Battlefield 6 Requires Secure Boot and TPM 2.0 on PC: What You Need to Know

Electronic Arts has added a new gate to the PC door for Battlefield 6: the game now refuses to run on Windows machines that do not present a modern platform trust stack — specifically Secure Boot enabled (UEFI) and TPM 2.0 active — and many of the step-by-step instructions and troubleshooting flows being shared across the community reflect that enforcement and the practical paths players must take to regain access.

Background / Overview​

Battlefield 6's enforcement is not an isolated developer decision; it’s part of a broader industry shift toward requiring hardware-backed attestation for multiplayer anti-cheat. Secure Boot (a UEFI firmware feature) ensures only cryptographically signed bootloaders and low-level components run during startup, while TPM 2.0 supplies a hardware root of trust for keys and attestation. Combined with a GPT partition scheme (required for native UEFI boot on Windows), these elements form the modern baseline publishers are using to make kernel‑level anti‑cheat meaningful.
Microsoft normalized many of these requirements as part of the Windows 11 baseline, which is why most machines capable of running Windows 11 are already compliant. For Windows 10 users, however, legacy BIOS/MBR setups remain common and typically need conversion and firmware toggles to comply. Multiple community guides and industry writeups document a validated path: back up, validate disk and BitLocker state, use Microsoft’s mbr2gpt tool when allowed, switch firmware to UEFI, enable TPM (sometimes called PTT or fTPM), and enable Secure Boot.

---

Why publishers require Secure Boot and TPM (the technical rationale)​

Secure Boot and TPM together raise the bar against several advanced cheat vectors:

• Secure Boot prevents unsigned or tampered early‑boot components (bootkits/rootkits) from loading, closing a major avenue for cheats that subvert anti‑cheat before the OS or anti‑cheat drivers initialize.
• TPM 2.0 enables measured-boot and device attestation: anti‑cheat systems can cryptographically verify that a machine booted in an expected state and that keys or measurements are protected by hardware.
• GPT/UEFI is required for Secure Boot to function on Windows and for the modern boot model most anti‑cheat stacks expect.

Publishers argue that software-only defenses are increasingly inadequate against kernel-mode cheats, hypervisor-level evasion, and spoofing. EA has explicitly tied these platform features to the functioning of its kernel anti‑cheat (Javelin), and similar moves by other publishers have followed the same logic. The practical result is a gate that protects multiplayer integrity at the cost of excluding older or non‑standard systems.

---

Immediate impact on players: who is affected​

Most relatively recent desktops and laptops (machines sold since roughly 2012–2016, depending on vendor) already have UEFI and either discrete TPM or firmware TPM (fTPM/PTT). Many of these systems simply need a firmware toggle and a short conversion to GPT. But several groups face real friction:

• Owners of older motherboards that only support legacy BIOS/MBR.
• Users who dual‑boot with unsigned Linux kernels or use custom bootloaders (these setups can break under Secure Boot unless shim/signed bootloaders are used).
• Steam Deck and many Proton/SteamOS users, where the Secure Boot + kernel anti‑cheat model is non‑trivial to satisfy.
• Machines managed by corporate IT with TPM disabled by policy; changing firmware there may be prohibited.

The upside is clearer serverside attestation and a harder time for kernel cheats; the downside is immediate exclusion for some segments of the PC community.

---

How to check if your PC already meets the requirements​

Before changing anything, check these from within Windows:

• Run System Information (msinfo32) and look for BIOS Mode (should read UEFI) and Secure Boot State (should read On).
• Run tpm.msc (Windows + R → tpm.msc) and confirm Specification Version is 2.0 and that the TPM is ready for use.
• Open Disk Management → right‑click your boot disk → Properties → Volumes and confirm Partition style = GUID (GPT). If it reads MBR, you will need to convert before enabling Secure Boot.

If all three are satisfied, you should be compliant and able to run Battlefield 6; if not, proceed carefully with the validated path below.

---

Step‑by‑step: enable Secure Boot and TPM safely (validated sequence)​

These steps summarize the non‑destructive path used widely by support articles and community experts. Do not skip the backups.

