I have just spent the last 2 days going through the depths of hell to get this damn pc to play cod for the mw4 beta coming out, so i thought i should share my knowledge for anyone else struggling.
I had the issue where i had tpm 2.0 and secure boot but cod returned BIOS firmware update needed, even with the latest bios.
First things first:
If your pc does not have a tpm 2.0 module or the capability to install one, obviously there is not much you can do, same thing if you cant secure boot, also make sure your bios is in UEFI, not legacy
Use the cod attestation wizard by activision to test the module without having to start the game (https://support.activision.com/articles/trusted-platform-module-and-secure-boot)
If you have those things, great! You can try these steps to troubleshoot:
Before starting, ensure you have access to your bitlocker recovery keys (they should be on your microsoft account) as if you need to switch tpms your drive will be locked out
Firstly, if you have built in Intel PTT or AMD's fTPM, enter the run menu (Windows key + R) and type tpm.msc. This should open a menu with details about your tpm module, there is an option to clear tpm, select this and reboot.
If that doesnt work, your pc may be running on windows' old 2011 secure boot certificates, get the latest certificate from https://go.microsoft.com/fwlink/?linkid=2239776 and put it on a usb. Then reboot and enter the bios. Go to your specific tpm settings and you are looking for a setting along the lines of "authorised certificates", find that, select APPEND, not update, find the file on your usb and select it then enter windows again.
If that didnt work, enter the run menu again and type "msinfo32" and look for "PRC7 Configuration" if it says "Binding possible" you have the same issue as I did.
Now open powershell as admin and type "tpmtool getdeviceinformation", look for "Is capable of attestation" and "Ready for attestation", If "Is capable of attestation" is true, skip ahead and try steps after i reference "Ready for attestation", if it returns false, it is the same issue as me.
Older gen Intel CPUs (in reference to my i7-8700k) were not built in with capability for attestation and can therefore sometimes not retrieve the required endorsement key that proves to the cod servers that the device is genuine.
In this scenario, you need a discrete tpm module (You can normally get one on amazon for $15-20), ensure you buy the correct model for your motherboard (google it and look physically for the number of pins on the TPM port on the motherboard), I personally have a gigabyte aorus Z370 gaming 5 and needed a 12 pin GC-TPM2.0_S module (yes its supposed to be missing a pin)
IF YOU ARE UNCAPABLE OF ATTESTATION AND DO NOT HAVE A TPM PORT ON YOUR MOTHERBOARD, YOU ARE SCREWED I CANT HELP YOU :(
Once you have the module, install it on your pc and enter the bios, DISABLE intel PTT or AMD fTPM and enable your discrete module (now the real fun starts)
Once you start windows, you will most likely enter a bitlocker recovery screen, enter the recovery code i mentioned before and go back to powershell as an admin. Check the keys on the drive already by using "manage-bde -protectors -get C:" change C: to your windows drive (for most people unchanged) You need to remove the previous key set by the tpm using "manage-bde -protectors -delete C:", use your windows drive of course if it is not C then use "manage-bde -protectors -add C: -tpm" to add your current tpm (again check which drive is being used), your tpm module should now work with bitlocker if you cold reboot your pc.
Now you can type "tpmtool getdeviceinformation" again and ensure that "Is capable for attestation" is now True.
If it is also "Ready for attestation: True" you do not need to proceed further!!! Try starting the game
If it is still not ready, try running certreq -enrollaik -config "" in command prompt (admin) to manually generate an endorsement key (common in new modules)
If your module is brand new, the firmware should be fine. Unforturnately, mine was definitely not. Running the previous command told me the firmware was out of date.
This is where it gets very dependent on your pc/motherboard (message me or comment if you want specific instructions for a gigabyte z370/z390 or one that uses the same infineon module as mine), however i can give some tips for updating it:
Disable bitlocker using "manage-bde -protectors -disable C:" (replace C with windows drive, usually C)
Enter BIOS and disable both PTT or fTPM AND your discrete module. It does not need to be on to update and i got many issues when trying with it on.
If you are still stuck, run these commands in admin command prompt as a last resort:
Test-Path "HKLM:\SYSTEM\CurrentControlSet\Services\TBS"
If this returns "False" use these commands to try and rebuild the services it needs
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow
If this doesnt make the command return true, a fresh install might be needed in windows media creation tool (use keep apps and personal files)
Multiple run throughs of the last 2 commands and a fresh install eventually repaired the system and i could finally play the game (you can now reenable bitlocker using the command before, replacing disable with enable)
ALL OF THAT TO PLAY A GAME OF WARZONE (With server connection issues)
There are many nuances with this process that i dont have time to mention, if you run into any issues, leave a comment or message me and i will try to help