Windows 11 how to check if Secure Boot is enabled and what to do next
Use System Information to check the current Secure Boot state on Windows 11. Its status must be interpreted alongside BIOS Mode and the manufacturer’s firmware documentation: Unsupported does not by itself prove that the hardware lacks the feature. Windows Security can also show related device-security information, but enabling Secure Boot is normally a firmware operation.
How can I quickly check if Secure Boot is enabled on my Windows 11 PC?
Press Windows+R, enter msinfo32, and read Secure Boot State and BIOS Mode in System Summary. On indicates active Secure Boot; Off indicates it is inactive. If the state is Unsupported, investigate the current firmware boot mode and model capability rather than immediately concluding the motherboard cannot support it.
Open Windows Security > Device security and look for its Secure boot information where available. Secure Boot is a separate section from Core isolation, not a toggle inside Core isolation details. The information displayed depends on the device and Windows version; a missing section alone is not a complete hardware-capability test.
These methods let you confirm Secure Boot status without restarting or entering BIOS. If it’s off but should be on, the next step is to check your firmware settings.
What exactly is Secure Boot and why should I care?
Secure Boot is a firmware security feature that protects your PC during startup. It ensures only software and drivers signed with trusted certificates can load before Windows starts. This helps prevent malicious programs, like rootkits, from running early in the boot process where they can evade antivirus detection.
Windows 11’s minimum firmware requirement is UEFI with Secure Boot capability. Microsoft distinguishes being capable from having Secure Boot enabled for an upgrade. Enabling it provides protection, and an organization or game may impose a stricter enabled-state requirement.
Secure Boot is one layer of startup protection, separate from TPM, drive encryption, and memory integrity. It does not guarantee general hardware compatibility or prevent every kind of malware.
Why might Secure Boot be disabled or not showing as enabled?
Secure Boot can be turned off for several reasons. One common cause is that your PC is set to use legacy BIOS mode instead of UEFI firmware, and Secure Boot requires UEFI.
Another reason is hardware limitations. Older motherboards or custom-built PCs with legacy components may not support Secure Boot.
If someone changed BIOS/UEFI settings to install another operating system or enable compatibility options, Secure Boot might have been disabled. Firmware updates or boot option changes can also turn it off unintentionally.
Virtual machines and dual-boot systems do not inherently require Secure Boot to be disabled. Support depends on the VM firmware, bootloader signatures, enrolled trust, and operating systems involved. Consult the relevant platform documentation before changing it.
How do I enable Secure Boot if it’s currently turned off?
To enable Secure Boot, you need to enter your PC’s UEFI firmware settings. In Windows 11, go to Settings > System > Recovery. Under Advanced startup, click Restart now. After rebooting, select Troubleshoot > Advanced options > UEFI Firmware Settings, then Restart.
In the UEFI menu, look for a Security, Boot, or Authentication tab—it varies by manufacturer. Find the Secure Boot option and set it to Enabled. Save your changes and exit; your PC will restart.
If BIOS Mode is Legacy, do not simply switch the firmware setting and expect the existing installation to boot. Check the disk layout and the manufacturer’s supported migration procedure first. A supported MBR-to-GPT conversion may be possible in eligible configurations; in other cases reinstalling may be needed. Back up data and preserve recovery access before either approach.
Check the exact model’s firmware instructions and whether administrator controls, CSM, key enrollment, or other prerequisites apply. Do not clear Secure Boot keys or reset all firmware settings as a generic fix. Clearing trust data can leave Secure Boot inactive or prevent expected boot software from being trusted.
What should I keep in mind before changing Secure Boot settings?
Secure Boot evaluates trusted boot components; Windows driver-signing and memory-integrity checks are related but distinct protections. If boot media, an alternate operating system, or an early boot component is rejected, use the appropriate publisher’s signed, supported version and model-specific guidance instead of assuming ordinary desktop apps all need replacement.
Back up important files and make sure the BitLocker recovery key is available outside the encrypted PC. Firmware and boot-security changes can trigger recovery. Follow the manufacturer’s BitLocker suspension/resumption instructions where required; a restore point alone is not a file backup or a substitute for the recovery key.
Be careful when adjusting firmware settings—incorrect changes can prevent your PC from booting. Document your current settings so you can revert if needed.
Use only the manufacturer’s applicable firmware package and follow its instructions. Secure Boot certificate servicing is also relevant in 2026: keep current Windows and OEM updates, and follow Microsoft’s certificate guidance. An On state alone does not establish that all certificate updates have completed. Do not clear keys or disable Secure Boot to deal with certificate-expiry concerns.
Conclusion
Read Secure Boot State together with BIOS Mode, distinguish capability from current enablement, and use the exact model’s guidance for changes. Keep data backups and BitLocker recovery access available. After a supported change, verify normal boot and the reported state. If a problem occurs, investigate its exact firmware, bootloader, servicing, or configuration cause rather than assuming Windows cannot be involved.
Frequently Asked Questions
Can I enable Secure Boot without reinstalling Windows 11?
Usually, yes. You can enable Secure Boot in your UEFI firmware without reinstalling Windows. But if your system is in legacy BIOS mode, switching to UEFI to support Secure Boot may require converting your disk or reinstalling Windows.
What if my system says Secure Boot is unsupported?
Unsupported may reflect the current Legacy/CSM configuration rather than permanent hardware inability. Check BIOS Mode and the exact model’s capabilities before planning conversion, firmware changes, or replacement.
Will Secure Boot affect my existing drivers or software?
It can reject untrusted boot components, while Windows also applies separate driver-signing and memory-integrity protections. Compatibility depends on the component and trust configuration; a Secure Boot status alone does not diagnose every driver or app failure.
How do I know if my PC uses UEFI or legacy BIOS?
In msinfo32, BIOS Mode reports UEFI or Legacy for the current Windows boot. UEFI mode is necessary for Secure Boot but does not by itself prove that Secure Boot is enabled or correctly provisioned. Check Secure Boot State and the model documentation too.
Is Secure Boot required for Windows 11 installation?
The stated Windows 11 firmware requirement is UEFI with Secure Boot capability. Enabled-state requirements can additionally come from security policy or particular applications. Meeting this firmware condition alone does not establish complete Windows 11 eligibility.