How to Enable Secure Boot on Windows 11 (Step-by-Step)

Contents

    Secure Boot is a firmware-level security feature that stops unauthorized operating systems and malware from loading when your PC starts up. It’s a requirement for Windows 11, and if it’s currently off, you’ll need to turn it on from your computer’s UEFI firmware settings, not from inside Windows itself.

    Quick steps

    1. Open Settings > System > Recovery, then select Restart now next to Advanced startup.
    2. Choose Troubleshoot > Advanced options > UEFI Firmware Settings, then click Restart.
    3. In the firmware menu, find the Secure Boot option (usually under a Boot or Security tab) and set it to Enabled.
    4. Save your changes and exit, usually with a key like F10, and let your PC restart normally.

    Before you start

    A few things to check before you go digging around in firmware settings:

    • Your PC needs UEFI firmware, not legacy BIOS. Secure Boot doesn’t exist on older legacy BIOS systems.
    • Your main drive needs to use the GPT partition style, not MBR. Secure Boot won’t work (and your PC may fail to boot) on an MBR disk.
    • Every manufacturer’s firmware menu looks a bit different. Dell, HP, Lenovo, ASUS and others all label and organize things slightly differently, so treat the steps below as a general map rather than an exact match for your screen.
    • Back up anything important before changing firmware settings, just in case something goes wrong during the restart.

    Check whether Secure Boot is already on

    It’s worth checking your current status first, since you might not need to do anything.

    1. Press Windows key + R, type msinfo32, and press Enter to open System Information.
    2. In the System Summary pane, look for Secure Boot State.
    3. If it says On, Secure Boot is already active and you don’t need to change anything. If it says Off or Unsupported, follow the steps below.

    If you’re comfortable with PowerShell, you can also open it as administrator and run Confirm-SecureBootUEFI. A result of True means it’s enabled; False means it’s off.

    Enable Secure Boot from within Windows 11

    This is the easiest route into your firmware settings, since Windows handles the restart for you instead of you having to catch a key press during boot.

    1. Open Settings (Windows key + I).
    2. Go to System > Recovery.
    3. Next to Advanced startup, select Restart now, then confirm when prompted.
    4. When your PC restarts to the blue recovery screen, choose Troubleshoot.
    5. Select Advanced options.
    6. Select UEFI Firmware Settings.
    7. Click Restart to boot straight into your firmware setup screen.
    8. Once inside, look for a tab or menu called Boot, Security, or Authentication, depending on your manufacturer.
    9. Find Secure Boot and change its setting to Enabled.
    10. Press the key shown on screen to save and exit (commonly F10), then confirm. Your PC will restart into Windows normally.

    Enable Secure Boot by rebooting straight into firmware

    If your Windows 11 installation is unstable or you can’t get to the desktop, you can still reach the firmware setup screen directly during startup.

    1. Restart or turn on your PC.
    2. As soon as the manufacturer’s logo appears, repeatedly press the key used to enter setup. This is commonly F2, F10, F12, Delete, or Esc, but it varies by brand and model, so check your PC or motherboard manual if none of these work.
    3. Once you’re in the firmware setup screen, go to the Boot or Security tab.
    4. Locate Secure Boot and set it to Enabled.
    5. Save and exit (usually F10), then let the PC restart.

    This method is handy on desktop PCs with fast boot times, where the Windows restart menu route can feel slower.

    What to do if your disk uses MBR instead of GPT

    Secure Boot depends on your system disk using the GPT partition style. If your PC was set up a long time ago, or was upgraded from an older version of Windows, it might still be using the older MBR format, which will block Secure Boot from working properly.

    1. Open Command Prompt as administrator.
    2. Run mbr2gpt /validate to check whether your disk is eligible for conversion.
    3. If it passes validation, run mbr2gpt /convert /allowFullOS to convert the disk to GPT without needing to reinstall Windows. The /allowFullOS flag is required when you run the tool from inside a fully booted Windows installation rather than from the Windows preinstallation environment.
    4. Restart your PC, enter firmware setup, switch the boot mode from Legacy/CSM to UEFI, and then enable Secure Boot.

    Converting a disk’s partition style carries some risk, so back up your important files before running this, and avoid interrupting the process once it starts.

    If it doesn’t work

    The Secure Boot option is greyed out

    This usually means your firmware is still set to Legacy or CSM (Compatibility Support Module) boot mode instead of UEFI. Look for a Boot Mode or CSM setting nearby, switch it to UEFI, and the Secure Boot option should become available.

    Your PC won’t start after enabling Secure Boot

    If your drive is formatted as MBR rather than GPT, enabling Secure Boot can prevent the system from booting. Go back into firmware setup, disable Secure Boot again, confirm you can boot normally, then convert the disk to GPT using the steps above before re-enabling it.

    You don’t see a UEFI Firmware Settings option in Advanced startup

    If that option is missing from the Troubleshoot menu, your PC is likely running in legacy BIOS mode rather than UEFI, or the manufacturer has disabled that shortcut. In that case, use the manual restart-and-press-a-key method instead to reach firmware setup directly.

    Secure Boot State shows “Unsupported”

    This typically means your motherboard or PC doesn’t support Secure Boot at all, often because it’s older hardware running legacy BIOS with no UEFI option. Check your manufacturer’s specifications or a firmware update page to confirm whether a UEFI firmware update is available for your model.

    Frequently asked questions

    What is Secure Boot and why should I turn it on?

    Secure Boot checks that your PC’s bootloader and operating system files haven’t been tampered with before they load, which helps block certain types of malware that try to hide before Windows even starts. It’s one of the baseline security requirements for Windows 11.

    Does enabling Secure Boot delete my files?

    No, simply turning Secure Boot on or off in firmware doesn’t touch your files. The risk only comes in if your disk is formatted as MBR and becomes unable to boot, which is why converting to GPT beforehand matters if that applies to you.

    Do I need Secure Boot for Windows 11?

    Yes, Secure Boot along with a compatible TPM is part of the baseline hardware requirements for running Windows 11. Most PCs sold new in recent years ship with it enabled by default.

    Why is Secure Boot greyed out or missing on my PC?

    Most commonly, it’s because your firmware is still set to Legacy or CSM boot mode instead of UEFI. Older hardware that lacks UEFI support entirely won’t offer Secure Boot as an option at all.

    Can I turn Secure Boot off again later?

    Yes, you can go back into the same firmware menu at any time and set it back to Disabled. Keep in mind that doing so removes one of the protections Windows 11 relies on, so it’s generally best left enabled unless you have a specific reason to turn it off.

    Sources

    Updated on November 8, 2026
    Was this article helpful?

    Related Articles

    Leave a Reply

    Your email address will not be published. Required fields are marked *

    Contents