COD MW4 TPM 2.0 and Secure Boot: Complete Setup Guide to Play Online

If you just installed Call of Duty: Modern Warfare 4 on PC and got hit with a security warning instead of a matchmaking screen, you're not alone. The COD MW4 TPM 2.0 requirement is now mandatory, and players without it enabled are locked out of every online mode. This isn't a bug or a launcher glitch — it's a deliberate anti-cheat gate that Activision built alongside Team Ricochet.

The good news? Most modern PCs already support these features; they just need to be switched on. This guide walks you through checking your COD MW4 TPM status in under two minutes, enabling it in BIOS, and troubleshooting the errors that still trip up thousands of players — including the notorious enrollaik.exe loop that keeps popping up on AMD systems.

Why Modern Warfare 4 Requires TPM 2.0 and Secure Boot

Activision's official support documentation confirms that both TPM 2.0 and Secure Boot are required to play Modern Warfare 4. Unlike Warzone and Black Ops 7 — where non-compliant players get restricted to certain playlists or separated matchmaking pools — MW4 enforces a hard block. No TPM, no online play. Period.

Here's the logic behind it:

• TPM 2.0 is a hardware security chip (or firmware module) that stores cryptographic keys and verifies your PC's integrity from boot to gameplay.
• Secure Boot ensures only trusted, signed software loads during startup, which blocks the low-level kernel cheats that anti-cheat tools struggle to detect once a match begins.
• Together, they give RICOCHET Anti-Cheat a verified hardware fingerprint it can trust.

In short: cheaters can spoof software, but spoofing a hardware root of trust is dramatically harder. That's the whole point.

What Happens If You Skip It

System Requirements: What Your PC Actually Needs

Before touching BIOS, confirm your operating system and hardware meet the baseline. Community reports on the official support forums show that the majority of failures trace back to one of four causes: outdated Windows, TPM 1.2 instead of 2.0, legacy boot mode, or an MBR-formatted drive.

Quick reality check: If you're running Windows 11, there's a strong chance both features are already active, since Microsoft requires them for the OS itself. Windows 10 users are the ones who usually need manual intervention.

How to Check Your COD MW4 TPM Status in Two Minutes

Don't guess — verify. Here's the fastest way to confirm whether your COD MW4 TPM 2.0 setting is already live.

Step 1: Check TPM 2.0

1. Press Windows Key + R to open the Run dialog.
2. Type tpm.msc and hit Enter.
3. Look at the Status section. If it reads "The TPM is ready for use" and lists Specification Version 2.0, you're done.
4. If it says "Compatible TPM cannot be found," you'll need to enable it in BIOS.

You can also verify through Windows Security → Device Security → Security Processor Details.

Step 2: Check Secure Boot

1. Press Windows Key + R again.
2. Type msinfo32 and hit Enter.
3. Find BIOS Mode — it must say UEFI.
4. Find Secure Boot State — it must say On.

Enabling TPM 2.0 in BIOS: Step-by-Step

Before you change anything, take these safety precautions — they're non-negotiable:

• Save your BitLocker recovery key. Switching TPM or boot settings can trigger a recovery prompt.
• Back up important files.
• Never clear, reset, or delete TPM keys. Only enable or toggle the settings described here.

Getting Into BIOS

The cleanest route from Windows:

1. Go to Settings → System → Recovery (Windows 11) or Settings → Update & Security → Recovery (Windows 10).
2. Under Advanced startup, click Restart Now.
3. Choose Troubleshoot → Advanced Options → UEFI Firmware Settings.

Finding the TPM Setting

Menu names vary wildly by motherboard brand. Here's what to look for:

Enable it, save with F10, and reboot. Then re-run tpm.msc to confirm version 2.0 is active.

Heads up: If your PC is managed by a school or employer, some BIOS settings may be locked by organizational policy. In that case, contact your IT admin — no workaround exists on the user side.

Enabling Secure Boot (and Fixing Legacy Mode)

Secure Boot only works when two conditions are met: UEFI boot mode and a GPT-formatted OS drive. Skip either and the setting will be greyed out or fail silently.

Check Your Disk Partition Style

1. Right-click the drive holding your Windows installation.
2. Select Properties → Volume tab.
3. Confirm GPT appears under Partition Style.

If it says MBR, you'll need to convert before switching to UEFI — otherwise Windows may not boot at all.

