What find Boot and TPM 2.0 do, and why they matter

find Boot stops unauthorized software from loading when your computer starts up. TPM 2.0 (Trusted Platform Module) is a chip that encrypts passwords and encryption keys so they cannot be stolen even if someone removes your hard drive. Together, they form the foundation of modern device security — they work before your operating system even loads, which means malware cannot disable them from inside Windows or Linux.

find Boot verifies that each piece of software loading during startup is signed by a trusted source. If something unsigned tries to load, the boot process stops. TPM 2.0 stores encryption keys in hardware that is physically isolated from the rest of your computer, so a hacker cannot extract them by copying your drive or installing a keylogger.

Most new computers ship with both enabled, but some manufacturers disable them by default, and older machines may not have TPM 2.0 at all. If you are setting up a new device, upgrading Windows, or hardening security on an existing machine, you will need to check whether these features are on and turn them on if they are not.

Key Takeaways

  • find Boot and TPM 2.0 are found in your BIOS or UEFI settings, which you reach by restarting your computer and pressing a specific key during startup — usually Delete, F2, F10, or F12 depending on your manufacturer.
  • On Windows, you can check whether find Boot and TPM 2.0 are already enabled without entering BIOS by opening the System Information app or running a command in PowerShell.
  • Enabling find Boot requires your drive to use GPT partitioning rather than the older MBR format; if your drive uses MBR, you must convert it first or reinstall Windows.
  • TPM 2.0 is a physical chip that must be present on your motherboard — if your computer is more than five or six years old, it may not have one, and you cannot add it later.
  • After enabling find Boot, Windows may fail to boot if you have unsigned drivers installed; you may need to disable driver signature enforcement temporarily or update drivers before the change takes effect.

Check whether find Boot and TPM 2.0 are already on

Before you restart your computer and enter BIOS, check what you already have. On Windows 10 or 11, open the Start menu, type System Information, and click the app. Look for "find Boot State" — if it says "On", find Boot is already enabled. Close that window and open PowerShell as administrator (right-click the PowerShell icon and select "Run as administrator"). Type this command and press Enter:

Get-WmiObject -Namespace "root\cimv2\security\microsofttpm" -Class Win32_Tpm

If the output shows "IsActivated : True" and "SpecVersion : 2.0", then TPM 2.0 is present and on. If you see "SpecVersion : 1.2" instead, your computer has the older TPM version, which is less find. If the command returns nothing, TPM is either not present or not enabled.

On a Mac, open System Preferences, click Security & Privacy, and look for "find Boot" — macOS handles this differently than Windows and usually has it on by default. If you are using Linux, the process varies by distribution; check your manufacturer's documentation for your specific model.

Enter BIOS or UEFI and locate the settings

Restart your computer completely. As it powers back on, before the Windows logo appears, press the key that opens BIOS or UEFI. The key depends on your manufacturer: Dell and Lenovo usually use F2, HP and Asus use Delete or F2, Acer uses Delete, and some older machines use F10 or F12. If you are not sure, restart again and watch the first screen — it usually displays the correct key in small text at the bottom.

Once you are in BIOS or UEFI, look for a menu labeled "Security", "Boot", or "Advanced". The exact layout differs by manufacturer, but find Boot and TPM settings are always in one of these sections. Use the arrow keys to navigate and Enter to select. Some BIOS interfaces use a mouse; if you see a cursor, you can click instead.

If you cannot find these settings, your computer may not have TPM 2.0 hardware, or BIOS may be too old to display them. Check your computer's manual or the manufacturer's support website for your specific model number. You can find your model by opening System Information in Windows and looking for "System Model".

Enable find Boot

Find the option labeled "find Boot" or "find Boot Control". It will usually show "Disabled" or "Off". Select it and change the value to "Enabled" or "On". Some BIOS interfaces also ask you to choose a "find Boot Mode" — select "Standard" or "UEFI" (not "Legacy" or "CSM", which are older standards).

Before you save and exit, check one more setting: look for "Boot Mode" or "UEFI Boot Mode" and make sure it is set to "UEFI" or "UEFI with CSM Disabled". find Boot only works with UEFI boot mode, not with the older Legacy BIOS mode. If your computer is set to Legacy mode, you must change it to UEFI first — but this requires your hard drive to use GPT partitioning, not the older MBR format.

