"Legacy Option ROMs cannot be enabled with PTT enabled" on Dell: fix both ways

On Dell computers, Legacy Option ROMs and PTT (Intel Platform Trust Technology, the built-in firmware TPM) can't be on at the same time. That's why you get "Legacy Option ROMs cannot be enabled with PTT enabled" or the reverse, "PTT cannot be enabled with Legacy Option ROMs enabled".

Which one to turn off depends on what you want:

• You need legacy boot (old OS, old GPU, legacy PXE): go to Security > PTT Security, uncheck PTT On, click Apply, then enable Legacy Option ROMs under Settings > General > Advanced Boot Options.
• You want Windows 11, BitLocker or TPM 2.0: uncheck Enable Legacy Option ROMs, set boot mode to UEFI, then turn on Secure Boot and PTT.

Read the warnings below before you change anything. Switching either way can make an existing Windows install fail to boot or ask for the BitLocker recovery key.

Why Dell blocks the combination

Legacy Option ROMs are old BIOS-style firmware on add-in cards (GPU, network, RAID). They only run in legacy/CSM mode, which skips the UEFI security chain. PTT is a TPM 2.0 built into the Intel chipset, and TPM 2.0 on these systems expects a pure UEFI boot. Dell enforces it in the BIOS: one or the other.

Dell also documents the same rule for Secure Boot: it needs UEFI boot mode with Legacy Option ROMs turned off. On some models PTT and a discrete TPM also exclude each other. Dell's Latitude 7350 article explains that "TPM Security" is greyed out because PTT is enabled by default.

Fix 1: enable Legacy Option ROMs (turn PTT off)

Use this if you need legacy boot, an old graphics card without UEFI firmware, or a legacy network boot.

Before you start: if the drive is encrypted with BitLocker, suspend it, or make sure you have the recovery key. Turning PTT off removes the TPM that holds the key.

Suspend-BitLocker -MountPoint "C:" -RebootCount 2

Then:

1. Restart and tap F2 at the Dell logo to open the BIOS.
2. Go to Security > PTT Security and uncheck PTT On. Click Apply.
3. Go to Secure Boot > Secure Boot Enable and set it to Disabled.
4. Go to Settings > General > Advanced Boot Options and check Enable Legacy Option ROMs. Click Apply.
5. If you want to boot an old OS, set Boot Sequence > Boot List Option to Legacy.
6. Apply and Exit.

Here's the same on video:

If you see "Legacy Option ROMs are required for legacy boot mode", you set the boot list to Legacy before enabling Legacy Option ROMs. Do step 4 first, then step 5.

Disabling PTT means Windows 11 loses its TPM. Windows Hello PINs, BitLocker with TPM and some anti-cheat software stop working until you turn it back on.

Fix 2: enable PTT for Windows 11 (turn Legacy Option ROMs off)

This is the more common case now: Windows 11 requires TPM 2.0, UEFI and Secure Boot, and PTT is greyed out because Legacy Option ROMs are on.

Before you start: check how Windows is installed. Press Win + R, run msinfo32, and look at BIOS Mode.

• UEFI: you're fine, go to the steps.
• Legacy: your disk is MBR, and Windows won't boot after you switch to UEFI. Convert the disk to GPT first with Microsoft's MBR2GPT tool, from an admin Command Prompt:

mbr2gpt /validate /allowFullOS
mbr2gpt /convert /allowFullOS

Back up first. The conversion is usually fine, but it rewrites the partition table.

Then in the BIOS (F2 at boot):

1. Settings > General > Advanced Boot Options: uncheck Enable Legacy Option ROMs. Click Apply.
2. Boot Sequence > Boot List Option: set UEFI.
3. Security > PTT Security: check PTT On. Click Apply.
4. Secure Boot > Secure Boot Enable: set Enabled.
5. Apply and Exit.

Dell's own UEFI boot guide uses the same order: UEFI boot list, Legacy Option ROMs off, then Secure Boot on.

Back in Windows, run tpm.msc. It should show TPM Manufacturer: INTC and Specification Version: 2.0.

If you can't find the options

• No "Enable Legacy Option ROMs" at all: many Dell models from 2020 onward ship a UEFI-only BIOS with no CSM, so legacy boot isn't possible. Use a UEFI-capable boot medium or GPU instead.
• PTT option missing: the system may have a discrete TPM instead. Look for TPM 2.0 Security in the Security section.
• Option greyed out: check the other side of the conflict: Legacy Option ROMs, Secure Boot and the boot list mode all have to match.
• Newer graphical Dell BIOS: the same settings are under Boot Configuration (boot mode, Secure Boot) and Security (TPM/PTT). The names are the same.

My take

Unless you really need to boot something from before 2012, go the UEFI way: Legacy Option ROMs off, PTT and Secure Boot on. That's what Windows 11 and modern Linux installers expect, and on newer Dells it's the only option anyway. If an old GPU forces you into legacy mode, it's usually cheaper to replace the card than to fight the BIOS.

If you're checking what your board supports before an upgrade, here's how to find your motherboard model and chipset. And if you end up reinstalling Windows 11 in UEFI mode, you can still set it up without a Microsoft account.

FAQ

What does "Legacy Option ROMs cannot be enabled with PTT enabled" mean?

On Dell systems, the firmware TPM (PTT) and Legacy Option ROMs are mutually exclusive. To enable Legacy Option ROMs, turn off PTT under Security > PTT Security first.

What does "PTT cannot be enabled with Legacy Option ROMs enabled" mean?

The reverse. Uncheck Enable Legacy Option ROMs under Settings > General > Advanced Boot Options, switch the boot list to UEFI, then turn PTT on.

What is PTT in a Dell BIOS?

Intel Platform Trust Technology, a TPM 2.0 built into the chipset firmware. Windows 11, BitLocker and Windows Hello use it the same way as a separate TPM chip.

Will disabling Legacy Option ROMs break Windows?

Only if Windows was installed in Legacy mode on an MBR disk. Check BIOS Mode in msinfo32. If it says Legacy, convert the disk with mbr2gpt before switching to UEFI.

Will turning off PTT lose my data?

Your files stay. But BitLocker will ask for the recovery key if it wasn't suspended, and Windows Hello PINs need to be set up again.