Key takeaway
Check the current state in Windows first. Change firmware settings using the device maker’s instructions and confirm you can retrieve the BitLocker recovery key.
Check TPM and Secure Boot in Windows
TPM (Trusted Platform Module) protects cryptographic keys; Secure Boot is a UEFI feature that checks trusted digital signatures on boot software. They are separate protections and do not replace antivirus or backups. To check TPM, press Win+R, enter tpm.msc, and check for specification version 2.0 and a ready status. In System Information (msinfo32), check BIOS Mode and Secure Boot State. Compare the result with the manufacturer’s instructions for your exact device because menu names and available settings vary.
Change UEFI settings using the device instructions
Save your work first. Use the startup key in the device instructions, or in Windows 11 open Settings > System > Recovery > Advanced startup > Restart now, then Troubleshoot > Advanced options > UEFI Firmware Settings > Restart. If the option is missing, consult the manufacturer; do not switch Legacy/CSM mode blindly. TPM may be named Intel PTT, AMD fTPM or TPM/Security Device. Enabling TPM is different from clearing it: Clear TPM can delete keys and is not needed for this check. Enable Secure Boot only after confirming compatibility with the device and Windows installation. Change only the required settings and recheck both states after Windows starts. Obtain BIOS updates only from the exact model’s official support page and follow its procedure.
Protect the recovery key for an encrypted drive
Changing TPM or firmware settings can trigger a recovery prompt on an encrypted drive. Before making changes, locate the BitLocker recovery key in an organization-approved store and confirm you can retrieve it from a separate trusted device. Do not keep the key on the same device or in an exposed file. If an unexpected recovery screen appears, avoid changing settings at random; use the key and contact the device owner or IT support.