Secure Boot is a security feature built into modern computers that use UEFI (Unified Extensible Firmware Interface) firmware. It helps protect your computer from malicious software that attempts to load before the Windows operating system starts. By allowing only trusted, digitally signed bootloaders and drivers to run during startup, Secure Boot reduces the risk of bootkits, rootkits, and other low-level malware that can compromise your system before antivirus software becomes active.
Windows 11 officially requires Secure Boot on supported devices, along with TPM 2.0, to provide a more secure computing environment. While Secure Boot is usually enabled by default on newer computers, it may be disabled after resetting the BIOS, updating the firmware, installing another operating system, or changing certain UEFI settings. Fortunately, enabling or configuring Secure Boot is a straightforward process once you understand how UEFI firmware works.
This guide explains what Secure Boot is, how to check its status, enable or disable it safely, resolve common Secure Boot issues, and understand when changing the setting is appropriate.
What Is Secure Boot?
Secure Boot is a UEFI firmware feature that verifies the digital signature of boot software before allowing it to load.
When Secure Boot is enabled, only trusted operating systems, bootloaders, and firmware components signed by approved certificate authorities can start during the boot process.
If untrusted or modified boot files are detected, the firmware blocks them from loading, helping protect your computer from startup-based malware.
Why Is Secure Boot Important?
Secure Boot improves system security by preventing unauthorized software from running during startup.
It helps defend against:
- Bootkits
- Rootkits
- Unauthorized bootloaders
- Firmware-level malware
- Startup tampering
Windows 11 also uses Secure Boot as part of its overall security requirements alongside TPM 2.0 and UEFI firmware.
Before You Configure Secure Boot
Before making changes, verify a few important requirements.
Your computer should support:
- UEFI firmware
- GPT-partitioned system drive
- TPM 2.0 (for Windows 11)
- A compatible version of Windows
If your computer uses Legacy BIOS or an MBR-partitioned system disk, Secure Boot cannot be enabled until the system is converted to UEFI and GPT.
Check Whether Secure Boot Is Enabled
Windows provides an easy way to verify the current status.
Press Windows + R.
Type:
msinfo32Press Enter.
The System Information window opens.
Locate:
- BIOS Mode
- Secure Boot State
Possible values include:
- On
- Off
- Unsupported
If BIOS Mode displays Legacy, Secure Boot isn’t available until the system is switched to UEFI mode.
Method 1: Enable Secure Boot Through UEFI Settings
This is the standard method.
Restart your computer.
Press the appropriate firmware key during startup.
Common keys include:
- Delete
- F2
- F10
- Esc
Enter the UEFI setup utility.
Navigate to the Boot, Security, or Authentication section.
Locate the Secure Boot setting.
Change it to Enabled.
Save the changes.
Exit the firmware.
The computer restarts using Secure Boot.
The exact menu location varies depending on the motherboard or laptop manufacturer.
Method 2: Enter UEFI from Windows
If startup happens too quickly to press the firmware key, Windows can restart directly into the firmware settings.
Open Settings.
Go to System > Recovery.
Under Advanced startup, click Restart now.
Choose:
Troubleshoot > Advanced options > UEFI Firmware Settings
Click Restart.
After entering the firmware interface, enable Secure Boot, save the changes, and restart the computer.
Method 3: Switch from Legacy BIOS to UEFI
If Secure Boot isn’t available because Windows is installed in Legacy BIOS mode, you’ll first need to switch to UEFI.
Before changing the firmware mode, ensure your system drive uses the GPT partition style.
If it’s still using MBR, convert it to GPT using Microsoft’s supported tools before changing the firmware settings.
After converting the drive:
- Enter UEFI setup.
- Disable Legacy or CSM mode if enabled.
- Enable UEFI boot mode.
- Enable Secure Boot.
- Save the changes.
Windows should then boot normally in UEFI mode.
Method 4: Restore Secure Boot Keys
Some firmware allows Secure Boot keys to be deleted or modified.
If Secure Boot cannot be enabled, restore the factory security keys.
Within the UEFI firmware, locate the Secure Boot configuration.
Choose an option similar to:
- Install Default Secure Boot Keys
- Restore Factory Keys
- Reset Secure Boot Keys
Save the changes.
Restart the computer.
