How to Enable Secure Boot on Windows 11 and 10 in the BIOS
Enable Secure Boot in three moves. Confirm Windows starts in UEFI mode on a GPT disk, open the firmware settings and set Secure Boot to Enabled. Steps for ASUS, MSI, Gigabyte, ASRock and Dell sit below, along with fixes for a grayed out option.
By Neeraj Singh ~8 min Updated Nov 2026 Checked against Microsoft Learn
Error message
Secure Boot State: Off (System Information, msinfo32)
Summary
Secure Boot works only when Windows starts in UEFI mode from a GPT disk. Check both in msinfo32 first. Open the firmware settings from Settings, System and Recovery, disable CSM and set Secure Boot to Enabled. Choose Windows UEFI mode or install the default Secure Boot keys when your board asks. Convert an MBR disk with mbr2gpt before you switch modes. Suspend BitLocker before you change any firmware setting. Open msinfo32 again and confirm that Secure Boot State reads On.
What Secure Boot Does and When You Need It
Secure Boot is a firmware feature that checks the signature of every boot file before Windows starts. Microsoft says it helps prevent malicious software from loading when a Windows PC starts up.
Windows 11 lists the system firmware requirement as UEFI with Secure Boot capability. Some games with anti-cheat check the same setting. You can meet the message in a game error first.
You can enable Secure Boot only in the firmware, because software cannot change it. The setting works after Windows boots in UEFI mode from a GPT disk with CSM off.
Microsoft also replaces the 2011 Secure Boot certificates during 2026. Microsoft says most Windows devices receive the new certificates automatically. You do not need that update to enable Secure Boot.
Why Secure Boot Is Off or Missing
Windows was installed in Legacy BIOS mode on an MBR disk. Secure Boot cannot start in that mode.
CSM or Legacy Support is on in the firmware, which hides or grays out the Secure Boot option.
The board ships with Secure Boot set to Off or with OS Type set to Other OS.
The Secure Boot keys are cleared or missing. The firmware then shows the state as not active.
A BIOS reset or update set Secure Boot back to its default.
An old BIOS version does not offer a Secure Boot setting.
✓ How to fix it
Method 1
Check Secure Boot State and Disk Style
1Press Windows key + R, enter this and press Enter.
msinfo32
2Select System Summary and find BIOS Mode and Secure Boot State. Dell tells you to look for BIOS Mode UEFI and both Dell and ASUS tell you to look for Secure Boot State On.
3If BIOS Mode says UEFI and Secure Boot State says Off, go to Method 3. If BIOS Mode says Legacy, you need Method 2 first. Unsupported means the same Legacy problem. The Secure Boot State Unsupported fix covers that message.
4For a second check, open PowerShell as administrator and enter this. Microsoft says it returns True when Secure Boot is on and False when it is off.
5Right-click the Start button, select Disk Management, right-click your Windows disk and select Properties. Open the Volumes tab and check Partition style. Microsoft uses the same path on its MBR to GPT disk page.
6GPT with BIOS Mode UEFI means you can skip to Method 3. MBR means you continue with Method 2.
Method 2
Convert an MBR Disk to GPT With MBR2GPT
1Make a backup of your files first. Microsoft says the conversion cannot be undone once it finishes. The tool converts system disks only.
2Suspend BitLocker on the Windows drive before you convert. Microsoft says BitLocker volumes need suspended protection. You must delete and recreate the protectors afterward to resume it.
3Open Command Prompt as administrator and validate the disk. Use your own disk number from Disk Management if it is not 0.
mbr2gpt /validate /disk:0
4If validation passes, convert the disk from inside Windows.
mbr2gpt /convert /disk:0 /allowFullOS
5Microsoft says validation fails with more than three primary partitions, with any extended or logical partition or with too little unpartitioned space. Fix the layout or use clean installation media in UEFI mode instead.
6Do not start Windows yet. Microsoft prints a reminder that you must switch the firmware to UEFI mode before the new layout boots. Go to Method 3. The full option list is on the MBR2GPT page on Microsoft Learn.
Method 3
Open the UEFI Firmware Settings From Windows
1Suspend BitLocker protection first if the drive is encrypted. Microsoft says changing the BIOS, UEFI firmware or boot configuration can send the PC into recovery mode and ask for your recovery key. The E_FVE_SECUREBOOT_DISABLED fix covers the BitLocker message.
2Keep a copy of your BitLocker recovery key nearby before you restart.
3Select Settings, then System, then Recovery. Under Advanced startup, select Restart now.
4On the next screen select Troubleshoot and then Advanced options. Select UEFI Firmware Settings and choose Restart. This is the path Microsoft lists on its Windows 11 and Secure Boot page.
5Your PC maker can use a startup key instead. Dell shows F2, ASRock shows F2, Gigabyte shows Delete and ASUS shows F2 or Delete on desktop boards.
Method 4
Enable Secure Boot in the BIOS
1Look for the Boot or Security tab. Names differ by maker. Follow Method 5 if you do not see the words below.
