TPM and Secure Boot status on this PC

#Requires -RunAsAdministrator
#Requires -Modules TrustedPlatformModule, SecureBoot
# TPM state and Secure Boot state of this device. Read-only.

$tpm = Get-Tpm

try {
    $secureBoot = Confirm-SecureBootUEFI -ErrorAction Stop
} catch {
    $secureBoot = "Unknown: $($_.Exception.Message)"
}

[pscustomobject]@{
    TpmPresent          = $tpm.TpmPresent
    TpmReady            = $tpm.TpmReady
    TpmEnabled          = $tpm.TpmEnabled
    TpmActivated        = $tpm.TpmActivated
    TpmOwned            = $tpm.TpmOwned
    RestartPending      = $tpm.RestartPending
    LockedOut           = $tpm.LockedOut
    ManufacturerIdTxt   = $tpm.ManufacturerIdTxt
    ManufacturerVersion = $tpm.ManufacturerVersion
    SecureBoot          = $secureBoot
}

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Where to run it

The Windows device you want to check, in an elevated Windows PowerShell 5.1 session.

Reading the output

• TPM values come from Get-Tpm. RestartPending True means the TPM is waiting for a restart to finish a change; LockedOut True means it has locked out after too many failed authorisation attempts.
• SecureBoot is True or False from Confirm-SecureBootUEFI. On a device that doesn't support Secure Boot, or a BIOS (non-UEFI) device, the cmdlet can't answer and the script shows its message instead.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.