Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall“Secure Boot State: Unsupported” means Windows is not currently using a usable UEFI Secure Boot path. In most cases, the PC is booting in Legacy BIOS mode from an MBR disk, or Secure Boot is blocked by firmware settings, missing keys, an outdated BIOS/UEFI implementation, or hardware that cannot support the feature. Press Win+R, run msinfo32, and use the BIOS Mode value to choose the right repair: enable Secure Boot if the system is already UEFI, or convert the Windows disk from MBR to GPT before changing the firmware to UEFI.
What “Unsupported” means—and how it differs from “Off”
Open msinfo32 (System Information) and look at Secure Boot State. The three useful results are:
As an Amazon Associate I earn from qualifying purchases.
- On: Windows booted through UEFI and Secure Boot is active.
- Off: The computer is capable of Secure Boot, but the firmware setting is disabled or not currently being used.
- Unsupported: Windows cannot use a valid Secure Boot path. The usual causes are Legacy BIOS boot, an MBR system disk, unavailable Secure Boot capability, disabled or missing firmware keys, or firmware that needs an update.
Capability and current state are different. A computer can be Secure Boot-capable while reporting Off. “Unsupported” generally indicates a mode, disk-layout, firmware, key-database, or hardware problem that must be addressed before Windows can report “On.” Windows 11 expects a PC to be Secure Boot-capable through UEFI/BIOS; TPM and Secure Boot are related requirements, but they are separate controls.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Diagnose the machine before changing firmware
Do these checks in Windows first. They tell you which repair path is safe and prevent the most common boot mistake: switching a Legacy installation to UEFI before converting its disk.
#1 Best Overall
- Compatible with TPM-M R2.0
- Chipset: Infineon SLB9665
- PIN DEFINE:14Pin
- Interface:LPC
- Please check the Pinout of mainboard at the official website and make sure it compatible with the pinout of TPM module before purchasing, thank you.
- Press
Win+R, entermsinfo32, and press Enter. - Record BIOS Mode and Secure Boot State under System Summary.
- Check the system disk’s partition style. In an elevated Windows Terminal or PowerShell window, use Disk Management or a disk utility to confirm whether the Windows disk is MBR or GPT. Do not delete or recreate partitions to change the style.
- Open Windows Security and inspect the security processor, or press
Win+R, runtpm.msc, and check whether the TPM is present and ready. - Write down the BitLocker recovery key and follow your organization’s approved process for suspending protection before firmware or boot-partition changes.
| What you find | Likely meaning | Correct next move |
|---|---|---|
| BIOS Mode: UEFI; Secure Boot State: Off | UEFI is already active, but Secure Boot is disabled, blocked by CSM/Legacy settings, or missing enrolled keys. | Use the UEFI firmware menu to disable CSM/Legacy boot as needed, enroll default keys if offered, and enable Secure Boot. |
| BIOS Mode: Legacy; Windows disk: MBR | Windows cannot use the normal UEFI Secure Boot chain from the current installation. | Back up, verify BitLocker recovery information, convert the system disk with the supported MBR2GPT workflow, then change firmware boot mode to UEFI. |
| BIOS Mode: Legacy; disk already GPT | The firmware is still booting in Legacy/CSM mode even though the disk layout may be suitable for UEFI. | Confirm that a Windows UEFI boot entry exists, switch firmware to UEFI-only, and repair the boot entry if the manufacturer’s instructions require it. |
| BIOS Mode: UEFI; Secure Boot is absent or greyed out | CSM, administrator firmware policy, outdated firmware, or missing key databases may be preventing the setting. | Check the manufacturer’s manual, update BIOS/UEFI when appropriate, and restore or install factory Secure Boot keys. |
| TPM is missing or not ready | The firmware TPM may be disabled, or the PC may lack a compatible TPM. | Enable the correct firmware security option and recheck Windows; if the hardware has no compatible TPM or UEFI Secure Boot capability, software changes cannot create it. |
Prepare safely: backups, BitLocker and recovery media
Changing boot mode or Secure Boot changes the trust measurements that Windows and BitLocker use. A successful change can therefore produce a BitLocker recovery prompt on the next boot even when no files were damaged.
- Back up important files before converting a disk or updating firmware. Keep a copy that is available without booting the affected Windows installation.
- Confirm that the BitLocker recovery key is stored somewhere you can reach from another device. If the PC belongs to an organization, use its required key-escrow and suspension procedure.
- Do not begin a conversion if the disk has errors, encryption is in an unknown state, or you cannot recover the machine if it fails to boot.
- Use a USB drive only when the PC maker’s or Microsoft’s recovery procedure specifically calls for removable media. Recovery procedures can require FAT32 formatting, a particular directory, and a particular file name.
If Windows asks for the recovery key after the change, enter the saved key rather than repeatedly powering the machine off. If the key is unavailable, stop and use the manufacturer’s or organization’s recovery process.
Repair path A: UEFI is already active
Choose this path when msinfo32 reports BIOS Mode: UEFI. Do not convert partitions merely because Secure Boot says Off or Unsupported; first correct the firmware configuration.