The firmware reloads the manufacturer’s default security certificates.
Verify Secure Boot Is Enabled
After Windows starts:
Press Windows + R.
Type:
msinfo32Press Enter.
Verify:
- BIOS Mode = UEFI
- Secure Boot State = On
If both values appear correctly, Secure Boot has been configured successfully.
Common Secure Boot Problems
Some users don’t see the Secure Boot option.
This usually occurs because:
- Legacy BIOS mode is enabled.
- CSM (Compatibility Support Module) is active.
- The system drive uses MBR instead of GPT.
- Secure Boot keys have been removed.
Correcting these issues typically makes the option available.
Secure Boot Is Grayed Out
If Secure Boot appears unavailable, try the following:
- Enable UEFI mode.
- Disable CSM.
- Install the default Secure Boot keys.
- Update the BIOS or UEFI firmware if necessary.
After making these changes, restart the firmware and check again.
Does Secure Boot Affect Performance?
No.
Secure Boot performs verification only during startup.
Once Windows has loaded, Secure Boot doesn’t reduce system performance, gaming performance, or application speed.
Most users won’t notice any difference other than improved startup security.
When Should You Disable Secure Boot?
Most users should leave Secure Boot enabled.
However, you may temporarily disable it when:
- Installing certain Linux distributions that don’t support Secure Boot.
- Using older operating systems.
- Running specialized hardware diagnostics.
- Testing unsigned drivers in development environments.
If you disable Secure Boot, remember to re-enable it after completing the task whenever possible.
Secure Boot vs TPM
Although often mentioned together, they serve different purposes.
Secure Boot verifies trusted software during startup.
TPM (Trusted Platform Module) securely stores encryption keys, credentials, and security information.
Windows 11 uses both technologies together to improve overall system security.
Secure Boot vs Fast Startup
These features are unrelated.
Secure Boot protects the boot process from unauthorized software.
Fast Startup reduces boot time by partially hibernating Windows during shutdown.
You can enable or disable either feature independently.
Tips for Managing Secure Boot
Only change Secure Boot settings when necessary.
Keep your UEFI firmware updated using official manufacturer updates.
Avoid deleting Secure Boot keys unless specifically instructed by your hardware manufacturer.
If you’re unsure about changing firmware settings, record the original configuration before making changes.
Leaving Secure Boot enabled provides the best balance between security and compatibility for most Windows users.
Is Secure Boot Safe?
Yes.
Secure Boot is a standard security feature supported by Microsoft and major hardware manufacturers.
It doesn’t affect your personal files, installed applications, or Windows installation.
Instead, it helps ensure that only trusted software runs during the startup process, reducing the risk of malware that targets the boot environment.
Conclusion
Configuring Secure Boot is an important step toward improving the security of your Windows computer. By allowing only trusted, digitally signed boot software to load during startup, Secure Boot helps protect your system from bootkits, rootkits, and other forms of malware that attempt to compromise the operating system before Windows starts. Whether you’re enabling Secure Boot for Windows 11 compatibility, restoring default firmware settings, or troubleshooting startup issues, understanding how to manage this feature helps ensure your PC remains secure and reliable.
Before making changes, verify that your computer is using UEFI firmware and a GPT-partitioned system drive, as Secure Boot isn’t available in Legacy BIOS mode. After enabling the feature, confirm its status using the System Information tool to ensure it is active. For most users, leaving Secure Boot enabled is the recommended choice because it enhances startup security without affecting system performance or everyday usability.
Frequently Asked Questions
How do I know if Secure Boot is enabled?
Open System Information by pressing Windows + R, typing msinfo32, and pressing Enter. Check the Secure Boot State field. If it displays On, Secure Boot is enabled.
Why can’t I enable Secure Boot?
Secure Boot may be unavailable if your computer is using Legacy BIOS mode, CSM is enabled, the system drive uses MBR instead of GPT, or the default Secure Boot keys are missing.
Does Secure Boot slow down my computer?
No. Secure Boot only verifies trusted boot components during startup. It doesn’t affect Windows performance after the operating system has loaded.
Should I disable Secure Boot?
In most cases, no. Secure Boot should remain enabled for better security. Only disable it temporarily if you need to install software or an operating system that isn’t compatible with Secure Boot, and re-enable it afterward if possible.