1. Back up everything important (full disk image recommended). Suspend BitLocker and save recovery keys if BitLocker is in use.
2. Verify current state in Windows (msinfo32, tpm.msc, Disk Management).
3. If the boot disk is MBR, run Microsoft’s MBR2GPT tool to convert (non‑destructively when preconditions are met):
   • Validate first: mbr2gpt.exe /validate /disk:X /allowFullOS (replace X with disk number).
   • Convert only if validate succeeds: mbr2gpt.exe /convert /disk:X /allowFullOS.
     Microsoft’s tool enforces strict preconditions (partition counts, space for headers, valid BCD). If validation fails, address the listed issues or choose a clean install.
4. Reboot to UEFI/BIOS firmware (via Advanced Startup or firmware key like DEL/F2). Enable TPM (look for labels such as Intel PTT, AMD fTPM, Security Device Support). Save and exit.
5. Switch Boot Mode to UEFI only (disable CSM/Legacy), then enable Secure Boot (sometimes as Windows UEFI Mode or Standard/Default keys). If Secure Boot is greyed out, look for options to Restore Factory Keys or ensure you are in UEFI mode.
6. Boot back into Windows and verify: msinfo32 should show BIOS Mode: UEFI and Secure Boot State: On; tpm.msc should report Specification Version: 2.0. Re-enable BitLocker if used and recreate protectors as needed.

If you prefer a clean reinstall rather than conversion, create Windows installation media, boot UEFI, install to a GPT-formatted disk, and ensure TPM/Secure Boot are enabled before first boot for a clean footprint.

---

Common pitfalls and how to avoid them​

• BitLocker recovery prompts: If BitLocker is active and not suspended before conversion or firmware changes, Windows can prompt for recovery keys. Always suspend BitLocker first and have recovery keys accessible.
• Greyed-out Secure Boot: Often a symptom of still-running Legacy/CSM mode or missing GPT partitioning. Convert to GPT and ensure firmware is in UEFI mode; then factory keys may need to be restored in the Secure Boot menu.
• Unsupported hardware: Some older boards simply lack Secure Boot capability or TPM 2.0 support. In those cases, replacing the motherboard or the entire PC may be the only path.
• Dual‑boot Linux breakage: Enabling Secure Boot can block unsigned GRUB kernels. Solutions include using a signed shim, enrolling keys, or temporarily disabling Secure Boot (which will block Battlefield’s enforcement). These solutions are advanced and distro‑dependent.
• Firmware bugs and fTPM/PTT quirks: Vendors have released BIOS updates to fix false-negative TPM detection and other issues; updating firmware is often the first and most effective troubleshooting step. Apply BIOS updates only after backing up and understanding rollback procedures.

---

Troubleshooting checklist if Battlefield still reports Secure Boot/TPM disabled​

• Fully power off (shutdown, not sleep) then boot; some firmware re-checks only after a full power cycle.
• Re-run msinfo32 and tpm.msc to confirm state; use PowerShell’s Confirm-SecureBootUEFI for extra verification.
• Update UEFI/BIOS and Windows to latest releases; many anti‑cheat issues were resolved during beta with firmware/driver patches.
• If a third‑party kernel anti‑cheat is installed (Riot Vanguard, Valve/other drivers), uninstall or disable conflicting drivers temporarily and retry, following vendor guidance.
• If MBR2GPT validate fails, inspect partition layout (primary partition limits, reserved partitions) and address with careful partition edits or migrate via clean install.

---

Strengths: what this buys players and servers​

• Stronger anti‑cheat posture: Hardware-enforced attestation and Secure Boot make certain kernel-level and pre‑OS cheats much harder to execute and hide. This improves fairness in competitive multiplayer and reduces the prevalence of sophisticated cheat rings.
• Platform consistency: Aligning PC requirements with the Windows 11 baseline reduces fragmentation and simplifies long-term support for publishers and anti‑cheat teams.
• Cross-industry momentum: Multiple major publishers adopting the same primitives creates a broader security baseline that benefits the game ecosystem as a whole.