Converting MBR to GPT

Microsoft's official MBR2GPT conversion guide is the safest reference here. Prerequisites include:

• Windows 10 version 1703 or later
• No more than three partitions on the disk
• 64-bit OS
• BitLocker/encryption off
• No dual-boot configuration
• Secure Boot disabled before starting

Run the validation step first in an elevated Command Prompt. If validation succeeds, the conversion is safe to proceed.

Turning On Secure Boot

1. Enter BIOS/UEFI.
2. Navigate to the Boot or Security tab.
3. Set Secure Boot to Enabled.
4. If the option is greyed out, confirm UEFI mode is selected, disable CSM, save, and re-enter BIOS.
5. Save changes and reboot, then verify with msinfo32.

The Call of Duty Secure Attestation Wizard: Fastest Verification

Rather than manually checking every setting, Activision offers a dedicated tool: the Call of Duty Secure Attestation Wizard (version 1.3.0, updated October 21, 2026). It scans your BIOS information and tells you exactly what's compliant and what isn't.

Download it, extract the ZIP, run CODSecureAttestationWizard.exe, accept the terms, and scan. You'll need administrator permission.

Fixing Common Errors After Enabling TPM

Even compliant systems sometimes throw errors on first launch. Here's how to handle the most frequent ones.

The enrollaik.exe / CODBrokerInstaller.exe Prompt

On first launch, Windows will ask for permission for CODBrokerInstaller.exe (or occasionally enrollaik.exe) as part of TPM registration. You must enter your admin credentials and select Yes. Declining — or closing the window — blocks you from playing MW4 entirely. The prompt should only appear once.

Player experience note: If you get a "CODBrokerInstaller.exe authorization declined" error with no popup at all, your UAC notification level is likely set too low. Search "change user account control settings" in Start, move the slider to Always notify, click OK, and relaunch the game.

AMD Firmware 3.x.0.x Loop

Community reports confirm a known bug: AMD motherboards with TPM manufacturer versions like 3.92.0.5 will fail registration repeatedly, even when you click Yes every time. Versions such as 3.92.5.5 are fine. The fix is a BIOS firmware update from your motherboard manufacturer.

Intel Firmware Warnings

Manufacturer versions beginning with INTC 302.12. or INTC 303.12. may also require a firmware update. Check your version in tpm.msc under TPM Manufacturer Information.

If you've done everything and still fail attestation, Activision encourages players to report their status through official support channels so engineers can work with hardware vendors on compatible firmware.

Final Checklist Before You Queue Up

Run through this list once and you'll never see the security warning again:

• ✅ Windows 10 version 22H2+ or Windows 11
• ✅ tpm.msc shows version 2.0 and "ready for use"
• ✅ msinfo32 shows BIOS Mode: UEFI
• ✅ msinfo32 shows Secure Boot State: On
• ✅ OS drive partition style is GPT
• ✅ BIOS firmware is current for your board
• ✅ UAC set to notify (so registration prompts appear)

Once those boxes are ticked, COD MW4 TPM verification happens automatically at launch and you're straight into matchmaking. For the full official walkthrough, bookmark the Activision TPM and Secure Boot support page.

Frequently Asked Questions

Do I really need TPM 2.0 to play COD MW4 online?

Yes. Activision requires both TPM 2.0 and Secure Boot for Modern Warfare 4, and players who don't meet the requirement are restricted from all online game modes. There is no opt-out or bypass — the check runs at launch through the anti-cheat pipeline.

Will enabling TPM 2.0 wipe my data or break Windows?

Enabling TPM in BIOS does not erase your drive. However, if you use BitLocker, changing TPM or boot settings can trigger a recovery key prompt — so save that key first. Never clear or reset TPM keys unless you fully understand the consequences.

Why does my PC keep asking for enrollaik.exe permission?

That prompt is part of the COD MW4 TPM registration process and should appear only once. If it repeats every launch, you're likely on an AMD board with firmware version 3..0., which is a known incompatibility. A BIOS update from your motherboard manufacturer resolves it.

My TPM is enabled but the game still says I'm not compliant. What now?

Check three things in order: whether Secure Boot is actually On in msinfo32, whether your drive is GPT rather than MBR, and whether your BIOS firmware is up to date. Running the Call of Duty Secure Attestation Wizard will pinpoint the exact failing setting instead of leaving you to guess.