How to Enable Secure Boot on Windows 11 and Windows 10 PCs

A game refuses to start until you enable Secure Boot in the firmware. Or Windows 11 setup says the PC can’t run it. To enable Secure Boot, restart into the UEFI setup. Set the option to Enabled on the Boot or Security tab and save with F10.

• Check: msinfo32 shows BIOS Mode and Secure Boot State.
• Clear the blockers: CSM, an MBR disk or missing keys.
• Switch it on in UEFI setup and save.

On most PCs from 2018 onward that’s five clicks. The tricky part is what blocks the toggle. CSM still on, a disk still on MBR, or factory keys that someone wiped.

All three come up often enough, and each one needs a different fix.

What Secure Boot does

Secure Boot is built into UEFI firmware. It checks the digital signature of every piece of code that runs before Windows starts.

• The boot manager.
• GPU and network option ROMs.
• The Windows loader.

Code signed with a key stored in the firmware runs. Unsigned or untrusted code is blocked. That stops bootkits and rootkits, which load before your antivirus can.

Here’s what happens when you press the power button. Firmware wakes up. Before it hands control to Windows Boot Manager, it compares each component’s signature with two lists.

A match in db and none in dbx? Boot continues. Anything else, and boot halts.

It doesn’t catch every threat. It closes the door that bootkits used for years.

Three terms get mixed up constantly.

Secure Boot itself doesn’t care about TPM. Windows 11 setup and modern anti-cheat systems check both.

Check the state before you enable Secure Boot

1. Press Win + R.
2. Type msinfo32 and press Enter.
3. In System Summary, find BIOS Mode and Secure Boot State.

That ten-second check tells you which fix you need, before you reboot into firmware settings at all.

Legacy in msinfo32? Don’t switch the firmware to UEFI right away. The Windows loader still sits on an MBR layout that UEFI can’t read, and the PC won’t boot. Convert the disk first, as described further down.

Prefer the command line? Two cmdlets help in an admin PowerShell window.

The same value lives in the registry. That’s what msinfo32 reads. Editing it by hand changes nothing, so don’t bother.

What has to be true to enable Secure Boot

Four conditions. Miss any one, and you get “Unsupported” or a greyed-out toggle.

• UEFI boot mode. With Legacy or CSM active, Secure Boot can’t run.
• GPT disk. MBR disks boot only in Legacy mode. Check in Disk Management: right-click the disk, Properties, Volumes, Partition style.
• Factory keys loaded. If someone cleared them, the firmware sits in Setup Mode and enforces nothing. That’s common after a custom Linux setup or a BIOS reflash.
• 64-bit Windows 10 or 11. The conversion tool needs Windows 10 version 1703 or later.

A machine from 2018 or later that shipped with Windows generally meets three of these already.

CSM is the one nobody thinks about. Many boards ship with Legacy support on for compatibility, and it stays on for years.

The order of operations at a glance

How to enable Secure Boot from inside Windows

The fastest way into UEFI setup is from Windows itself. You don’t have to guess which key your laptop maker chose.

1. Press Win + I to open Settings.
2. Go to System, then Recovery. On Windows 10 it’s Update & Security, then Recovery.
3. Under Advanced startup, click Restart now and confirm.
4. On the blue screen pick Troubleshoot, Advanced options, UEFI Firmware Settings, then Restart.
5. In the firmware, open the Boot or Security tab. Find Secure Boot and set it to Enabled.
6. Press F10, confirm, and let the PC restart.
7. Back in Windows, run msinfo32 again. Secure Boot State should now read On.

This works on desktops, laptops, 2-in-1s and handhelds running Windows.

UEFI Firmware Settings is missing from the menu? Then the PC is booting in Legacy mode. That brings you back to the MBR conversion.

Suspend BitLocker before changing firmware settings: Control Panel, BitLocker, Suspend protection. Otherwise the next boot may ask for the 48-digit recovery key. That’s not the moment to start looking for it.

After you turn it on

• msinfo32 reads UEFI and On.
• Windows starts with no recovery key prompt.
• BitLocker protection is resumed, if you suspended it.
• The game or the installer that complained gets a second try.
• Windows Update has nothing pending.

Enable Secure Boot on ASUS, MSI, Gigabyte and ASRock boards

The pattern is the same on all four. Press the setup key during power-on and disable CSM if it’s on. Set Secure Boot to Enabled, with the mode on Standard. Save with F10.

Each vendor names and nests the menus differently. The paths below are the usual ones on current boards.