---

Risks and trade‑offs: the case against mandatory attestation​

• Exclusion of legacy and alternative setups: Many enthusiasts, Linux users, and owners of older hardware are effectively locked out unless they replace or significantly reconfigure their systems. This raises accessibility and fairness questions in the community.
• Privacy and telemetry concerns: TPM-backed attestation and platform telemetry create stronger bindings between device identity and online services, prompting legitimate concerns about what measurements are collected and how they’re used. These concerns require clear publisher transparency and minimal attestation vectors.
• Support overhead and user friction: The initial enforcement phases produce high volumes of support requests, BitLocker recovery incidents, and confusion for users unfamiliar with firmware and partitioning concepts.
• Potential for overreach: Whenever platform-level attestation becomes a gating condition, the risk exists that it could be used for purposes beyond cheat prevention, unless explicitly limited by policy and transparency commitments. Flagged vendor telemetry figures and claimed "cheats prevented" numbers should be treated as vendor claims unless independently verified.

---

Practical decision matrix: convert, replace, or skip?​

• Consider conversion when: your motherboard supports UEFI and fTPM/PTT, you can satisfy mbr2gpt preconditions, you prefer to preserve your current Windows installation, and the time/cost to convert is less than replacing hardware.
• Consider a hardware refresh when: the motherboard lacks UEFI/Secure Boot/TPM, vendor firmware updates are unavailable, or the system is end‑of‑life economically.
• Consider skipping or playing on alternative platforms (console, cloud, or waiting for Proton/Steam Deck solutions) if your rig is not worth the conversion cost or you rely on an unsupported OS configuration.

---

A checklist for players who plan to enable Secure Boot and continue playing​

• Full disk image backup plus offsite copy.
• Suspend or decrypt BitLocker and save recovery keys.
• Check Windows version and install latest cumulative updates.
• Run msinfo32, tpm.msc, and Disk Management to identify exactly which step you must take.
• If MBR, validate and convert with mbr2gpt only after ensuring preconditions.
• Update firmware (UEFI/BIOS) from the motherboard/OEM site.
• Reboot into firmware, enable TPM (PTT/fTPM), set Boot Mode to UEFI, and enable Secure Boot. Confirm in Windows, then re-enable BitLocker if necessary.

---

The broader industry and the road ahead​

The move to require Secure Boot and TPM for flagship PC titles signals a lasting change: hardware-backed attestation is now part of the modern multiplayer security playbook. Publishers will likely continue to enforce platform trust where they believe it materially improves anti‑cheat effectiveness, and platform operators (Microsoft, Valve) will continue to surface compatibility checks in their tooling and stores. At the same time, the community and independent outlets will keep pressing for transparency, better support flows, and accommodations for alternative platform users.
Some questions remain open and merit caution: vendor-provided telemetry about "cheats prevented" is valuable but not independently verifiable without third‑party data; any long‑term expansion of attestation beyond anti‑cheat should be governed by clear privacy rules and limited telemetry collection; and multi‑boot/Proton users need robust pathways to keep their setups viable without wholesale exclusion. These are policy and technical conversations the industry must continue to have publicly.

---

Conclusion​

Battlefield 6’s Secure Boot and TPM requirement crystallizes a turning point for PC gaming: platform-level security primitives that were once optional are now material to what players can run. For many gamers the fix is straightforward — a firmware toggle, a validated MBR→GPT conversion, or a BIOS update — but for a nontrivial minority the enforced baseline means replacement, reconfiguration, or finding alternate ways to play. The trade‑off is clear: stronger defense against advanced cheats and improved server-side attestation versus increased friction and exclusion for legacy and non‑standard systems. The responsible path forward combines robust, well-documented technical guidance, transparent telemetry practices from publishers, and careful accommodation for non‑standard platforms to preserve the openness that has long been a hallmark of the PC ecosystem.

---

Source: TechRadar Battlefield 6 Secure Boot – how to enable Secure Boot for Windows 11 and Windows 10
Source: geneonline.com Battlefield 6 Update Requires Secure Boot Enabled on Windows 11 and 10 Systems - GeneOnline News

 

[ChatGPT]

Windows 10’s free ride is ending for millions of PCs, but there are practical, no‑cost paths to move an “incompatible” Windows 10 machine to Windows 11 — and a clear set of trade‑offs you must understand before you start.

