Modern Warfare 4 TPM 2.0 and Secure Boot: how to check and enable them

Why MW4 needs this

Modern Warfare 4 uses a kernel-level anti-cheat that checks the machine is in a trusted boot state before it lets you into a game. That trust chain depends on two firmware features:

• TPM 2.0 — a hardware or firmware security module that stores keys and measurements.
• Secure Boot — a UEFI feature that only allows signed, trusted code to load during boot.

If either is missing or turned off, MW4 refuses to start. A PC that ran previous Call of Duty titles fine can still be blocked here, because those games did not enforce both.

Step 1 — Check what you already have

Do this before touching the BIOS. Many machines already have both enabled.

Secure Boot:

1. Press Win+R, type msinfo32, press Enter.
2. On the System Summary page, find Secure Boot State.

- On — you are done for Secure Boot. - Off — it is supported but disabled; enable it in the BIOS (step 3). - Unsupported — usually means the disk is in Legacy/MBR mode rather than the card lacking support. See the GPT/UEFI section.

1. Check BIOS Mode on the same page. It should read UEFI, not Legacy.

TPM 2.0:

1. Press Win+R, type tpm.msc, press Enter.
2. If it says "The TPM is ready for use", check the Specification Version reads 2.0.
3. If it says "Compatible TPM cannot be found", the TPM is disabled in firmware, not necessarily absent — enable it in the BIOS (step 2).

Step 2 — Enable the TPM in your BIOS/UEFI

Restart and enter firmware setup. The key is shown briefly at boot — commonly Del or F2 on desktops, F2, F10 or Esc on laptops. Alternatively, from Windows: Settings → System → Recovery → Advanced startup → Restart now → Troubleshoot → Advanced options → UEFI Firmware Settings.

Find the TPM setting. It is usually under Security, Advanced, or a Trusted Computing submenu, and the name depends on your CPU:

Set it to Enabled, then save and exit. Back in Windows, re-run tpm.msc to confirm it now reads 2.0.

Step 3 — Enable Secure Boot

Still in the BIOS/UEFI, find Secure Boot (usually under Boot or Security).

• If it is available, set it to Enabled. Choose Standard keys and, where offered, an OS Type of Windows UEFI mode.
• Save and exit, then confirm with msinfo32 that Secure Boot State now reads On.

If the Secure Boot option is greyed out or missing, it is almost always because of one of the gotchas below — fix those first, then come back here.

The GPT/UEFI and CSM gotchas

Secure Boot only works when the machine boots in pure UEFI mode from a GPT disk. Older installs often boot in Legacy/CSM mode from an MBR disk, which is why the toggle is locked out.

1. Disable CSM. Find CSM (Compatibility Support Module) or Legacy Boot and set it to Disabled. Set the boot mode to UEFI only. This is what unlocks the Secure Boot option on most boards.
2. Convert the disk to GPT if it is still MBR. Do not just wipe it. Windows includes MBR2GPT, which converts your existing install in place:

- Check first from Windows: open an admin Command Prompt and run mbr2gpt /validate /allowFullOS. - If it validates, run mbr2gpt /convert /allowFullOS. - Back up important files first. A boot-layout change is low-risk with MBR2GPT but never zero-risk.

1. After converting, set the boot mode to UEFI, disable CSM, then enable Secure Boot and save.

Check your disk's current style any time in Disk Management → right-click the disk → Properties → Volumes → Partition style (GPT or MBR).

Common problems

• Secure Boot State still says "Unsupported" after enabling it. The disk is probably still MBR/Legacy. Convert to GPT and disable CSM (above).
• fTPM/PTT setting is missing. Update the motherboard BIOS to the latest version — older firmware sometimes hides or lacks the option.
• AMD fTPM stutter. Some older AMD boards had audio/stutter issues with fTPM; the fix is a BIOS update, not disabling fTPM (which MW4 needs on).
• You enabled it but MW4 still complains. Reboot fully after making the changes, and double-check both tpm.msc (reads 2.0) and msinfo32 (Secure Boot State = On) before launching.
• Laptop with no options. Some OEM laptops expose very little firmware control. Look for a BIOS/firmware update from the manufacturer that adds or defaults these settings on.
• BitLocker prompt. If your drive is BitLocker-encrypted, changing firmware settings can trigger a recovery-key prompt on the next boot. Have your BitLocker recovery key to hand before you start.

Once both read as on in Windows, MW4's anti-cheat requirement is satisfied. If the game still will not start for other reasons, work through the MW4 crashing and won't-launch guide.

FAQ

More Modern Warfare 4 guides