You launch Call of Duty: Modern Warfare 4 on PC and online modes are refused, Activision's wizard reports "TPM 2.0: Not Enabled" or "Secure Boot: Not Enabled", or a Windows prompt asks you to allow CODBrokerInstaller.exe or enrollaik.exe. Since the game's release, Activision requires TPM 2.0 and Secure Boot to play online. This guide helps you check what is missing on your PC, then fix it in the right order while limiting the risks.
Problem
- You can't access Modern Warfare 4 online modes on PC.
- A "Failed Attestation Status" notification appears.
- The Call of Duty Secure Attestation Wizard shows one or more failed results.
- A User Account Control (UAC) prompt for CODBrokerInstaller.exe or enrollaik.exe appears at launch, sometimes repeatedly.
What to know first
- For Modern Warfare 4, Activision states that TPM 2.0 and Secure Boot are both required, and that players who don't meet the requirements are restricted from playing any online game mode. This is stricter than Black Ops 7 and Warzone, where only certain modes (including Ranked Play) are restricted.
- Windows: Activision requires Windows 10 version 22H2 or later, or Windows 11. On Windows 11, both features are likely already enabled, since Windows 11 requires them.
- Processor: the TPM can be built into the CPU (Intel PTT from 8th-gen Intel CPUs, AMD CPU fTPM from Ryzen 2000) or provided by a dedicated chip.
- Secure Boot requires UEFI boot mode (not "Legacy" or CSM) and a GPT system disk (not MBR).
- Activision warns that changing BIOS/UEFI settings improperly can stop the PC from booting and that it is not responsible for such changes. Always follow your motherboard or PC manufacturer's documentation.
- BitLocker: Microsoft lists BIOS/UEFI firmware upgrades, changes to the boot manager and changes to the partition table among the causes of a BitLocker recovery screen. If your drive is encrypted, write down your recovery key before any change (see the French guide Écran de récupération BitLocker au démarrage : trouver la clé).
Step 1: diagnose with the Secure Attestation Wizard
When to use it: always first, to know exactly what's blocking.
Suggested solution
- Open Activision's article on TPM 2.0 and Secure Boot (link in the sources), section Call of Duty Secure Attestation Wizard, and download the wizard from that page only (version 1.3.0, updated 21 October 2026 at the time of writing).
- Extract the .zip file, then double-click CODSecureAttestationWizard.exe. Accept the terms and run the scan.
- The Settings button at the bottom of the wizard lets you choose its display language. If the wizard says the system is compliant, no action is needed.
- Note every failed result, then follow the matching step:
| Wizard result | Step in this guide |
|---|---|
| TPM 2.0: Not Enabled | Steps 2 and 3 |
| Secure Boot: Not Enabled | Steps 4 and 6 |
| BIOS Boot mode not set to UEFI | Steps 4, 5 and 6 |
| Boot Partition not set to GPT | Step 5 |
| Authorization Key Failed | Step 7 |
| TCG Event Log Failed | Step 7 |
| BIOS Firmware Update Required | Step 8 |
Expected result: you know which item is missing, instead of changing BIOS settings blindly.
Step 2: check the TPM status in Windows
When to use it: the wizard reports a TPM issue, or you want to confirm its status.
Suggested solution
- Press Windows + R, type the command below and press Enter:
tpm.msc
- In the Status section:
- "The TPM is ready for use": the TPM is active; check its version (2.0) in the TPM Manufacturer Information.
- "Compatible TPM cannot be found": the TPM is probably disabled in the BIOS/UEFI, or missing.
Expected result: you know whether TPM 2.0 is active. If it is, go straight to step 4.
Step 3: enable the TPM in UEFI
When to use it: tpm.msc shows "Compatible TPM cannot be found".
Prerequisites: your motherboard or PC documentation at hand (Activision's article links to guides from Acer, ASRock, ASUS, Biostar, Dell/Alienware, GIGABYTE, HP, Lenovo, MSI and others) and your BitLocker recovery key if the drive is encrypted.
Suggested solution
- Open the firmware from Windows:
- Windows 11: Start > Settings > System > Recovery, then Restart now next to "Advanced startup".
- Windows 10: Start > Settings > Update & Security > Recovery, then Restart now under "Advanced startup".
- After the restart: Troubleshoot > Advanced options > UEFI Firmware Settings.
- Look for the option under Advanced, Security or Trusted Computing (depending on the manufacturer):
- Intel CPU: Intel PTT or Security Device Support;
- AMD CPU: AMD CPU fTPM.
- Enable it, save and exit (usually F10), then let the PC restart.
- Check again with tpm.msc.
Expected result: tpm.msc says the TPM is ready for use.
Rollback: if the PC no longer boots normally, go back into UEFI and restore the option to its previous state.
Step 4: check boot mode and Secure Boot
When to use it: the wizard reports a Secure Boot or boot mode issue.
Suggested solution
- Press Windows + R, type the command below and press Enter:
msinfo32
- In System Summary, look at two lines:
| Line shown | Meaning | Next |
|---|---|---|
| BIOS Mode: UEFI | The PC can enable Secure Boot | Step 6 |
| BIOS Mode: Legacy | Secure Boot isn't possible as is | Step 5 |
| Secure Boot State: Off | Supported, but disabled | Step 6 |
| Secure Boot State: Unsupported | The PC may not support it | Manufacturer documentation |
Expected result: you know whether you can enable Secure Boot directly (UEFI) or must deal with the disk first (Legacy).
