If Modern Warfare 4 or Warzone tells you your PC does not meet the security requirements, or Black Ops 7 suddenly locks you out of Ranked Play, the fix almost always sits in two Windows security features: TPM 2.0 and Secure Boot.
Activision requires both to work alongside its RICOCHET Anti-Cheat, and the Steam store pages for MW4 and Black Ops 7 now carry the same line saying TPM 2.0 and Secure Boot are required. This guide is current as of November 10, 2026, matching Activision's support guidance last updated November 5.
It starts with what each Secure Attestation Wizard message means, then walks through checking your PC, moving from Legacy to UEFI, converting an MBR disk to GPT, enabling the settings in the BIOS, and handling firmware versions such as AMD 3.92.0.5 that keep failing even when everything looks switched on.
Two rules before you touch anything. Follow your motherboard or PC maker's manual over any generic guide, because menu names and locations differ by brand. And back up your files before converting a disk or flashing a BIOS, since both change the way your PC starts.
Secure Attestation Wizard messages and fixes (as of November 10, 2026)
| Wizard message | What it means | Fix |
|---|---|---|
| TPM 2.0: Not Enabled | TPM is off in the BIOS, or the PC only has TPM 1.2 or older | Turn on Intel PTT or AMD CPU fTPM in the BIOS |
| Secure Boot: Not Enabled | The PC supports Secure Boot but it is switched off | Set Secure Boot to Enabled on the Boot or Security tab |
| Boot Partition not set to GPT | The Windows disk still uses the MBR partition style | Back up, convert with mbr2gpt, then switch the boot mode to UEFI |
| BIOS Boot mode not set to UEFI | The PC boots in Legacy or CSM mode | Change Boot Mode to UEFI and disable CSM if the option exists |
| BIOS Firmware Update Required | Minimum requirements are met but the firmware is dated | Install your board's latest BIOS, since it may become required later |
| Authorization Key Failed | User Account Control blocked the full scan | Select Generate Key and answer Yes to the enrollaik.exe prompt |
| TCG Event Log Failed | Windows is not up to date | Restart the PC and install the latest Windows update |
| CODBrokerInstaller.exe authorization declined, no popup | UAC notifications are set too low to show the prompt | Set the UAC slider to Always notify or the default level, then restart the game |
Black Ops 7 vs MW4 and Warzone: what each one blocks
The requirement is the same across the three games, but the penalty is not. In Modern Warfare 4 and Warzone, missing either TPM 2.0 or Secure Boot locks you out of every online game mode.
Black Ops 7 still launches, but it restricts certain modes including Ranked Play and some playlists, and it may put you in a separate matchmaking pool with other players who do not meet the requirements.
So if Black Ops 7 casual playlists work but MW4 refuses to go online, the settings were most likely missing all along. If your account shows a Failed Attestation Status, you are under those same restrictions.
On the Windows side, any version of Windows 11 works, and Windows 10 must be on 22H2 or later.
For hardware, TPM 2.0 is available on Intel 8th gen or newer through Intel PTT, on AMD Ryzen 2000 series or newer through AMD CPU fTPM, or on any board with a discrete TPM chip; TPM 1.2 or older does not qualify.
Windows 11 needs TPM 2.0 to install, so most Windows 11 PCs already have it on, but Windows 11 only requires the PC to be Secure Boot capable, which means Secure Boot can still be switched off. Warzone follows the same rules as MW4, and our Warzone Season 1 roundup covers the Season 1 schedule and changes.
How to enable TPM 2.0 and Secure Boot for Call of Duty
- 1Confirm your Windows version and CPUPress Windows+R, type winver and check the version. Windows 10 needs 22H2 or later, so update first if you are behind. Then confirm your processor is Intel 8th gen or newer, or AMD Ryzen 2000 series or newer. If you are not sure what is inside your PC, follow our guide to checking PC specs on Windows 11. On an older CPU, ask your motherboard maker whether the board has a discrete TPM chip before you change any settings.