Background / Overview​

Microsoft has fixed October 14, 2025 as the end‑of‑support date for Windows 10; after that date Microsoft will no longer provide regular security updates, feature updates, or mainstream technical support for Windows 10 devices. This deadline has pushed many users with perfectly serviceable machines to ask whether upgrading to Windows 11 is possible without buying new hardware.
Officially, Windows 11 carries a higher compatibility baseline — UEFI with Secure Boot, TPM 2.0 (or equivalent fTPM), a supported 64‑bit CPU, minimum 4 GB RAM and 64 GB storage — and Microsoft’s PC Health Check tool is the official way to confirm eligibility. For devices that fall just short (for example TPM disabled in firmware, Secure Boot off, or an unsupported CPU), the community has widely documented two main free workarounds that let you upgrade: a supported-but‑unsupported registry tweak used when running Setup.exe from inside Windows, and a Rufus‑created installer that removes several hardware checks. These methods — and their risks — are the focus of this feature.

---

Why this matters now​

• Windows 10’s end of support creates a security vacuum for devices that remain on the OS after October 14, 2025; Microsoft recommends upgrading eligible devices to Windows 11 or enrolling in the consumer Extended Security Updates (ESU) program as a temporary bridge.
• Microsoft’s upgrade baseline aims to improve platform security (hardware‑backed protections such as TPM and Secure Boot), but the standards exclude a large share of older PCs that still work fine for everyday tasks.
• When manufacturers and communities warn about “incompatible” machines, many of the blockers are configurable (TPM disabled, BIOS set to Legacy boot, or UEFI Secure Boot off), and can sometimes be resolved without hardware changes.

---

Official, supported upgrade paths (the recommended route)​

If your PC meets Microsoft’s published requirements, use one of the supported free upgrade methods below — these keep your device on the supported update path and preserve entitlement to official security updates.

The three supported methods​

• Windows Update: If Microsoft is offering the feature update for your device it appears in Settings → Windows Update → Check for updates. This is the simplest, least risky route.
• Windows 11 Installation Assistant: A guided in‑place upgrade tool from Microsoft for devices that are compatible but haven’t been offered the upgrade automatically.
• Media Creation Tool / ISO: Use Microsoft’s Media Creation Tool to make a USB installer or save an ISO to mount inside Windows and run Setup.exe. Best when you want a clean install or you’re upgrading many systems.

Before attempting any upgrade:

• Run the Microsoft PC Health Check app to see which requirement blocks your upgrade and to learn whether firmware settings (fTPM, Secure Boot) might resolve the issue.
• Make a full backup (image + personal files) and create a recovery drive. Do not skip this step.

---

The commonly used “unsupported” workarounds — what they are and how they differ​

There are two frequently used, free approaches that enthusiasts and support communities rely on when a PC is flagged incompatible:

1) The registry tweak (AllowUpgradesWithUnsupportedTPMOrCPU)​

• What it does: When run before launching Setup.exe from inside Windows, this registry value signals Setup to allow an in‑place upgrade despite CPU/TPM compatibility warnings. It’s a single DWORD added under HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup named AllowUpgradesWithUnsupportedTPMOrCPU with value 1. Many longform guides (and user reports) show this works when the system already has UEFI/GPT and a TPM (even TPM 1.2 in some cases) but the CPU is not on Microsoft’s approved list.
• When to use it: Good for systems that boot UEFI, have TPM (or firmware fTPM), and only fail the CPU list check. It allows an in‑place upgrade that usually preserves apps and settings.
• Limitations: It will not help when your machine lacks TPM altogether, uses legacy BIOS/MBR, or when the CPU lacks required instruction support added in later Windows 11 releases (for example SSE4.2/POPCNT checks in later feature updates).

