Check if Your PC Has a Vulnerable TPM or Secure Boot Issue

To check if your PC has a vulnerable TPM or Secure Boot issue, open the Windows Security app, go to Device security, and look for the Security processor and Secure Boot sections — if either shows a warning or an unsupported status, your system may be at risk. You can also run the built-in tpm.msc and msinfo32 tools to see detailed TPM firmware versions and Secure Boot state. This article explains what these vulnerabilities mean, how to check for them, and what to do if your system is affected.

What Are TPM and Secure Boot?

TPM (Trusted Platform Module) is a dedicated microcontroller that stores cryptographic keys, passwords, and certificates in hardware. It verifies the integrity of your system by checking that the boot process hasn’t been tampered with. Secure Boot is a UEFI firmware feature that only allows signed, trusted operating system loaders to run during startup. Together, they form the foundation of Windows 11’s security requirements and help protect against rootkits and bootkits.

Vulnerabilities in TPM firmware or misconfigurations in Secure Boot can let attackers bypass these protections. For example, a TPM with an outdated firmware version might have known flaws that allow an attacker to extract encryption keys. Similarly, if Secure Boot is disabled or uses a weak default key, a malicious driver could be loaded before Windows starts.

Why These Issues Matter

A vulnerable TPM or Secure Boot configuration can lead to:

Unauthorized access to encrypted data (if TPM-backed BitLocker keys are exposed)
Bootkits and rootkits that hide deep in the system, surviving OS reinstalls
Failure to meet Windows 11 hardware requirements, leaving you stuck on an unsupported OS
Compliance problems in corporate environments that require secure boot and TPM 2.0

In 2023, researchers demonstrated a TPM flaw that could leak cryptographic keys over the bus, but most real-world risks come from outdated firmware or misconfigured settings. The good news is that checking and fixing these issues is usually straightforward.

How to Check Your TPM Status

There are three main methods to check TPM status on Windows 10 and 11:

Windows Security app: Open Start, type “Windows Security,” go to Device security, and click Security processor details. You’ll see the TPM version (1.2 or 2.0) and its status.
tpm.msc: Press Win+R, type tpm.msc, and hit Enter. The console shows whether your TPM is ready, the specification version, and the manufacturer’s firmware version.
System Information: Run msinfo32, and look for “Secure Boot State” and “TPM” entries under System Summary.

If you see “TPM is not detected” or “Compatible TPM cannot be found,” your PC may have TPM disabled in BIOS/UEFI, or it may lack a TPM chip entirely (common on older or budget hardware).

How to Check Secure Boot Status

Secure Boot status is visible in the same places:

In msinfo32, look for “Secure Boot State” — it should read On or Off.
In Windows Security, go to Device security and look for the Secure Boot section. If it’s not there, your firmware may not support it or it’s disabled.

To enable or disable Secure Boot, you must enter your UEFI firmware settings (usually by pressing a key like F2, F12, Del, or Esc during startup). The exact path varies by motherboard manufacturer, but look for a “Boot” or “Security” tab. If you have a custom-built PC, check your motherboard manual. On many systems, Secure Boot requires UEFI mode (not Legacy/CSM).

Common Vulnerabilities and Their Fixes

Here are the most common TPM/Secure Boot issues and how to resolve them:

Outdated TPM firmware: Check your PC or motherboard manufacturer’s support page for a TPM firmware update. For example, Intel and AMD both release firmware updates for their integrated TPMs. Install the latest BIOS/UEFI update, which often includes TPM firmware fixes.
TPM 1.2 instead of 2.0: Windows 11 requires TPM 2.0. If you have 1.2, you may need a new TPM module or a CPU with built-in 2.0 support (most Intel 8th-gen and later, AMD Ryzen 2000 and later).
Secure Boot disabled: Enable it in UEFI. If you have a graphics card with an old VBIOS, you may need to enable “CSM” for it, but that will disable Secure Boot. Consider updating the GPU VBIOS or using a supported card.
Secure Boot with default keys: Some motherboards ship with a “Setup” mode that uses default keys. You may need to reset to “User” mode and restore factory keys. This is done in the UEFI’s Secure Boot settings.
BitLocker recovery after enabling Secure Boot: If you enable Secure Boot after BitLocker was set up, you may be prompted for a recovery key. Have your recovery key ready (stored in your Microsoft account or saved to a file).

What to Do If You Find an Issue

If your checks reveal a vulnerable TPM or Secure Boot problem, follow these steps:

Update your BIOS/UEFI: This is the most common fix. Go to your manufacturer’s website, download the latest BIOS for your exact model, and follow the instructions. Keep your PC plugged in during the update to avoid power loss.
Enable TPM and Secure Boot: In UEFI, set TPM to “Enabled” (or “Firmware TPM” on AMD systems) and Secure Boot to “Windows UEFI mode.” Save and exit.
Clear TPM (if needed): If you’re having issues after an update, you can clear the TPM from Windows Security or tpm.msc. This will erase keys and may require you to re-set up BitLocker or Windows Hello.
Check for driver or OS updates: Sometimes Windows updates include fixes for TPM-related issues. Run Windows Update and install all pending updates.

If you’re not comfortable making these changes, consult your PC manufacturer’s support or a qualified technician.

Frequently Asked Questions

Is TPM 2.0 mandatory for Windows 11?

Yes, Windows 11 requires TPM 2.0 and Secure Boot capable UEFI. If your PC doesn’t have TPM 2.0, you won’t be able to install Windows 11 through standard means. Some users bypass this with registry hacks, but that’s not recommended for security or stability.

Can I add a TPM module to my desktop PC?

Many desktop motherboards have a TPM header (usually labeled TPM or SPI TPM). You can purchase a discrete TPM 2.0 module that matches your motherboard’s connector type. Laptops and prebuilt systems often have the TPM soldered or integrated into the CPU, so you can’t upgrade them separately.

What does “Secure Boot state: Off” mean?

It means your PC is not using Secure Boot, which leaves you more exposed to bootkits. You should enable it in UEFI if your hardware supports it. Note that if you’re using a Linux distribution with unsigned bootloaders, you may need to use a signed shim or disable Secure Boot.

Will enabling Secure Boot break my dual-boot setup?

It can. If you have a Linux distribution installed, you may need to use a bootloader that supports Secure Boot (like shim) or disable Secure Boot for that OS. Windows and most modern Linux distros work fine with Secure Boot enabled.

How do I find my TPM firmware version?

Open tpm.msc and look at the “TPM Manufacturer Information” section. The version is listed under “Specification version” (e.g., 2.0) and “Firmware version” (e.g., 7.2.1.0). Compare it with the latest version from your manufacturer’s website.

What is the difference between TPM and Secure Boot?

TPM is a hardware chip that stores cryptographic keys and performs secure operations, while Secure Boot is a firmware feature that verifies the integrity of the boot process. They work together: Secure Boot ensures only trusted code runs, and TPM can attest to the boot state to external parties (like BitLocker).

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →