> ## Content Index > Fetch the complete content index at: https://elevendecoded.com/llms.txt > Use this file to discover other available public pages before exploring further. # How to Enable Secure Boot in Windows 11 and Boost Your PC Safety - URL: https://elevendecoded.com/enable-secure-boot-windows-11/ - Published: 2026-09-11T04:47:00.000Z - Updated: 2026-10-23T14:20:00.000Z - Author: Md Fakharuddin - Tags: PC Security, Windows 11, Secure Boot Secure Boot checks trusted signatures during UEFI startup to help block untrusted boot software. It strengthens startup protection, but it does not replace antivirus protection, supported Windows updates or backups. ### Check Your Current Secure Boot State Press **Windows + R**, enter **msinfo32**, and check **BIOS Mode** and **Secure Boot State** in System Summary. - **On:** Secure Boot is already enabled. - **Off:** It is currently disabled; consult your manufacturer’s instructions for enabling it. - **Unsupported:** Check the device’s firmware capabilities and boot mode. This result alone does not identify the cause or prove that hardware replacement is necessary. The Windows 11 upgrade requirement is **UEFI with Secure Boot capability**. It is not a universal requirement that Secure Boot already be turned on to pass eligibility. Enabling it is nevertheless recommended for improved protection. See [Microsoft’s Secure Boot guidance](https://support.microsoft.com/en-us/windows/security/devicesecurity/windows-11-and-secure-boot?ref=elevendecoded.com). ### Prepare Before Changing Firmware Back up important files and verify access to your BitLocker recovery key if device encryption is enabled. Firmware and boot changes can trigger recovery. Follow the manufacturer’s guidance on suspending and resuming BitLocker protection when required. Record the existing boot settings. On a work or school device, involve IT. If you use another operating system or custom boot software, confirm that it supports the intended Secure Boot configuration. ### Do Not Confuse the Windows Disk Layout with Every Attached Disk A normal Windows UEFI installation uses GPT for its system disk. This does not mean that all attached data disks must be converted to GPT to enable Secure Boot. Do not assume the Windows system disk is Disk 0, particularly on a PC with several drives. If **BIOS Mode** is **Legacy**, do not simply disable CSM or switch the firmware to UEFI and hope Windows starts. The existing Windows installation may need a planned conversion or reinstallation first. Microsoft’s [MBR2GPT documentation](https://learn.microsoft.com/en-us/windows/deployment/mbr-to-gpt?ref=elevendecoded.com) explains the supported system-disk conversion, validation, encryption prerequisites and required firmware transition. The tool has layout restrictions, and validation is not itself a conversion. Get assistance if you cannot confidently identify the correct disk and recovery plan. If Windows already reports UEFI, do not convert disks based only on an apparently inconsistent disk listing. Identify the actual boot and Windows disks before making changes. ### Enter UEFI Settings On supported PCs, open **Settings > System > Recovery > Advanced startup > Restart now**. In Windows Recovery, choose **Troubleshoot > Advanced options > UEFI Firmware Settings > Restart** if that option is available. Alternatively, use the exact startup-key procedure in your PC or motherboard manual. Restarting is valid; Windows Fast Startup applies to shutdown and does not require you to avoid Restart. Firmware Fast Boot is a separate setting that may affect the time available to press a key. ### Enable Secure Boot Using Model-Specific Instructions 1. Locate Secure Boot in the firmware menu, often under Security, Boot or Authentication. 2. Follow your manufacturer’s procedure for the exact model and firmware version. Menu names and prerequisites vary. 3. Do not blindly set a firmware administrator password, disable CSM, clear security keys or install custom keys because a menu is unavailable. These actions have different consequences and are not universal fixes. 4. If the manufacturer requires restoring factory Secure Boot keys or changing a mode, follow that documented procedure and confirm compatibility with your boot software. 5. Save changes using the firmware’s documented Save and Exit action. F10 is common but not universal. A firmware update is appropriate only when the manufacturer identifies a relevant need. Use the exact model’s update and power precautions; a missing menu does not automatically call for flashing firmware. ### Verify After Restarting When Windows starts, run **msinfo32** again and confirm **Secure Boot State: On**. If you suspended BitLocker, follow the required procedure to restore protection and confirm its status. If Windows fails to start, record the error and consult the manufacturer or IT. Reverting only the Secure Boot change may help if that was the only change, but a Legacy-to-UEFI change or disk conversion can require a different recovery procedure. Do not repeatedly convert disks or clear the TPM to troubleshoot a boot failure. A recovery-key prompt requires the correct BitLocker recovery key; changing firmware settings does not bypass encryption. Secure Boot protects the startup trust chain when configured correctly, while ongoing Windows and firmware maintenance remain necessary.