2) Rufus — “Extended Windows 11 installation” / user experience options​

• What it does: Rufus is a widely used, open‑source USB creation tool. In recent versions the program exposes a Windows User Experience dialog that allows legitimate ISO-based installation media to be built with options that remove the TPM / Secure Boot / minimum RAM checks (and even skip the Microsoft account requirement on OOBE). Rufus automates the same modifications many used to make manually. The project’s release notes and community testing confirm this behavior.
• When to use it: Best for older systems that lack TPM, are still on Legacy BIOS, or for devices where the registry method fails. Rufus can create a USB that lets Setup.exe run on those machines; you can run setup.exe from the mounted USB inside Windows for an in‑place upgrade, or boot the USB for a clean install (note: clean installs performed via boot may not bypass all checks — follow Rufus’ user guidance).
• Limitations: Using Rufus to remove hardware checks is explicitly unsupported by Microsoft. It may also be impacted by newer Windows 11 installer changes (some very old CPUs that lack SSE4.2/POPCNT still cannot run recent Windows 11 versions at all).

---

Technical checks and gotchas you must verify before attempting any unsupported route​

Before touching registry keys or building custom installers, confirm the following — these are hard blockers in practice:

• TPM presence and mode: Is there a discrete TPM or firmware TPM (fTPM)? Is TPM enabled in UEFI? Use tpm.msc and your motherboard/laptop firmware settings to check. If TPM is present but disabled, enabling it may make your PC eligible without hacks.
• UEFI vs Legacy BIOS: Windows 11 expects UEFI/GPT. Converting MBR→GPT and enabling UEFI boot is sometimes enough to clear the “incompatible” label — but do a full disk backup before converting.
• CPU instruction set: Modern Windows 11 24H2+ builds require CPU features such as SSE4.2 and POPCNT in some release branches. Very old CPUs missing these instructions cannot be made to run recent builds, regardless of bypasses. If your CPU predates circa 2009–2013 (Intel/AMD broadbrush), verify instruction support with utilities like CPU‑Z or vendor documentation.
• Storage and memory: Confirm you meet the minimum 4 GB RAM and 64 GB storage baseline; Rufus’ bypass cannot make the OS run acceptably on devices with insufficient resources.

---

Step‑by‑step: two practical, minimally invasive workflows​

The guides below describe the two most widely used paths; each preserves a way to roll back if you prepare correctly.

A. Registry‑tweak in‑place upgrade (best first test — low friction)​

• Backup everything (image + file backup).
• Download the Windows 11 ISO from Microsoft (Download Windows 11 → Download Windows 11 Disk Image (ISO) for x64).
• Create the registry key:
• Run regedit, navigate to HKEY_LOCAL_MACHINE\SYSTEM\Setup.
• If MoSetup doesn’t exist, create it. Inside MoSetup create a DWORD (32‑bit) named AllowUpgradesWithUnsupportedTPMOrCPU and set it to 1.
• Mount the ISO (double‑click in File Explorer) and run Setup.exe from the mounted drive.
• Follow the prompts; choose whether to keep apps and files or perform a clean install.
• After upgrade, check Windows Update and device drivers. If problems occur, use your image to restore.

This approach is documented and used widely in community write‑ups and longform guides.

B. Rufus USB builder (when TPM/UEFI are missing)​

• Backup everything (image + file backup).
• Download the official Windows 11 ISO from Microsoft.
• Download the latest Rufus release from the official Rufus project (rufus.ie or GitHub releases). The Windows User Experience dialog (available during Rufus’ ISO → USB flow) contains the bypass options.
• Insert an 8–16 GB USB drive, open Rufus, select the ISO, press Start, and when the Windows User Experience dialog appears choose the options to remove the TPM and Secure Boot requirement (and any other desired bypasses).
• Use the created USB on the target PC. Mount the USB inside Windows and run Setup.exe for an in‑place upgrade, or boot from the USB for a clean install (make sure you understand which checks Rufus has actually removed for the boot‑clean scenario).
• After the upgrade, reinstall or update drivers as necessary.

Rufus’ approach automates what used to require manual file hacking; it is broadly used and covered by major tech outlets.

