ENLVRU
← Back to software

Tech guides

FACEIT Anti-Cheat for CS2: how to enable TPM 2.0, Secure Boot, IOMMU and VBS

FACEIT Anti-Cheat checks that your PC is protected at the hardware and system level before it lets you play CS2 matches. If it shows an error such as “Secure Boot is not enabled”, “TPM 2.0 not found” or “IOMMU / VBS required”, the fix is almost always a few switches in the BIOS and in Windows. This guide shows how to turn them on step by step on ASUS, MSI, Gigabyte and ASRock motherboards, for both AMD and Intel.

What has to be switched on
TPM 2.0BIOS
Secure BootBIOS
IOMMUBIOS
VBS / Memory integrityWindows

What FACEIT requires

  • TPM 2.0 and Secure Boot – required for all players (since 25 November 2025). The PC must boot in UEFI mode from a GPT disk.
  • IOMMU (Intel VT-d / AMD IOMMU) and VBS (virtualization-based security, “Memory integrity”) – being introduced in waves for more and more accounts. It is better to turn them on now than to be stopped in the middle of a match day.
  • Up-to-date Windows – Windows 11 is recommended. For Windows 10, FACEIT requires version 22H2 with Extended Security Updates (ESU) from 14 October 2026, and plans to require Windows 11 later.

The rules change from time to time. The FACEIT Anti-Cheat itself shows which setting is missing when you start it, and the official guides are linked at the end of this article.

1. Check what you have now (2 minutes)

  1. Press Win, type msinfo32 and press Enter. Check: BIOS Mode = UEFI, Secure Boot State = On, Kernel DMA Protection = On, Virtualization-based security = Running.
  2. Press Win, type tpm.msc and press Enter. The status must be “The TPM is ready for use” and the specification version 2.0.
  3. Find the “BaseBoard Manufacturer” and “BaseBoard Product” lines in msinfo32 and write down their values: this is the make and model of your motherboard.

Whatever is not in order, enable it below. If a BIOS option is missing, update the BIOS first (see our guide How to update the BIOS manually on ASUS, MSI, Gigabyte and ASRock motherboards).

2. Enter the BIOS

Restart the PC and press Del (or F2) repeatedly until the UEFI appears. Press F7 (ASUS) or F6 (ASRock) to switch from Easy Mode to Advanced Mode. Change one setting at a time and take a photo of the screen before you change it. The menu names below vary slightly between BIOS versions; the built-in search (often F9 or Ctrl+F) helps to find a setting.

3. Enable TPM 2.0

Modern boards have a firmware TPM inside the processor: AMD fTPM or Intel PTT.

  • ASUS: Advanced → AMD fTPM configuration (AMD) or PCH-FW Configuration (Intel) → TPM Device Selection = Firmware TPM / PTT = Enabled.
  • MSI: Settings → Security → Trusted Computing → Security Device Support = Enabled, then AMD fTPM / Intel PTT = Enabled.
  • Gigabyte: Settings → Miscellaneous → AMD CPU fTPM or Intel Platform Trust Technology (PTT) = Enabled.
  • ASRock: Advanced → CPU Configuration → AMD fTPM switch = AMD CPU fTPM (AMD), or Security → Intel Platform Trust Technology = Enabled (Intel).

Save with F10, boot Windows and check tpm.msc again. On some AMD boards the TPM is reported as “not ready” until the BIOS is updated.

4. Enable Secure Boot

Secure Boot works only when the PC boots in UEFI mode from a GPT disk and CSM (legacy mode) is off.

