How to fix the BitLocker E_FVE_SECUREBOOT_DISABLED error
This means BitLocker found Secure Boot turned off, and it uses Secure Boot as part of how it checks the system has not been tampered with. Turning Secure Boot back on resolves it. Jump to your situation below or work through the methods in order.
By Neeraj Singh ~6 min Updated Jun 2026 90% found this helpful
Error message
E_FVE_SECUREBOOT_DISABLED. BitLocker could not continue because Secure Boot is disabled.
Summary
E_FVE_SECUREBOOT_DISABLED means BitLocker detected that Secure Boot is turned off. BitLocker can use Secure Boot as part of its integrity validation, the check that the boot path has not been altered, so if Secure Boot was disabled, often to boot a Linux USB, an old installer, or after a firmware reset, BitLocker treats it as a change to the protected environment and stops. The fix is to re-enable Secure Boot in the UEFI firmware. That usually requires the system to be booting in UEFI mode with the disk in GPT, not legacy CSM mode, so you may also need to disable CSM. If the drive locked, you will need the 48-digit recovery key to get in first. Suspending BitLocker before any future firmware change avoids the lockout.
What this error means
BitLocker protects against someone altering your boot path to steal your data. To do that it measures the boot environment, and Secure Boot is part of that measurement. When Secure Boot is on at encryption time and off later, BitLocker sees the protected environment has changed and refuses to proceed.
So this is BitLocker working as designed, not a fault. Putting Secure Boot back the way it was satisfies the integrity check. The common trigger is deliberately turning Secure Boot off to boot other media, or a BIOS update or reset reverting it.
Common causes
Secure Boot was disabled in the UEFI firmware.
Secure Boot was turned off to boot a Linux USB or old installer.
A BIOS or UEFI update or reset reverted Secure Boot.
“This is not a bug, it is BitLocker doing its job. It watched Secure Boot get turned off, decided the boot environment had changed, and clamped down. So the fix is simply to put Secure Boot back on in the UEFI. The only gotcha is that Secure Boot needs UEFI mode and a GPT disk, so if CSM is on you turn that off too. And the lesson for next time, suspend BitLocker before you go poking at firmware, then it will not panic.”
Manager, Tech Support & Operations · 19+ years fixing Windows and system errors
✓ How to fix it
Method 1
Re-enable Secure Boot in UEFI
1Restart into the UEFI firmware (often F2, F10, Del, or via Settings, Recovery, Advanced startup, UEFI Firmware Settings).
2Find Secure Boot under the Boot or Security menu and set it to Enabled.
3Save and exit.
Method 2
Ensure UEFI mode (disable CSM)
1Secure Boot needs UEFI mode. In the firmware, disable CSM or Legacy boot if it is on.
2The system drive must be GPT for UEFI boot.
3Then enable Secure Boot.
Method 3
Unlock with the recovery key if needed
1If the drive is locked, enter the 48-digit BitLocker recovery key at the prompt (find it in your Microsoft account, your organisation's portal, or a saved copy).
2Once in Windows, re-enable Secure Boot.
3Protection then continues normally.
Method 4
Suspend BitLocker before future firmware changes
1In future, suspend BitLocker before changing firmware settings:
manage-bde -protectors -disable C:
2Make the change, then re-enable: manage-bde -protectors -enable C:.
3This prevents the lockout entirely.
E_FVE_SECUREBOOT_DISABLED is BitLocker's integrity check firing, so the fix is to put Secure Boot back on in UEFI. Remember Secure Boot needs UEFI mode and a GPT disk, so disable CSM if it is enabled. Suspend BitLocker before any future firmware change to avoid being locked out again.
Frequently asked questions
What does E_FVE_SECUREBOOT_DISABLED mean?
It means BitLocker found Secure Boot turned off. BitLocker uses Secure Boot in its integrity check, so disabling it makes BitLocker treat the boot environment as changed and stop.
How do I re-enable Secure Boot?
Restart into the UEFI firmware, find Secure Boot under the Boot or Security menu, set it to Enabled, and save. You may also need to disable CSM so the system boots in UEFI mode.
Why did Secure Boot turn off?
Usually it was disabled deliberately to boot a Linux USB or old installer, or a BIOS update or reset reverted it. BitLocker then detects the change at the next boot.
Will I need my recovery key?
If the drive locked, yes. Enter the 48-digit recovery key from your Microsoft account, your organisation's portal, or a saved copy, then re-enable Secure Boot in Windows.
How do I avoid this next time?
Suspend BitLocker with manage-bde -protectors -disable C: before changing firmware settings, make the change, then re-enable protection. BitLocker then will not flag the change.
Does Secure Boot need UEFI mode?
Yes. Secure Boot only works in UEFI mode with a GPT system disk. If the PC is in legacy CSM mode, disable CSM first, then enable Secure Boot.
Still not working?
If Secure Boot is greyed out or will not enable, the disk may be in MBR or the firmware may be in legacy mode. Converting the system disk from MBR to GPT (with mbr2gpt) and switching the firmware to UEFI lets Secure Boot turn on. You can also submit your error to us for a tailored fix.
