Secure Boot is a security feature built into modern computers that helps protect your system during startup by allowing only trusted software to load. It works with your computer’s UEFI firmware to verify the digital signatures of boot loaders, drivers, and operating system files before Windows starts. If unauthorized or malicious code attempts to run during boot, Secure Boot can prevent it from loading.
Windows 11 requires Secure Boot support on most new installations, making it an important part of Microsoft’s security requirements. However, Secure Boot may be disabled after updating your BIOS, changing firmware settings, installing another operating system, or resetting your motherboard. Fortunately, enabling it is usually a straightforward process once you know where to look.
This guide explains how to check your Secure Boot status, enable Secure Boot in UEFI firmware, resolve common issues, and verify that it is working correctly in Windows 11.
What Is Secure Boot?
Secure Boot is a UEFI firmware feature that helps prevent unauthorized software from loading during the startup process.
It verifies the digital signatures of:
- Windows boot loader
- UEFI drivers
- Firmware components
- Option ROMs
- Bootable operating systems
If a component isn’t trusted or has been tampered with, Secure Boot blocks it from loading.
This helps protect against:
- Bootkits
- Rootkits
- Boot-level malware
- Unauthorized operating systems
Why Enable Secure Boot?
Enabling Secure Boot offers several benefits:
- Improves startup security
- Helps prevent malware before Windows loads
- Meets Windows 11 security requirements
- Works with Trusted Platform Module (TPM)
- Enhances system integrity
- Supports modern security features
For most users, leaving Secure Boot enabled is recommended.
Check Whether Secure Boot Is Already Enabled
Before changing firmware settings, verify your current Secure Boot status.
Step 1: Open System Information
Press Windows + R.
Type:
msinfo32Press Enter.
Step 2: Locate Secure Boot State
In the System Summary, look for:
Secure Boot State
Possible values include:
- On
- Off
- Unsupported
If it says On, Secure Boot is already enabled.
If it says Off, continue with the methods below.
If it says Unsupported, your computer may be using Legacy BIOS mode instead of UEFI.
Before Enabling Secure Boot
Secure Boot requires:
- UEFI firmware
- GPT partition style
- Compatible hardware
- Supported operating system
If your PC is using Legacy BIOS or an MBR partition, you may need to convert it before Secure Boot can be enabled.
Method 1: Enter UEFI Firmware Settings from Windows
The easiest way to access your firmware settings is through Windows.
Step 1: Open Settings
Press Windows + I.
Go to:
System
Select:
Recovery
Step 2: Open Advanced Startup
Under Advanced startup, click:
Restart now
Confirm the restart.
Step 3: Enter UEFI Firmware
After your PC restarts:
Select:
Troubleshoot
Then:
Advanced options
Choose:
UEFI Firmware Settings
Click:
Restart
Your computer will boot directly into the UEFI setup utility.
Method 2: Enable Secure Boot in UEFI
Once inside the firmware settings:
Navigate to one of these sections:
- Boot
- Security
- Authentication
- Advanced
Locate:
Secure Boot
Change its value to:
Enabled
Some systems may first require changing:
OS Type
to:
Windows UEFI Mode
Save your changes and exit the firmware.
Your computer will restart automatically.
Method 3: Disable Legacy Boot (If Necessary)
Secure Boot only works in UEFI mode.
If your system is using Legacy BIOS:
Enter the firmware settings.
Locate:
- Boot Mode
- CSM
- Compatibility Support Module
- Legacy Support
Disable:
- Legacy Boot
- CSM
Enable:
- UEFI Boot
Save the changes.
Important: If Windows was installed in Legacy mode, switching to UEFI without converting the disk may prevent Windows from booting.
Method 4: Convert MBR to GPT
If your Windows installation uses an MBR partition, Secure Boot cannot be enabled until the drive is converted to GPT.
Step 1: Open Command Prompt as Administrator
Search for:
Command Prompt
Choose:
Run as administrator
Step 2: Validate the Disk
Run:
mbr2gpt /validate /allowFullOSIf validation succeeds, continue.
Step 3: Convert the Disk
Run:
mbr2gpt /convert /allowFullOSRestart your PC.
Enter UEFI settings.