2Set the boot mode to UEFI and disable CSM or Legacy Support. The Secure Boot option stays hidden or grayed out until you do.
3Open Secure Boot. If the board offers OS Type, change Other OS to Windows UEFI mode. ASUS says this setting activates Secure Boot.
4If the state shows Not Active, set Secure Boot Mode to Custom and install the default keys. ASUS names it Install Default Secure Boot Keys, ASRock names it Install default Secure Boot keys and Gigabyte names it Restore Factory Keys.
5Set Secure Boot to Enabled, press F10 and confirm the save. Start Windows.
6Open msinfo32 again and check that BIOS Mode says UEFI and Secure Boot State says On.
Method 5
Follow the Steps for Your PC or Board Maker
1ASUS motherboards. Press F7 for Advanced Mode, open the Boot tab, select Secure Boot and set OS Type to Windows UEFI mode. Press F10 to save. See ASUS support on enabling Secure Boot.
2ASRock motherboards. Press F2 and set CSM to Disabled under Boot\CSM. Under Security\Secure Boot, set Secure Boot Mode to Custom, select Install default Secure Boot keys, set Secure Boot to Enabled and save with F10. After the restart the menu should show Active. See ASRock FAQ on Secure Boot.
3Gigabyte motherboards. Press Delete, go to Boot and set CSM Support to Disabled. Open Secure Boot, set Secure Boot Mode to Custom and confirm the Restore Factory Keys prompts. Gigabyte lists these steps for AM4 and TRX40 boards on its Gigabyte Secure Boot support page.
4MSI motherboards. MSI places the setting under Security\Secure Boot or Settings\Security\Secure Boot. MSI also names an Image Execution Policy setting for Secure Boot. See the MSI statement on Secure Boot.
5Dell PCs. Press F2 at the Dell logo and open Boot, Boot Sequence or Boot Configuration. Set Secure Boot to Enabled and select Apply or Save and Exit. Dell warns that a switch from Legacy to UEFI makes the current Windows installation unbootable. Convert the disk with Method 2 first. See Dell support on enabling Secure Boot.
6HP and Lenovo menus differ by model. Use the manual for your model and keep the same order of steps: UEFI mode, CSM off, default keys, Secure Boot Enabled.
Method 6
Fix a Grayed Out Secure Boot Option
1Check that BIOS Mode is UEFI and that CSM or Legacy Support is off. Dell says a grayed out or missing Secure Boot option points to Legacy boot mode. Gigabyte says the option appears after CSM Support is disabled.
2Install the default Secure Boot keys with the menu names from Method 5. ASUS notes that the Secure Boot state value cannot be set by hand and follows the keys and OS Type.
3Update the BIOS from your board or PC maker if the setting is missing from the menu.
4If Windows fails to start after the change, go back to the BIOS. Gigabyte says you can set CSM Support back to Enabled or disable Secure Boot, then fix the disk with Method 2.
Secure Boot needs UEFI mode and a GPT disk. Check msinfo32, convert with mbr2gpt if the disk is MBR, suspend BitLocker, disable CSM, install the default keys and set Secure Boot to Enabled. Confirm that Secure Boot State reads On.
Frequently asked questions
How do I enable Secure Boot on Windows 11?
Open the firmware settings from Settings, System, Recovery, Advanced startup and Restart now. Disable CSM, set Secure Boot to Enabled and save. Your PC must boot in UEFI mode from a GPT disk first.
How do I check if Secure Boot is on?
Press Windows key + R, enter msinfo32 and read Secure Boot State under System Summary. On means it is active. You can also enter Confirm-SecureBootUEFI in an administrator PowerShell window, which returns True when it is on.
Do I need GPT and UEFI to enable Secure Boot?
Yes. Secure Boot works only when Windows boots in UEFI mode. The UEFI boot path needs a GPT system disk. Convert an MBR disk with mbr2gpt before you switch the firmware to UEFI.
Will enabling Secure Boot delete my files?
Switching Secure Boot on does not delete files. Converting the disk with mbr2gpt does not delete data either. Microsoft says the conversion cannot be undone. Make a backup before you change the disk or the firmware mode.
Will Secure Boot ask for my BitLocker recovery key?
It can. Microsoft says changing the BIOS, UEFI firmware or boot configuration can send a BitLocker PC into recovery mode. Suspend protection first and keep your recovery key handy.
Why is Secure Boot grayed out in my BIOS?
The firmware is in Legacy or CSM mode or the Secure Boot keys are missing. Disable CSM, switch to UEFI and install the default keys. Update the BIOS if the setting does not appear at all.
Do the 2026 Secure Boot certificate changes affect me?
Microsoft says the 2011 certificates expire between June and October 2026 and Windows devices receive the 2023 replacements automatically. PCs that miss the update keep starting normally but stop receiving new boot protections. Install Windows Update and your PC maker BIOS updates.
Is it safe to disable Secure Boot again?
Yes. Microsoft says some fixes call for disabling Secure Boot for a short time. It recommends enabling it again afterward. Games with anti-cheat and Windows 11 expect it to stay on.