- 2Read tpm.msc and msinfo32Press Windows+R, run tpm.msc and look at Status. The TPM is ready for use means TPM 2.0 is on, while Compatible TPM cannot be found means it is disabled in the BIOS or unsupported. Next run msinfo32 and look at two lines in System Summary: BIOS Mode should read UEFI and Secure Boot State should read On. Off means supported but disabled, Unsupported means the board may not support it, and a BIOS Mode of Legacy means you have to move to UEFI first.
- 3Convert MBR to GPT if you are on LegacyLegacy mode usually means your Windows disk is MBR, and UEFI with Secure Boot needs GPT. The built-in mbr2gpt tool converts it in place if all of these hold: Windows 10 version 1703 or later, 64-bit Windows, no more than three partitions on the MBR disk, BitLocker or other encryption turned off, no dual boot, a BIOS that supports UEFI, and Secure Boot left off until the conversion is done. Back up your files, open Command Prompt as administrator and run mbr2gpt /validate /allowFullOS. Only if validation passes, run mbr2gpt /convert /allowFullOS, then reboot into the BIOS and set the boot mode to UEFI. If validation fails, stop there and ask your PC maker or someone experienced.
- 4Turn on TPM and Secure Boot in the BIOSIn Windows 11, open Settings, System, Recovery and choose Restart now next to Advanced startup, then Troubleshoot, Advanced options, UEFI Firmware Settings. Under Advanced, Security or Trusted Computing, enable Intel PTT (sometimes labeled Security Device Support) or AMD CPU fTPM. On the Boot tab set Boot Mode to UEFI, disable CSM if it is listed, set Secure Boot to Enabled, then save and exit. If Secure Boot is greyed out, save with UEFI selected and enter the BIOS again. If you just converted the disk, boot into Windows once in UEFI mode before enabling Secure Boot.
- 5Run the Secure Attestation WizardDownload Activision's Call of Duty Secure Attestation Wizard (grab the latest version), extract the zip and run CODSecureAttestationWizard.exe. Accept the terms and start the scan; the Settings button at the bottom changes the display language. A compliant result means you can delete the wizard and play. Any message that remains maps to a row in the table above, so work through the fix column one line at a time.
- 6Approve the UAC prompt and check TPM firmwareOn the first launch of MW4, Warzone or Black Ops 7, Windows shows a User Account Control prompt for CODBrokerInstaller.exe to register your TPM. Enter an administrator name and password and choose Yes; choosing No or closing it blocks play. Some PCs get an enrollaik.exe prompt instead, which also needs Yes. If that prompt keeps coming back, open tpm.msc and read Manufacturer Version under TPM Manufacturer Information. AMD versions in the 3.*.0.* format, such as 3.92.0.5, are not compatible and need a BIOS update, while 3.92.5.5 is fine. Intel INTC 302.12.*.* or 303.12.*.* may also need one. Get the latest BIOS from your motherboard maker's support page; Lenovo owners are asked to open a ticket with Lenovo Support.
Before you queue again
- Windows 11, or Windows 10 on 22H2 or later.
- tpm.msc reports that the TPM is ready for use.
- msinfo32 shows BIOS Mode UEFI and Secure Boot State On.
- The Secure Attestation Wizard reports a compliant system with no messages left.
- You answered Yes to the CODBrokerInstaller.exe or enrollaik.exe prompt on first launch.
Record your first match back with DOR
Once the wizard comes back clean, that first match back online is worth keeping. DOR is a free Windows app that detects Modern Warfare 4 when you launch the campaign or multiplayer and records the whole session from launch to exit.
Everything lands in My Clips, where you find the gunfight or final circle you want and trim it to 16:9, 9:16 or 1:1. To stitch several moments together or add text, BGM and effect templates, open DOR Studio, then export an mp4 or share a dor.gg link with your squad.
Our guide to sending Warzone clips to friends covers the link workflow, and the Call of Duty game page collects the rest. Game audio and your mic are captured on one track. On supported NVIDIA graphics cards such as the RTX series, DOR records with NVENC hardware encoding.
Older videos are cleared only when full gameplay recordings exceed their share (5GB by default), and recent and liked videos are kept.