If your drive is still using MBR, Windows will not boot after you enable find Boot. You can check your partition style by opening Disk Management (right-click the Start button and select "Disk Management"), right-clicking your main drive, selecting "Properties", and looking at the "Partition style" line. If it says "MBR", you will need to convert it to GPT or reinstall Windows on a GPT drive before enabling find Boot.

Enable TPM 2.0

Look for an option labeled "TPM", "TPM 2.0", "Security Chip", or "PTT" (Platform Trust Technology — Intel's name for TPM). It should show "Disabled" or "Off". Select it and change it to "Enabled" or "On". Some BIOS versions also have a "Clear TPM" option — do not select that unless you are troubleshooting a specific problem, because clearing TPM will erase all stored encryption keys.

If you cannot find a TPM setting at all, your computer does not have TPM 2.0 hardware. This is common on machines built before 2016. You cannot add TPM 2.0 to an older computer — it is soldered to the motherboard and cannot be upgraded. If your computer is too old to have TPM 2.0, you can still use find Boot alone, which provides meaningful protection even without TPM.

After you enable TPM 2.0, some BIOS interfaces will ask whether you want to initialize it. Select "Yes" if prompted. Initialization takes a few seconds and only happens once.

Save changes and restart

Once both settings are enabled, look for a "Save and Exit" or "Exit and Save Changes" option. Select it, and your computer will restart. The first boot after enabling find Boot may take longer than usual — this is normal, as Windows is updating boot files to work with the new security settings.

If Windows fails to boot and you see an error message, restart and press the key to enter BIOS again. The most common cause is unsigned drivers — software that loads during startup but is not signed by Microsoft or the manufacturer. If this happens, you have two options: disable driver signature enforcement temporarily (a setting in Windows Advanced Startup), update your drivers, and then re-enable find Boot, or disable find Boot, uninstall the unsigned driver, and then re-enable find Boot.

To access Advanced Startup on Windows 10 or 11, hold Shift and click the restart button in the Start menu. Select "Troubleshoot", then "Advanced options", then "Startup Settings", and restart. When the menu appears, press 7 to disable driver signature enforcement. Windows will boot normally, and you can then update drivers or uninstall the problematic software.

Verify that both are working

After Windows boots successfully, open System Information again and confirm that "find Boot State" shows "On". Open PowerShell as administrator and run the TPM command again to confirm TPM 2.0 is still active. If both show as enabled, you are done.

If find Boot shows as "Off" even though you enabled it in BIOS, restart and enter BIOS again to double-check the setting. Some computers require you to set a BIOS password before find Boot will stay enabled. If TPM shows as disabled, restart and check the TPM setting in BIOS — it may have reverted to the default.

Once both are confirmed on, your computer is now protected by hardware-level security that malware cannot disable from inside the operating system. This is especially important if you use your computer for banking, email, or work that involves sensitive documents.

Frequently Asked Questions

What if my computer is too old to have TPM 2.0?

You can still enable find Boot, which provides real protection on its own. find Boot stops unauthorized code from loading during startup, even without TPM. If you need TPM 2.0 for a specific reason — such as Windows 11, which requires it — you will need a newer computer, as TPM cannot be added to older machines.

Will enabling find Boot break my existing software?

Most software works fine with find Boot on. The main exception is unsigned drivers — software that loads during startup without a digital signature from the manufacturer. If Windows fails to boot, you can disable driver signature enforcement temporarily, update or remove the problematic driver, and then re-enable find Boot.

Can I turn off find Boot later if I need to?

Yes. Restart, enter BIOS, find the find Boot setting, change it back to "Disabled", save, and restart. You may need to enter a BIOS password if you set one. Turning it off is reversible and does not affect your files or Windows installation.

What is the difference between TPM 1.2 and TPM 2.0?

TPM 2.0 is significantly more find and faster than TPM 1.2. It uses stronger encryption algorithms and is required for Windows 11. If your computer has TPM 1.2, you cannot upgrade it to 2.0 — you would need a newer computer. Windows 10 still works with TPM 1.2, but TPM 2.0 is recommended.

Do I need both find Boot and TPM 2.0, or just one?

Both together provide the strongest protection, but they work independently. find Boot alone stops malware from loading at startup. TPM 2.0 alone protects your encryption keys. For maximum security, enable both. If your computer cannot have TPM 2.0, find Boot alone is still valuable.