1. Enter the firmware setup
Restart and use the setup key documented for the exact motherboard or laptop model. The key and menu names differ by manufacturer, so the model’s current support documentation is more reliable than a generic key list.
2. Remove the setting that forces Legacy boot
Look for Legacy Boot, CSM (Compatibility Support Module), or a similar compatibility option. Disable it, or select UEFI-only mode, if it prevents Secure Boot from being enabled. Some firmware exposes Secure Boot only after CSM is disabled.
Rank #2
- Nuvoton NPCT650
- TCG PC Client Platform TPM Profile (PTP) Specification; Family 2.0 (Trusted Platform Module Library; Family 2.0)
- TCG PC Client Specific TPM Interface Specification (TIS), Version 1.3 (TPM Main Specification; Family 1.2 Revision 116)
- Low Standby Power Consumption
3. Select the Windows UEFI boot entry
In the boot-order screen, choose the entry that identifies Windows as a UEFI loader (often displayed as a Windows boot manager entry) rather than a raw disk entry. Saving the wrong entry can leave the PC looking for a Legacy boot loader.
4. Enroll the default Secure Boot keys when necessary
If the menu offers Install default keys, Restore factory keys, or equivalent wording, follow the manufacturer’s documented procedure. A blank or damaged key database can make Secure Boot appear unavailable even when the hardware supports it.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors5. Enable Secure Boot and restart
Save the firmware changes, allow Windows to start, and run msinfo32 again. The target result is BIOS Mode: UEFI and Secure Boot State: On. If Windows no longer starts, return to firmware, restore the previous boot setting, and use the model-specific recovery instructions before making another change.
If Secure Boot still cannot be enabled, reset BIOS/UEFI settings to factory defaults as the manufacturer or Microsoft recommends, then reapply only the required UEFI, TPM and boot-order settings. A custom overclock, storage mode, or administrator policy may otherwise be masking the real cause.
Repair path B: convert a Legacy/MBR Windows installation
Choose this path when msinfo32 reports BIOS Mode: Legacy and the Windows disk is MBR. A Legacy/MBR installation cannot provide the expected UEFI Secure Boot state until the disk and boot process are converted.
Rank #3
- Compatible with：TPM2.0(MS-4462)
- Chipset: INFINEON 9670 TPM 2.0
- PIN DEFINE:12-1Pin
- Interface:SPI
- Supports：MSI Intel 400 Series and 500 Series Motherboards,MSI AMD B550 and A520 Series Motherboards,Windows 10 TPM 2.0
What the conversion changes
Microsoft’s supported MBR2GPT workflow converts the system disk’s partition structure and creates the UEFI boot files without the destructive “delete all partitions” shortcut. It has prerequisites that depend on the Windows version and the disk layout. Recovery partitions, partition counts, free space and unusual boot arrangements can cause validation to fail.
1. Confirm eligibility and make a recovery plan
- Back up files and confirm the BitLocker recovery key.
- Identify the disk that contains the running Windows installation; do not assume it is disk 0 on a multi-disk system.
- Disconnecting or changing other disks may alter drive numbering, so follow the current Microsoft and manufacturer instructions for your configuration.
- Do not proceed if the disk has errors, unsupported partitions, or a third-party boot manager you have not accounted for.
2. Validate with MBR2GPT
Open Windows Terminal or Command Prompt as an administrator and run the validation form appropriate to your Windows version. A common system-disk example is:
mbr2gpt /validate /allowFullOSOn a machine with several disks, specify the correct disk only after confirming its number and checking the syntax supported by that Windows release. Validation must report success before conversion. If it fails, read the error, correct the stated layout problem, and validate again; do not force the conversion.
3. Convert only after validation succeeds
Use the conversion command documented for your release. The usual full-Windows example is:
mbr2gpt /convert /allowFullOSThe tool creates the EFI system partition and updates the boot configuration. It can restart the computer, and the machine may not boot until the firmware is changed to UEFI, so keep the recovery key and recovery media available.
Rank #4
- TPM 2.0 module for Asus motherboard.
- TPM 2.0 module chip 2.0mm pitch, 2x7P, 14 pin security module
- LPC 14 Pin for AsusTPM chip is better compatible with DDR4 memory module of motherboard, built in support memory type higher than DDR3! Supported states may vary by motherboard specification.
- Note: Don't support laptops and motherboards prior to X99; Don't support DDR3 memory.
- Packing list:1x TPM 2.0 Module for ASUS
4. Change firmware from Legacy/CSM to UEFI
Immediately after conversion, enter firmware setup and select UEFI-only mode. Disable Legacy Boot or CSM if required, select the new Windows UEFI boot entry, and save. Do not enable Secure Boot while the firmware is still forcing a Legacy loader.
5. Enable Secure Boot and verify
Once Windows starts in UEFI mode, enable Secure Boot in the firmware. Boot Windows, run msinfo32, and confirm both values. If the result is not UEFI/On, return to the diagnosis table rather than repeating the conversion.