Step 5: Legacy boot with an MBR disk
When to use it: only if msinfo32 shows BIOS Mode: Legacy or the wizard reports "Boot Partition not set to GPT". Otherwise, skip this step.
Suggested solution
- Check the partition style: type Disk Management in Windows search, right-click the disk that holds Windows > Properties > Volumes tab > Partition style line.
- If GPT is shown, you only need to switch the firmware to UEFI (point 6 below).
- If MBR is shown, a conversion is required. Requirements listed by Activision: Windows 10 version 1703 or later, 64-bit Windows, at most three partitions on the MBR disk, BitLocker or any encryption turned off, no dual boot, UEFI-capable motherboard, Secure Boot disabled before starting.
- Back up your important data before any conversion, then read Microsoft's official MBR2GPT guide (link in the sources).
- Open Command Prompt as administrator and run the validation first:
mbr2gpt /validate /allowFullOS
- Only if validation succeeds, run the conversion, then restart into UEFI to switch boot mode from Legacy (or CSM) to UEFI and disable CSM if present:
mbr2gpt /convert /allowFullOS
When to stop: if validation fails, go no further and don't force anything: ask for help in this topic with the message you got.
Expected result: Windows restarts normally in UEFI mode, and msinfo32 shows BIOS Mode: UEFI.
Step 6: enable Secure Boot
When to use it: msinfo32 shows BIOS Mode: UEFI and Secure Boot State: Off.
Suggested solution
- Open the UEFI firmware as in step 3.
- Go to the Boot tab (or Security, depending on the manufacturer). Many BIOS include a search feature, often with F9.
- Set Secure Boot to Enabled. If the option is greyed out, check that UEFI mode is selected, save, then reopen UEFI.
- Save and exit (usually F10).
- In Windows, run msinfo32 again: Secure Boot State should say On.
Expected result: Secure Boot is active; run the attestation wizard again to confirm.
Rollback: if the PC no longer boots, set Secure Boot back to Disabled in UEFI and ask for help here.
Step 7: UAC prompts, authorization error and TCG log
When to use it: TPM and Secure Boot are active, but the game or the wizard still blocks.
Suggested solution
- On the first launch of Modern Warfare 4, Windows may show a UAC prompt for CODBrokerInstaller.exe: enter the PC's administrator username and password if asked, then select Yes. Another prompt may concern enrollaik.exe: select Yes. Answering No prevents you from playing.
- In the wizard, "Authorization Key Failed" is fixed with Generate Key, which triggers the UAC prompt for enrollaik.exe: answer Yes.
- If a CODBrokerInstaller.exe authorization declined error appears without a UAC prompt: open Start, type "change user account control settings", move the slider to Always notify or to the level just below (the default), confirm, then restart the game.
- "TCG Event Log Failed": according to Activision, restart the PC and apply the latest Windows update.
Expected result: the prompt no longer returns after answering Yes, and the wizard no longer reports a failure.
If the enrollaik.exe prompt keeps coming back even though you answer Yes: Activision says this indicates AMD firmware 3..0. that needs updating. Go to step 8.
Step 8: update the motherboard firmware
When to use it: everything is enabled but attestation still fails, or the wizard shows "BIOS Firmware Update Required" (according to Activision, the firmware then meets the minimum requirements, but an update is recommended and may be required in the future).
Suggested solution
- Open tpm.msc and note the Manufacturer Version under TPM Manufacturer Information.
- Compare with the cases listed by Activision:
- AMD 3..0. (for example AMD 3.92.0.5): not compatible, a firmware update is required (AMD 3.92.5.5 is given as OK). AMD documents this known issue (link in the sources).
- INTC 302.12.. or INTC 303.12..: your motherboard may require a firmware update.
- Lenovo PC: Lenovo prefers that you submit a ticket on its support website to get the right firmware.
- Look for a BIOS update on the support page of your exact model and follow the manufacturer's procedure. Keep a laptop plugged in and never cut the power during an update.
- If attestation still fails after all this, Activision offers a way to report your status (link in the sources) to help its teams work with manufacturers.
Expected result: after the update, the attestation wizard no longer reports a failure and online modes are available.
Special cases
- Your CPU is too old for Intel PTT or AMD CPU fTPM: you need a dedicated TPM 2.0 module compatible with your motherboard, or another PC. Check compatibility in the manufacturer's documentation.
- You also want to move to Windows 11: the TPM/Secure Boot check is detailed in the French guide « Ce PC ne répond pas actuellement à la configuration requise pour Windows 11 » : vérifier et activer TPM 2.0 et démarrage sécurisé.
Final check
- ☐ tpm.msc: the TPM is ready for use (version 2.0).
- ☐ msinfo32: BIOS Mode UEFI and Secure Boot State On.
- ☐ The CODBrokerInstaller.exe or enrollaik.exe UAC prompts were accepted.
- ☐ The Secure Attestation Wizard no longer reports a failure.
- ☐ Modern Warfare 4 online modes are available.
Sources
- Activision Support: Trusted Platform Module (TPM) 2.0 and Secure Boot
- Activision Support: PC system requirements for Modern Warfare 4
- Activision Support: Report your attestation status
- Microsoft Learn: MBR2GPT.EXE
- Microsoft Learn: BitLocker recovery overview
- AMD: TPM firmware known issue
Still having the problem?
Reply in this topic with: your motherboard or PC model, your CPU, your Windows version, the results shown by the attestation wizard, what tpm.msc (status and manufacturer version) and msinfo32 (BIOS mode, Secure Boot state) show, and the steps you already tried. Never post your Activision ID, email address or BitLocker recovery key.