ASUS

1. Press Del on a desktop, F2 on a laptop.
2. In EZ Mode, press F7 for Advanced Mode.
3. Go to Boot, Secure Boot and set OS Type to Windows UEFI mode.
4. Save with F10.

Still Not Active after saving? Open Key Management and choose Install Default Secure Boot Keys.

A typical case: a used board. The previous owner reflashed the BIOS, and the keys are gone. Ten seconds, once you know where to click.

MSI

1. Press Del.
2. Open Settings, Advanced, Windows OS Configuration.
3. Set BIOS UEFI/CSM Mode to UEFI.
4. Open Secure Boot, set it to Enabled and set Secure Boot Mode to Standard.

Older MSI boards, from 2019 and earlier, use similar wording under the same menu.

Gigabyte

Gigabyte trips people up most. The Secure Boot entry often hides while CSM is on.

1. Press Del.
2. On the BIOS or Boot tab, set CSM Support to Disabled.
3. Save with F10 and reboot into setup again.
4. Secure Boot now appears. Enable it, set the mode to Standard and save.

ASRock

1. Press F2 or Del.
2. Go to Security, Secure Boot, Enabled.

Greyed out? Switch to the Boot tab and set CSM to Disabled first. Then come back. Honestly the cleanest layout of the four.

Enable Secure Boot on Dell, HP and Lenovo PCs

Brand-name PCs use their own setup keys. Once inside, make sure the boot mode is UEFI only, with legacy support disabled. Then set Secure Boot to Enabled and save.

Dell

Tap F2 at the Dell logo. Or tap F12 and choose BIOS Setup.

HP

1. Press Esc right after power-on, then F10 for BIOS Setup.
2. Go to Security, then Secure Boot Configuration. On some models it’s under Advanced.
3. Disable Legacy Support and enable Secure Boot.
4. Save.

HP then shows a four-digit code at the next boot. Not an error. Type it and press Enter. It confirms the change was made by someone at the keyboard.

Lenovo ThinkPad, IdeaPad and Legion

1. Tap F1 on a ThinkPad, F2 on an IdeaPad or Legion, at the Lenovo logo.
2. Open Security, Secure Boot and set it to Enabled.
3. Press F10.

On ThinkPads, also check Startup, UEFI/Legacy Boot. It should read UEFI Only, not Both.

Why the option to enable Secure Boot is greyed out

Nearly always one of three causes. One of the three fixes frees the toggle.

1. CSM or Legacy still on. The firmware won’t enforce signatures while it also accepts unsigned legacy boot code. Disable CSM, save, reboot, retry.
2. MBR disk. Some boards grey out the option so you can’t break a Legacy install. Convert to GPT first.
3. Platform Key missing. The firmware is in Setup Mode. Look for Key Management, Restore Factory Keys or Install Default Secure Boot Keys. One click puts the Microsoft certificates back.

A rarer fourth cause: a modded BIOS, or a board reflashed with a wrong image. The keys may be invalid. We’d use fix number 3 there, often with a flash of the official BIOS file.

Some boards also lock the option until a supervisor password is set in the firmware. If everything else looks right, set one and change the setting. You can remove the password afterwards.

Converting MBR to GPT without a reinstall

Microsoft’s built-in mbr2gpt tool converts the system disk in place. No files deleted, no Windows reinstall.

Back up first. A power cut mid-conversion is bad news.

1. Open Command Prompt as Administrator.
2. Run the validate line and wait for “Validation completed successfully”.
3. Run the convert line. It takes under a minute on an SSD.
4. Restart into UEFI setup.
5. Switch the boot mode from Legacy to UEFI, or disable CSM, depending on the menu.
6. Turn Secure Boot on.
7. Save, restart and check msinfo32.

mbr2gpt /validate /disk:0 /allowFullOS
mbr2gpt /convert /disk:0 /allowFullOS

If validation fails, the disk usually has more than three primary partitions, or no room for the EFI partition. A clean install is often quicker than fighting it.

About that disk number. Zero in the command stands for disk number 0. Open Disk Management and check which number your Windows disk has before running anything.

Running it against a data drive by mistake is how people lose files.

Fixing “Secure Boot State: Unsupported”

“Off” only tells you the feature is switched off. “Unsupported” is different. Windows booted in a way where the firmware can’t run Secure Boot at all.

Another one from the forums: the firmware says Enabled, and msinfo32 says Off. Do a full shutdown, not a restart. Wait a few seconds, boot again and re-check.

If msinfo32 still disagrees, a BIOS update from the vendor typically clears it.