Enable:
- UEFI Boot
- Secure Boot
Method 5: Load Default Secure Boot Keys
Some motherboards require Secure Boot keys to be installed.
Inside the UEFI setup:
Locate:
- Secure Boot Keys
- Key Management
Choose:
- Install Default Keys
- Restore Factory Keys
- Load Default Secure Boot Keys
Save the changes.
Restart your computer.
Verify That Secure Boot Is Enabled
After Windows starts:
Press:
Windows + R
Type:
msinfo32Press Enter.
Locate:
Secure Boot State
It should now display:
On
This confirms Secure Boot is active.
Check BIOS Mode
Secure Boot requires UEFI mode.
To verify:
Open:
msinfo32Look for:
BIOS Mode
Possible values:
- UEFI
- Legacy
If it says Legacy, Secure Boot cannot be enabled until you switch to UEFI mode.
Why Secure Boot Is Greyed Out
If the option cannot be selected, possible reasons include:
- Legacy Boot is enabled.
- CSM is enabled.
- Secure Boot keys aren’t installed.
- The boot drive uses MBR.
- Firmware needs updating.
Resolving these issues usually makes the Secure Boot option available.
Update Your BIOS or UEFI Firmware
Older firmware versions may contain Secure Boot bugs.
Visit your motherboard or computer manufacturer’s support website.
Download the latest BIOS or UEFI update.
Carefully follow the manufacturer’s instructions when updating firmware.
Avoid interrupting the update process.
Troubleshooting Secure Boot
If Secure Boot won’t enable, try these solutions.
Secure Boot Still Shows Off
- Save BIOS changes before exiting.
- Verify UEFI mode is enabled.
- Confirm the disk uses GPT.
- Install default Secure Boot keys.
Windows Won’t Boot After Enabling Secure Boot
Possible causes include:
- Legacy Windows installation
- Unsupported bootloader
- Incorrect firmware settings
You may need to temporarily disable Secure Boot, correct the boot configuration, or convert the system disk properly before re-enabling it.
Secure Boot Option Is Missing
Some older computers don’t support Secure Boot.
Check whether your motherboard includes:
- UEFI firmware
- TPM support
- Secure Boot capability
Older BIOS-only systems cannot use Secure Boot.
Is It Safe to Enable Secure Boot?
Yes. Secure Boot is designed to improve system security.
For most users, enabling it has no negative impact on normal Windows operation.
However, Secure Boot may prevent some older operating systems, unsigned drivers, or certain bootable utilities from loading until it is temporarily disabled.
Benefits of Keeping Secure Boot Enabled
Leaving Secure Boot enabled provides several advantages:
- Better protection against boot-level malware
- Improved operating system integrity
- Compliance with Windows 11 requirements
- Enhanced compatibility with modern security features
- Reduced risk of unauthorized boot software
Unless you have a specific compatibility reason, it’s generally best to keep Secure Boot turned on.
Conclusion
Secure Boot is an important security feature that helps ensure only trusted software runs during your computer’s startup process. In Windows 11, it plays a key role in protecting against boot-level malware and meeting Microsoft’s hardware security requirements. Enabling Secure Boot typically involves accessing your UEFI firmware, switching to UEFI mode if necessary, and turning on the Secure Boot option. If your system uses an MBR disk or Legacy BIOS mode, converting to GPT and enabling UEFI may be required first.
Once enabled, you can verify its status using the System Information tool. Keeping Secure Boot active provides stronger protection with little to no impact on everyday use, making it a recommended setting for most Windows 11 users.
Frequently Asked Questions
Does Windows 11 require Secure Boot?
Windows 11 requires Secure Boot support for most new installations, although some upgrade scenarios or unsupported hardware configurations may still function without it.
How do I know if Secure Boot is enabled?
Open System Information by running msinfo32, then check the Secure Boot State entry. If it displays On, Secure Boot is enabled.
Can I enable Secure Boot without reinstalling Windows?
Yes, in many cases. If your system already uses UEFI firmware and a GPT partition, you can usually enable Secure Boot directly from the UEFI settings without reinstalling Windows.
What happens if I disable Secure Boot?
Windows will generally continue to work, but your computer loses an important layer of startup security. Additionally, some Windows 11 security features or certain applications may require Secure Boot to remain enabled.
