Check app tells you whether the processor is the blocker.

If the TPM is below 2.0, the Secure Boot option is missing from a UEFI machine, or the processor is not listed, that PC is not a simple firmware fix. Check the maker's page for your model; if it offers nothing, your choices are a different PC or staying on Windows 10 for now. Our guide on the Windows 10 to Windows 11 options covers the second route.

Checking five office PCs by hand

A tool that reads each PC on a network from one computer and puts the answers in one list saves the walk round the office. Without one, a sheet of paper works. For each PC, in this order:

1. Run PC Health Check and press Check now. Write down the reason it gives.
2. Open Device Security and write the Specification version, or the words no Security processor.
3. Run Confirm-SecureBootUEFI as administrator and write what it prints.
4. Mark the PC as ready, firmware fix, or does not meet the requirement using the table above.
5. For firmware fixes, back up first and note the PC maker and model so you can open the right support page.

Here is an invented example for an office of five. These are not real results.

That makes one ready, two to fix in the firmware, one that does not meet the requirement and needs the maker's page, and one blocked by the processor. The tally shows how much work there is before anyone changes a setting.

Questions

Keep reading

More guides

About Readylook

Readylook is our Windows app that checks whether the PCs on your network are ready for Windows 11 and builds one report. It only reads: nothing is installed on the PCs it scans, and no data is sent to us. The report is a guide, not a guarantee. It is not in the Microsoft Store yet.

Sources

• Microsoft: Enable TPM 2.0 on your PC
• Microsoft: Windows 11 system requirements
• Microsoft Learn: Confirm-SecureBootUEFI
• Microsoft Learn: MBR2GPT.EXE
• Microsoft: Windows devices for home users, businesses and schools with Microsoft-managed updates
• Microsoft: Windows 11 on devices that don't meet minimum system requirements

Checked 2026-11-03.