Secure Boot and Windows 11

Windows 11 requires UEFI firmware that is Secure Boot capable, plus TPM 2.0. The installer checks that your PC supports the feature.

Microsoft recommends having it switched on, and many features and games assume it. If you’re moving to UEFI for Windows 11 anyway, we’d turn it on in the same session.

When setup or PC Health Check reports “This PC can’t run Windows 11”, check TPM 2.0 and the boot mode together. Do it before starting setup, not mid-install.

Our Windows 11 requirements guide lists the full hardware checklist. The walkthrough on installing Windows 11 from USB covers media that boots in UEFI mode.

For a fresh start, see the clean Windows 11 installation guide.

Games that require Secure Boot

Kernel-level anti-cheat uses Secure Boot as proof that the boot chain wasn’t tampered with. Without it, these games refuse to start.

The “Secure Boot must be enabled” message has the same fix as any Windows install. Follow the steps above, then relaunch the game. There’s nothing to configure in the game itself.

The anti-cheat reads the same state msinfo32 shows. When Windows reports On, the game launches.

A classic slip: switching it off for a weekend of GPU testing and forgetting to switch it back. Then the anti-cheat kicks you out for days. A sticky note on the monitor helps.

Windows Server and virtual machines

On physical servers the flow matches desktops. You usually work through the remote console, and Secure Boot sits under the system security or boot settings.

Many physical servers ship with Secure Boot off, because admins load custom drivers. Before turning it on, we’d check that every RAID and NIC option ROM is signed.

Virtual machines have their own switch, per VM. The host setting and the guest setting are independent. One doesn’t turn on the other.

The same steps apply to Windows Server 2019 and 2022. Windows Server 2025 follows them too.

When to turn it off

Only temporarily, and for a reason. Turn it back on when the job is done.

• Old GPUs with unsigned VBIOS. Some cards from around 2012 and earlier won’t show a picture with it on.
• Custom Linux kernels. Sign them and enroll your key with MOK, or switch Secure Boot off while testing.
• Old rescue USBs. Older Clonezilla or GParted builds are unsigned. So are some third-party recovery tools.
• Boot loop troubleshooting. Turn it off, isolate the cause, turn it on again.

Mainstream Linux distributions such as Ubuntu and Fedora boot with Secure Boot on. Their signed shim loader takes care of that.

The 2026 certificate change

The Microsoft certificates issued in 2011 for Secure Boot expired in 2026.

Windows Update installs the replacement 2023 certificates. OEMs ship them in BIOS updates as well.

According to Microsoft, PCs with only the old certificates keep starting normally. They miss new security fixes for the early boot process, though. And new boot media or third-party components signed only with the 2023 certificates may not be trusted.

For most home users, installing updates is all it takes.

1. Run Windows Update until nothing is pending.
2. Check your board or laptop vendor for a BIOS release from late 2025 or 2026 that mentions the 2023 Secure Boot certificates.
3. Verify with the line below, in an admin PowerShell window. True tells you the new certificate is in the allowed database.

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

Windows 10 PCs fall under this too. Microsoft’s details are on its page Windows Secure Boot certificate expiration and CA updates.

Related guides

• How to enter the BIOS on Windows 10 and 11
• Where to find your BitLocker recovery key

Terms used on this page

Typical Secure Boot problems and their fixes

The keys that went missing

A used board shows Secure Boot as Not Active, whatever gets saved. The previous owner had reflashed the BIOS. One click on the default keys, and the state turns to On.

The hidden menu entry

On a Gigabyte board there’s no Secure Boot entry at all. CSM Support is on. With CSM disabled and one more trip into setup, the entry appears.

The switch to UEFI that broke the boot

Someone flips Legacy to UEFI on a PC with an MBR disk. Windows won’t start. Back on Legacy it boots, the disk gets converted, and the second switch works.

Enabled in firmware, Off in Windows

The setup screen says Enabled, and the game still complains. After a full shutdown and a cold start, msinfo32 reports On.

The recovery key prompt

A firmware change on a laptop with BitLocker, and the next boot asks for 48 digits. Protection hadn’t been suspended. The key from the owner’s Microsoft account gets the laptop going again.

Boards and Windows versions this guide covers

Firmware menus change between BIOS releases. Labels on your board may differ slightly, even when the path is the same.

Windows refuses to activate after a board swap or a firmware reset? Our Windows 11 activation errors guide picks up where this page stops.

Need a key? Our Windows 11 Pro key comes as a genuine license. Delivery is instant to email.