Repair path C: firmware or Secure Boot key-database problems
If the PC is already UEFI but Secure Boot is missing, greyed out, refuses key enrollment, or stopped working after a firmware change, treat it as a firmware problem rather than a Windows setting.
Update the firmware from the hardware manufacturer
Download the BIOS/UEFI release and recovery instructions for the exact PC or motherboard model. Firmware menus, certificate databases and recovery behavior vary by model. Keep the machine on reliable power, use the manufacturer’s verification steps, and do not interrupt an update.
Restore or install factory keys
In Secure Boot’s key-management area, use the documented Install default keys or Restore factory keys action when the database is empty or corrupted. Some systems require Secure Boot to be in a particular setup or standard mode before keys can be enrolled.
Best Value
- Product Color: Black
- Width: 0.6"
- Depth: 0.5"
- Additional Information: Interface: SPI Features: TPM IC: Nuvoton NPCT750 TPM Version: TPM 2.0 Pin Dimension: 14-1pin System Requirements: Windows® 10, UEFI OS
- Country of Origin: Vietnam
Recover from a failed key or boot-manager update
A Secure Boot database update can expose a boot-manager or certificate problem. Microsoft recovery guidance may require updating Secure Boot variables or the Windows boot manager. In procedures that call for removable media, the recovery file may need to be placed on a FAT32-formatted USB drive under EFIBOOT and renamed bootx64.efi. Use that layout only when the exact recovery instructions for the device call for it; file names, capacity, formatting and enrollment steps are device-specific.
TPM and Secure Boot: related, but not interchangeable
Windows 11 security checks commonly mention TPM 2.0 and Secure Boot together, which can make them seem like one switch. They are separate:
- TPM: stores and reports hardware-backed measurements and keys.
- UEFI Secure Boot: verifies that approved boot components are allowed to start.
Enable the firmware TPM option if it is disabled, then verify that Windows reports the TPM as present and ready. Manufacturers may label the setting Security Device, Security Device Support, TPM State, AMD fTPM, AMD PSP fTPM, Intel PTT, or Intel Platform Trust Technology. Enabling TPM alone will not change Secure Boot State; the PC still must boot through UEFI with Secure Boot configured and enabled.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Common symptoms and the safest response
| Symptom | What it usually indicates | Response |
|---|---|---|
| Secure Boot is enabled in firmware, but Windows says Unsupported | Windows may still be booting a Legacy entry, CSM remains active, or the firmware key database is not usable. | Check BIOS Mode, select the Windows UEFI entry, disable CSM/Legacy, and verify or restore default keys. |
| Secure Boot is greyed out | CSM is enabled, firmware is in a setup state, administrator policy blocks it, or firmware is outdated. | Follow the model manual, change CSM/UEFI mode first, and update firmware if the manufacturer lists a fix. |
| Turning on Secure Boot causes “no boot device” | The installation has no usable UEFI boot entry or is still an MBR/Legacy installation. | Return temporarily to the previous mode, confirm disk style and boot files, then complete the MBR2GPT/UEFI sequence if eligible. |
| Windows asks for a BitLocker recovery key after the change | TPM measurements changed as expected after firmware or boot-policy changes. | Enter the saved recovery key. Do not keep retrying firmware changes without confirming the key and protection status. |
| TPM is enabled but Secure Boot remains Unsupported | TPM and Secure Boot are independent controls. | Check BIOS Mode, disk style, CSM/Legacy, Secure Boot keys and hardware capability separately. |
| Secure Boot disappeared after a BIOS update | The update may have reset settings, changed boot mode, or altered the key database. | Load the current model-specific defaults, restore the Windows UEFI entry and factory keys, and re-enable Secure Boot. |
When the hardware cannot support Secure Boot
Some older PCs have no UEFI Secure Boot implementation, no compatible TPM, or firmware that cannot accept the required keys. No Windows command can add a missing firmware capability. Check the manufacturer’s specifications and available BIOS/UEFI updates for the exact model.
If the specification confirms that Secure Boot is absent, the state cannot be repaired through Windows settings. Secure Boot-dependent Windows 11 checks or game anti-cheat requirements may therefore require a motherboard or complete PC replacement. A TPM upgrade by itself will not solve a system that lacks UEFI Secure Boot.
Final verification checklist
After the machine has restarted normally, verify the complete chain rather than checking only one switch:
msinfo32shows BIOS Mode: UEFI.msinfo32shows Secure Boot State: On.- The firmware boot list uses the Windows UEFI boot entry, not a Legacy disk entry.
- TPM management reports a present, ready TPM when the PC is expected to meet Windows 11 requirements.
- BitLocker protection is in the intended state and the recovery key remains accessible.
- Windows starts after a full shutdown and power-on, not only after returning from firmware setup.
For any firmware setting you cannot identify, Microsoft recommends checking the PC manufacturer’s support information. Menu names and certificate guidance change between models and firmware releases, so model-specific documentation takes precedence over generic instructions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
