secure-boot.txt

This is gonna be complicated.

1. I assume you are using an hp desktop? I think thats what the company gets ppl nowadays
2. As sam says, you must disable bitlocker before mucking around

with that out of the way you need to ensure you check all these boxes

1. you have a TPU installed on your machine and its enabled: 
  - Turn on the computer and press the f10 key to start to the BIOS setup menu.
  - On the Security tab, check whether your TPM Device status is Hidden.
  - Toggle the TPM device status to Available.
  - Change TPM State to Enabled.
  - Press f10 to exit, and then click Yes to save changes. If prompted, press f1 to confirm the changes and restart the computer.

2. ensure your os is installed to a UEFI boot loader
  - run msinfo32.exe
  - In the right pane of System Summary, you should see the BIOS MODE line. If the value of BIOS MODE is UEFI, then Windows is booted in UEFI BIOS mode. If the value of BIOS MODE is Legacy, then Windows is booted in legacy BIOS mode. 
  - if you are in legacy mode, I feel bad for you, you will need to update your boot loader to UEFI: https://answers.microsoft.com/en-us/windows/forum/all/convert-an-existing-windows-10-installation-from/aa8c2de3-460b-4a8c-b30b-641405f800d7

3. enable secure boot in the bios 
  - once you've done this if you run msinfo32.exe in the right pane of System Summary, you should see the "Secure Boot State" line that tells you if windows detects secure boot mode

once you have confirmed that your TPU is enable, you are using a UEFI boot mode, and secure boot is enabled you should stop getting the nag mails