Enable Windows 11 Secure Boot in UEFI

Secure Boot only allows signed boot software

Secure Boot is a security feature of UEFI firmware that checks whether boot software comes from a trusted, digitally signed source. This prevents malicious code from installing itself before Windows loads. Windows 11 requires Secure Boot as one of its hard system requirements, alongside a TPM 2.0 chip.

The feature works only on a PC that boots in UEFI mode and whose system disk uses the GPT format. If your PC still runs in the older Legacy or BIOS mode with an MBR disk, you need to convert it first. That is usually why the option is missing or greyed out on older systems.

Under the hood, Secure Boot maintains a list of trusted digital signatures. At startup the firmware compares the signature of each bootloader with that list. If the signature doesn't match, the machine refuses to load the code. This blocks, for example, a rootkit that tries to wedge itself between the firmware and Windows. Together with the TPM 2.0 chip, which stores encryption keys, this forms the security basis that Windows 11 relies on.

This guide first checks your current status, converts the disk to GPT if necessary, and then enables Secure Boot via the firmware. The order is important: converting the disk after you have already switched the firmware makes the PC unbootable. Therefore, follow the steps in the order they are presented and don't skip any, even if you think a part is already set correctly.

First check your Secure Boot status with msinfo32

Before making any changes, find out where you stand. Windows displays the status in the System Information window.

1. Press Windows + R, type msinfo32 and press Enter.
2. Stay on System Summary.
3. Look for the line Secure Boot State. If it says On, Secure Boot is already active.
4. Also check BIOS Mode. If it says UEFI, your firmware is set correctly; if it says Legacy, you need to switch first.

If Secure Boot State is Off while BIOS Mode is already UEFI, you only need to turn on the firmware setting (skip ahead to the section about the UEFI). If BIOS Mode is Legacy, a conversion is required first.

To check the status from a script or quickly from PowerShell, use the command below in an elevated PowerShell window. It returns True if Secure Boot is on and False if it is off. If the machine is still in Legacy mode, it reports that Secure Boot is not supported on this platform.

Confirm-SecureBootUEFI

Secure Boot requires UEFI mode and a GPT disk

Secure Boot and the old Legacy boot mode are mutually exclusive. The feature belongs to UEFI, the modern firmware that has replaced MBR. Two conditions must therefore be met.

The disk format is checked like this: open Disk Management (press Windows + X and choose Disk Management), right-click the system disk, select Properties > Volumes and read the Partition style. If it says GUID Partition Table (GPT), you are ready for Secure Boot. If it says MBR, convert first.

The third condition, disabling CSM, is linked to the first two. CSM is the compatibility layer that allows the firmware to still boot in the old Legacy way. As long as it is on, the machine remains in a hybrid state and many motherboards hide the Secure Boot option. You disable CSM in the same firmware where you turn on Secure Boot, which will be covered later.

Safely convert an MBR disk to GPT with mbr2gpt

MBR (Master Boot Record) and GPT (GUID Partition Table) are two ways to describe the layout of a disk. MBR is the older standard associated with Legacy boot; GPT is the modern variant required by UEFI and Secure Boot. Windows has included the mbr2gpt tool for years, which converts a disk from MBR to GPT without wiping your files. You run it from within Windows itself.

First, back up important files. The conversion is generally safe, but any change to the disk layout carries a small risk. Then, turn off BitLocker or suspend protection, otherwise the PC will ask for your recovery key at the next start.

First, check that the disk is suitable for conversion. Open an elevated Command Prompt and run the validation:

mbr2gpt /validate /disk:0 /allowFullOS

If the tool reports that validation succeeded, run the conversion:

mbr2gpt /convert /disk:0 /allowFullOS

Replace /disk:0 with the disk number from Disk Management if your system disk has a different number. After a successful conversion, shut down Windows, enter the firmware and set the boot mode to UEFI. If you switch the firmware before converting the disk, Windows will no longer start. The official documentation with all options is on the Microsoft Learn page on mbr2gpt.

Enable Secure Boot via the UEFI firmware

Now that the disk is on GPT, enter the firmware to adjust settings. You can enter in two ways: via the Windows recovery menu, or by pressing a key during startup. The route via Windows is the most reliable, as you do not need to hit the right moment to press the firmware key.

1. Go to Settings > System > Recovery (or Update & Security > Recovery in older builds) and under Advanced startup, click Restart now.
2. Choose Troubleshoot > Advanced options > UEFI Firmware Settings and restart.
3. In the firmware, look for the Boot or Security section.
4. Turn off CSM (Compatibility Support Module) or Legacy boot, and set the boot mode to UEFI.
5. Set Secure Boot to Enabled. If the board asks for default keys, choose Install default Secure Boot keys or Restore factory keys.
6. Save with Save and Exit, usually the F10 key.

If you cannot enter the firmware via Windows, restart and press the firmware key repeatedly right after powering on. It varies by brand: often Del or F2, sometimes F10, F12 or Esc. After saving, Windows should start normally. Check with msinfo32 that Secure Boot State is now On.

The names of settings differ by manufacturer. What is under Boot on one board may be called Security, Authentication or Startup on another. Look for the terms Secure Boot, CSM, Legacy and Boot Mode; these are present everywhere. If you cannot find Secure Boot, first check that CSM is completely off, because as long as that compatibility layer is active, many boards hide the Secure Boot setting.

Secure Boot option greyed out or PC fails to start

Most problems arise from the wrong order or a setting that blocks the option. Work through these points.

• Secure Boot option is greyed out: CSM or Legacy boot is still on. Disable that first and restart the firmware.
• Option asks for a password: some boards require an administrator password in the firmware before you can enable Secure Boot. Set that under Security.
• PC won't start after switching: you set the firmware to UEFI while the disk was still MBR. Switch the firmware back to Legacy, start Windows and convert with mbr2gpt first.
• BitLocker asks for a recovery key: you forgot to suspend protection. Enter the key or suspend BitLocker before changing firmware settings next time.
• Validation of mbr2gpt fails: the disk has too many partitions or insufficient space for the new layout. Remove unnecessary partitions and try validation again before converting.

If the PC continues to act up after a firmware change, bear in mind that a major hardware change can also affect your activation; in that case, see how you can restore your Windows licence after a hardware change. If you are unsure whether your PC with the right edition and firmware is ready for Windows 11, the overview of upgrading Windows 11 Home to Pro helps set out the edition requirements.

Re-enable BitLocker and check Windows 11 readiness

After enabling, there are two things to complete, especially if you converted the disk or suspended BitLocker.

1. Resume BitLocker protection if you suspended it. Go to Control Panel > System and Security > BitLocker Drive Encryption and choose Resume protection.
2. Open Microsoft's PC Health Check app to confirm that the PC now meets all Windows 11 requirements, including Secure Boot and TPM 2.0.
3. Verify that your boot disk is still correctly recognised and that Windows starts without a recovery message.

If you notice extra boot delay or an error about boot order after the conversion, go back into the firmware and put the system disk at the top of the boot list. This ensures the PC knows which drive to start from. With that, Secure Boot is enabled and your PC is ready for the installation or upgrade of Windows 11.