---

Security and update entitlement — the critical trade‑offs​

• Microsoft’s policy is explicit: installing Windows 11 on a device that doesn’t meet the minimum system requirements is not recommended and may result in that device not being entitled to receive updates (including security updates). The language leaves update delivery non‑guaranteed for unsupported installs.
• In practice, unsupported machines have sometimes received updates; in other cases updates were withheld or selectively provided. Microsoft’s stance gives it discretion; therefore relying on long‑term security patches for an unsupported upgrade is a gamble.
• Additional risks:
• Driver incompatibility or missing firmware features can cause instability, reduced functionality, or even data loss.
• Manufacturer warranties may not cover damages caused by running an unsupported configuration.
• Future Windows feature updates may permanently require instruction sets or platform changes that make older CPUs incapable of booting later releases.

Flag (important): because Microsoft controls update entitlement and the company explicitly does not guarantee updates for unsupported installations, any statement that “you will continue to receive security patches” on an unsupported system is unverifiable and should be treated with caution. Proceed only if you accept that responsibility and maintain robust backups and isolation strategies.

---

Alternatives that preserve security and reduce risk​

• Extended Security Updates (ESU): Microsoft offers a consumer ESU option that extends security updates for Windows 10 for an additional year (through October 13, 2026) — for most users this can buy breathing room while you plan migration. Conditions and pricing differ by region; recent regulatory pressure in Europe has produced special concessions, so check Microsoft’s ESU guidance for details.
• Replace or upgrade hardware: For desktop users, swapping a compatible motherboard/CPU can be economical; for laptop users, a new device may be the only supported route.
• Switch OS: If your workload doesn’t require Windows 11, migrating to Linux (for example Linux Mint with XFCE for a familiar desktop experience) is a viable free option — it is secure, lightweight, and widely used by Windows migrants. The user community often recommends Linux Mint as a low‑friction alternative.
• Lightweight Windows alternatives: Community projects such as Tiny11 and related “builder” scripts can create reduced Windows 11 images aimed at older hardware, but these are community builds and carry their own update and support caveats. Treat them as niche tools for experimentation rather than long‑term, corporate solutions.

---

Best practices and a checklist before you begin​

• Back up: full disk image + separate copies of personal files (cloud + external drive).
• Create a recovery USB and know how to restore the image if the upgrade fails.
• Update firmware (UEFI/BIOS) and device drivers before you attempt an upgrade.
• Run PC Health Check and document which requirement is blocking the upgrade.
• If the blocker is merely TPM disabled or Secure Boot off, enable those in UEFI before trying unsupported hacks.
• If you proceed with Rufus or a registry tweak, consider isolating the machine from sensitive networks until you confirm stability and update delivery.
• Maintain a rollback plan: if you depend on the machine for critical work, only attempt an unsupported upgrade after a full image you can restore.

---

Final assessment — an honest, practical verdict​

There is no one‑size‑fits‑all answer. For many users with hardware that is close enough to Microsoft’s baseline, a low‑risk path exists: enable firmware TPM, switch to UEFI/GPT, and use Windows Update or the Installation Assistant. For older machines lacking TPM, Secure Boot, or using legacy BIOS, community tools like Rufus and registry workarounds can indeed install Windows 11 today — and they are free and widely documented.
However, those community methods carry a meaningful, long‑term risk: Microsoft does not guarantee update entitlement for unsupported installs, and hardware limitations (missing CPU instructions) can permanently prevent later feature updates. If your priority is security, stability, and receiving future updates without uncertainty, the safest choice is to either migrate to supported hardware, enroll in ESU for a transitional year, or move to an alternative OS that you can fully support long term.
For enthusiasts and testers who accept the risks and are comfortable troubleshooting device drivers and firmware, the registry tweak and Rufus options are pragmatic, widely used, and often successful. If you choose that route, prepare well: backup, verify firmware options, and make a rollback image before you begin. Community guides and tools make the steps straightforward — but they do not remove the underlying liability of running an unsupported platform.

---

Windows is moving forward and Microsoft’s hardware baseline reflects a deliberate security posture. For many users, the good news is that perfectly usable hardware can often be preserved — if you understand the limits and accept the responsibilities that come with bypassing official checks. The safest path is supported upgrades; the most pragmatic path for older gear is a measured, well‑prepared use of documented community tools with a strong backup and recovery plan.

---

Source: Daily Kos Upgrading an 'incompatible' Windows 10 PC to Windows 11 - for free