  1. If msinfo32 shows “BIOS Mode: Legacy”, or the system disk is MBR, convert the disk first. In an administrator Command Prompt run mbr2gpt /validate /allowFullOS and then mbr2gpt /convert /allowFullOS, and then switch the BIOS to UEFI. Back up your data first: a mistake here can stop Windows from starting.
  2. In the BIOS set CSM Support = Disabled (Boot menu).
  3. Enable Secure Boot:
    • ASUS: Boot → Secure Boot → OS Type = Windows UEFI mode (install the default Secure Boot keys if asked).
    • MSI: Settings → Security → Secure Boot → Secure Boot = Enabled, Secure Boot Mode = Standard.
    • Gigabyte: Boot → CSM Support = Disabled, then Boot → Secure Boot → Secure Boot Mode = Standard and Secure Boot = Enabled.
    • ASRock: Security → Secure Boot → Secure Boot = Enabled, Secure Boot Mode = Standard.
  4. If it does not turn on, use Restore Factory Keys / Install default Secure Boot keys in the same menu, then try again.

5. Enable virtualization and IOMMU

First enable the processor virtualization (needed for VBS): AMD SVM Mode or Intel Virtualization Technology (VT-x). It is usually in the CPU configuration section (ASUS: Advanced → CPU Configuration; MSI: OC → Advanced CPU Configuration; Gigabyte: Tweaker → Advanced CPU Settings; ASRock: Advanced → CPU Configuration).

Then enable IOMMU:

  • ASUS: AMD – Advanced → AMD CBS → IOMMU = Enabled (sometimes under NBIO Common Options). Intel – Advanced → System Agent (SA) Configuration → VT-d = Enabled.
  • MSI: AMD – OC → Advanced CPU Configuration → AMD CBS → IOMMU = Enabled. Intel – OC → CPU Features → VT-d = Enabled.
  • ASRock: AMD – Advanced → AMD CBS → NBIO Common Options → IOMMU = Enabled. Intel – Advanced → Chipset Configuration → VT-d = Enabled.
  • Gigabyte: AMD – usually Settings → Miscellaneous (or AMD CBS) → IOMMU = Enabled. Intel – VT-d in the Tweaker or Settings → Miscellaneous section. If you cannot find it, search for it with the BIOS search and update the BIOS.

If these options are visible, also enable: DMA Protection, DMAr Support, Pre-boot DMA Protection, Kernel DMA Protection indicator (AMD) and, for Intel, Control IOMMU Pre-boot behavior = Enable IOMMU during boot.

6. Turn on Memory integrity (VBS) in Windows

  1. Open Windows Security → Device security → Core isolation details.
  2. Set Memory integrity to On and restart the PC.
  3. If the switch is not available, click “Review incompatible drivers” and update or remove the listed drivers (often old RGB, overclocking or peripheral software, and old virtual-device drivers).
  4. After the restart, msinfo32 should show “Virtualization-based security: Running”.

IOMMU and VBS may slightly reduce FPS on some PCs. On modern hardware the difference is usually small.

7. Update Windows

  1. Open Settings → Windows Update and install all available updates until it says “You’re up to date”. Do not forget “Advanced options → Optional updates” for drivers.
  2. Windows 11 is the best choice. If your PC is supported but still runs Windows 10, update to Windows 11 (check with the PC Health Check app).
  3. If you stay on Windows 10, it must be version 22H2 with Extended Security Updates (ESU) enabled (Settings → Windows Update → enrol in ESU).
  4. Also update the chipset and graphics card drivers and, if needed, the BIOS.

If something does not work

  • Windows does not start after a change: go back into the BIOS and undo the last change (or use Load Optimized Defaults and repeat the steps one by one).
  • Secure Boot cannot be enabled: check UEFI mode, GPT, CSM disabled and restore the factory keys; update the BIOS.
  • TPM “not ready” or attestation error on AMD: update the BIOS to the latest version.
  • Memory integrity will not turn on: update or uninstall the incompatible drivers it lists.
  • The BIOS has no IOMMU / VT-d option: update the BIOS; if it is still missing, the board or processor may not support it.
  • Still an error: run the check in the FACEIT guides below and send FACEIT support the msinfo32 report.

Official FACEIT guides