Diagnosing Windows 11 Boot Failures Caused by TPM or Secure Boot Misconfiguration

A Windows 11 machine that drops into Automatic Repair, shows a black screen before the logo, or loops back into the BIOS after a firmware update or BIOS reset usually has one of two root causes: TPM 2.0 got disabled, or Secure Boot was turned off or lost its keys. Both are firmware-level requirements for Windows 11, and both are frequently reset to defaults when the CMOS battery dies, the BIOS is updated, or someone clears settings while troubleshooting something else. The good news: you can diagnose and usually fix this without reinstalling anything.

Recognizing the condition

Common symptoms of a TPM or Secure Boot related boot failure include:

• The PC boots straight into the UEFI/BIOS setup screen instead of Windows.
• Automatic Repair launches repeatedly and Startup Repair reports it could not fix the problem.
• A message such as "Secure Boot Violation" or an error about an invalid signature on the bootloader.
• The failure started immediately after a BIOS update, a "Load Optimized Defaults" action, or a motherboard replacement.

If the machine was working and nothing in Windows itself changed, suspect firmware settings before suspecting the OS.

Cause and diagnostic quick reference

Step 1: Verify TPM 2.0 is enabled in firmware

Enter your UEFI setup (usually Del, F2, or F12 during POST) and look for the TPM setting. Naming varies by vendor: Intel platforms call it PTT (Platform Trust Technology), AMD platforms call it fTPM, and discrete modules appear as TPM or Security Device. Set it to Enabled, save, and reboot.

If Windows boots after this, confirm the TPM state from within Windows: press Win+R, run tpm.msc (requires administrator rights), and check that the status reads "The TPM is ready for use" and the specification version is 2.0. If it shows 1.2 or "compatible TPM cannot be found," the firmware setting did not stick or the hardware needs a firmware update from the vendor.

Step 2: Verify Secure Boot

In UEFI setup, confirm Secure Boot is enabled and set to standard mode rather than custom or setup mode. If it was disabled, re-enable it and attempt a boot. One caution: if the machine has third-party drivers or an older bootloader that lacks valid signatures, enabling Secure Boot can itself cause a boot failure. If the machine fails only after you enable Secure Boot, the bootloader or a boot-critical driver is the problem, not the setting.

From a working Windows session you can check Secure Boot state by running msinfo32 and looking at "Secure Boot State," or in an elevated PowerShell prompt with Confirm-SecureBootUEFI, which returns True when active.

Step 3: Repair the BCD store from WinRE

If firmware settings are correct and the machine still loops into recovery, the Boot Configuration Data (BCD) store may be corrupted. Boot from Windows 11 installation media, choose "Repair your computer," then Troubleshoot, then Command Prompt. This runs in the Windows Recovery Environment with administrative rights.

Always back up the store before editing it:

bcdedit /export C:\bcd_backup

Note that drive letters in WinRE often differ from normal Windows letters; use diskpart then list volume to identify the Windows volume. Then rebuild the boot files:

bootrec /fixmbr
bootrec /fixboot
bootrec /rebuildbcd

On UEFI systems bootrec /fixboot may return "Access is denied" — this is expected on GPT/UEFI configurations, where the correct repair is to mount the EFI system partition and run bcdboot C:\Windows /s S: /f UEFI after assigning a letter to that partition. Incorrect BCD edits can make the machine unbootable, which is why the export comes first.

Step 4: Repair system files

Still in WinRE or from a booted system, check system file integrity. From an elevated command prompt in Windows:

sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth

The DISM command requires internet access by default to pull clean components from Windows Update, unless you point it at a local source with /Source. Run these only after firmware settings are confirmed correct; they will not fix a disabled TPM.

When to escalate

Stop troubleshooting and escalate if any of the following apply:

• The TPM option is missing entirely from UEFI on hardware that shipped with Windows 11 — this points to a firmware bug or board failure; check the vendor for a BIOS update.
• Re-enabling Secure Boot consistently produces a signature violation even after BCD repair — a third-party boot component may need updating or removal.
• BitLocker was enabled and you lack the recovery key. Firmware changes can trigger BitLocker recovery; without the key, data recovery is not possible.
• All repairs fail — back up data from WinRE or another machine and perform a clean install, or contact the hardware vendor or Microsoft Support.

Verifying the fix

After each change, do a full cold boot rather than a restart. Confirm the Windows logo appears without Automatic Repair, then check tpm.msc shows TPM 2.0 ready and msinfo32 shows Secure Boot State: On. Review Event Viewer under Windows Logs, System, filtering for sources like Microsoft-Windows-Kernel-Boot, for recurring boot errors. A clean boot three times in a row is a practical confirmation; intermittent failures usually mean a firmware setting is not persisting, which often indicates a failing CMOS battery.