Secure Boot is a security feature built into your computer's firmware that protects the boot process before Windows can even load. When it's enabled, your computer checks that every piece of software involved in starting up is trusted and hasn't been tampered with. If something doesn't pass that check, the computer stops the boot process before any damage can be done.
Most computers manufactured in the last several years come with Secure Boot enabled by default. But there are situations where it gets turned off, sometimes intentionally and sometimes accidentally, and users don't realize it. In this post, I'll show you how to check whether Secure Boot is enabled on your computer and how to turn it on if it isn't.
What Secure Boot Does
When you turn on your computer, a process called the boot sequence begins. The computer loads its firmware, then a bootloader, and then the operating system. Secure Boot monitors each step and verifies that only software with a trusted digital signature is allowed to run. This prevents malicious programs like rootkits and bootkits from loading before Windows starts, at a point in the startup process where traditional antivirus software can't help.
Secure Boot is required for Windows 11 and is one reason Microsoft made UEFI firmware a prerequisite for the upgrade. If you are still running Windows 10 and plan to upgrade, enabling Secure Boot is one of the first steps you may need to take. For more on enabling the other key requirement, check out our post: Enabling TPM for Windows 11 upgrade on 2018-2021 Windows 10 PCs.
Check if Secure Boot is already enabled
Before making any changes, it's worth checking whether Secure Boot is already turned on. Many users find it's already enabled, so no further steps are needed.
The quickest way to check is through System Information:
- Right-click on the Start button to bring up the Power User menu.
- Left-click on Run.
- In the Run dialog box, type msinfo32 and left-click OK.
- The System Information window will open with System Summary selected by default in the left-hand column.
- In the right-hand column, look for two entries:
- BIOS Mode: this should read UEFI. If it reads Legacy, see the important note below.
- Secure Boot State: this should read On. If it reads Off, continue with the steps below.
If Secure Boot State reads On, you're already protected, and no further steps are needed.
Important note about Legacy BIOS mode
If BIOS Mode reads Legacy rather than UEFI, your computer is currently running in Legacy (also called CSM) mode. Switching from Legacy to UEFI mode is more involved and requires your system disk to use the GPT partition style rather than MBR. Switching the boot mode without first converting the disk will make Windows unbootable. If you are in this situation, I strongly recommend bringing your computer in for a professional assessment before making any changes.
Access your UEFI or BIOS settings
If Secure Boot is off but BIOS Mode reads UEFI, enabling it is straightforward. Restart your computer and enter your UEFI or BIOS settings. You can do this in two ways.
From inside Windows 11
This is the easiest and safest method:
- Left-click on the Start
button to bring up the Start menu.
- Left-click on Settings (gear icon).
- In the left-hand column, left-click on System.
- In the right-hand column, left-click on Recovery.
- Under Advanced startup, left-click Restart now.
- If prompted to save any open work, do so first, then left-click Restart now again.
- Your computer will restart to the Advanced Boot Options screen. Left-click on Troubleshoot.
- Left-click on Advanced options.
- Left-click on UEFI Firmware Settings.
- Left-click Restart. Your computer will restart directly into your UEFI or BIOS settings.
From the keyboard at startup
Alternatively, you can enter BIOS by pressing a specific key immediately after powering on your computer. The key varies by manufacturer:
- Dell: F2
- HP: F10 or Esc
- Lenovo: F1 or F2
- ASUS: F2 or Delete
- Acer: F2 or Delete
- MSI: Delete
You'll need to press the key repeatedly as soon as the computer starts, before Windows begins to load. If you miss the window, restart and try again.
For a full walkthrough of the Advanced Boot Options, check out our post: How to get to and use the Advanced Boot Options inside of Windows 11.
Enable Secure Boot in your UEFI or BIOS settings
Every BIOS and UEFI interface looks a little different depending on the manufacturer. Still, the Secure Boot setting is almost always in one of three locations: the Security tab, the Boot tab, or the Authentication tab. Use your keyboard arrow keys to navigate between tabs and menus.
Once you find the Secure Boot setting:
- Select Secure Boot and set it to Enabled.
- If you see an option for Secure Boot Mode, leave it set to Standard or Default. This loads the factory-trusted security keys and is the correct setting for most users.
- Press F10 to save your changes and exit. Your computer will restart.
Note: The exact key to save and exit may vary. Look for a legend at the bottom or side of your BIOS screen that shows the available keyboard commands. It will typically show something like F10 = Save and Exit.
Verify that Secure Boot is now enabled
After your computer restarts, it's worth confirming that Secure Boot is now active:
- Right-click on the Start button to bring up the Power User menu.
- Left-click on Run.
- Type msinfo32 and left-click OK.
- Check that Secure Boot State now reads On.
You can also verify using Terminal (Admin):
- Right-click on the Start button and left-click Terminal (Admin).
- Type the following and press Enter:
Confirm-SecureBootUEFI
- If Secure Boot is enabled, the command returns True. If it returns False, Secure Boot is supported but still disabled. If it returns an error, your system may not support Secure Boot or may still be in Legacy mode.
For more on using Windows Terminal, check out our post: Exploring the features of Windows Terminal.
A note on Secure Boot and BitLocker
If your computer uses BitLocker drive encryption or Device Encryption, be aware that changes to Secure Boot settings can sometimes trigger a BitLocker recovery prompt on your next restart. If this happens, you will be asked to enter your BitLocker recovery key before Windows loads. Make sure you have your recovery key available before changing any BIOS settings. You can find your recovery key by signing into your Microsoft account at account.microsoft.com and looking under Devices.
Secure Boot is one of those features that works quietly in the background, and most users never need to think about it. But if it's turned off on your computer, turning it back on is a simple way to add an important layer of protection. As long as your computer is running in UEFI mode and your disk uses the GPT partition style, the steps above will get you there in just a few minutes.
For more on keeping your Windows 11 computer secure and running well, check out these posts:
Enabling TPM for Windows 11 upgrade on 2018-2021 Windows 10 PCs
How to get to and use the Advanced Boot Options inside of Windows 11
How to find and update drivers in Windows