How do I enable my TPM?

Enabling your processor’s built-in firmware TPM is easy, but finding the setting to do it sometimes isn’t. If you’re unsure what you’re doing, try searching for “[manufacturer of your computer or motherboard] enable TPM” because many manufacturers have created help pages specifically because of Windows 11.

For Intel systems, if you can’t find a setting marked “TPM” somewhere in the chipset or security settings, look for “Platform Trust Technology” or “PTT” and enable that. AMD systems usually just refer to it as an “fTPM,” though you may also see it called the “Platform Security Processor,” or “PSP.”

Once you’ve enabled your TPM, reboot into Windows and look at the Device Manager or use the Health Check app to ensure it’s working properly.

How do I enable Secure Boot?

Any computer made since Windows 8 was released in 2012 ought to support Secure Boot, which helps prevent unsigned and potentially malicious software from being loaded during your PC’s boot process. You should be able to turn it on in your PC’s BIOS if it isn’t already enabled, usually either in a “Security” or “Boot” section. As with enabling your TPM, if you can’t find the setting, check your PC's or motherboard’s manual.

If your computer won’t boot after you enable Secure Boot, don’t worry—you just need to go through a couple of additional steps. Failure to boot is most likely because your hard drive or SSD is set up with an MBR (or Master Boot Record) partition table rather than the newer GPT (GUID Partition Table) format that Secure Boot and UEFI both require.

To check, right-click the Start button or use the Windows + X keyboard shortcut and then click Disk Management in the menu that pops up. Right-click whatever drive that Windows is installed on (in most computers, it will be Disk 0, but not always if you have multiple hard drives), then click Properties, then check the Volumes tab. If your partition style is listed as MBR, that's when you'll need to convert the drive.