sodcalculator

10 Tech How-To

How to Check Secure Boot & Keep Windows PC Protected

Guide 10-31149 · Updated · Step by step

Secure Boot is a UEFI security feature that verifies the digital signature of the operating system loader before Windows starts, blocking rootkits and bootkits from loading early. This guide shows you how to check whether Secure Boot is enabled on your Windows 10 or Windows 11 PC, and how to keep it that way for stronger protection.

What You’ll Need

  • A Windows 10 or Windows 11 PC with UEFI firmware (not legacy BIOS).
  • Administrator access to your PC (to run System Information and change firmware settings).
  • Your device’s user manual or manufacturer’s website, in case you need to access the UEFI firmware settings.

Step-by-Step

  1. Check Secure Boot status via System Information (easiest method).
    1. Press Windows + R to open the Run dialog.
    2. Type msinfo32 and press Enter. This opens System Information.
    3. In the left pane, ensure System Summary is selected.
    4. In the right pane, look for Secure Boot State. Its value will be On, Off, or Unsupported.
  2. Interpret the result.
    • On – Secure Boot is enabled and active. Your PC is protected.
    • Off – Secure Boot is disabled. You can enable it by following steps 3–5.
    • Unsupported – Your PC uses legacy BIOS, not UEFI, so Secure Boot is not available. Consider upgrading your hardware if security is a priority.
  3. Access UEFI firmware settings (to enable or verify Secure Boot).
    1. Open Settings (Windows + I).
    2. Go to System > Recovery (Windows 11) or Update & Security > Recovery (Windows 10).
    3. Under Advanced startup, click Restart now.
    4. After the PC restarts to the blue menu, choose Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.
  4. Enable Secure Boot in the UEFI settings.
    1. Once in the UEFI (also called BIOS setup), locate the Boot or Security tab. The exact location varies by manufacturer.
    2. Find the Secure Boot option. It may be listed as Secure Boot Control, Windows Secure Boot, or simply Secure Boot.
    3. Set it to Enabled.
    4. If you see a Secure Boot Mode option, choose Standard (or Custom if you manage your own keys, but Standard is recommended).
    5. Save changes and exit. Usually press F10 and confirm.
  5. Verify Secure Boot is now on. Repeat step 1 to confirm that the Secure Boot State reads On.
  6. Keep Secure Boot enabled. Avoid turning it off unless absolutely necessary (e.g., for certain Linux distributions or hardware drivers that don’t support it). If you must disable it temporarily, re-enable it afterward.
  7. Update your firmware and Windows regularly. Firmware updates can improve Secure Boot’s security and compatibility. Install Windows Updates and check your manufacturer’s website for UEFI updates.

Common Mistakes

  • Confusing Secure Boot with Fast Boot. Fast Boot is a separate feature that speeds up startup; it does not provide the same security verification.
  • Assuming Secure Boot is on because Windows 11 is installed. Windows 11 requires Secure Boot for installation, but some PCs may have it disabled afterward, or the installation may have been done with a workaround.
  • Disabling Secure Boot to install an older OS or a graphics card with legacy VBIOS. This weakens protection. Look for alternative solutions, such as updating the GPU firmware or using a compatible OS.
  • Not saving changes before exiting UEFI. If you exit without saving, Secure Boot remains off.
  • Forgetting to re-enable Secure Boot after troubleshooting. Many troubleshooting guides suggest disabling it; if you do, re-enable it as soon as the issue is resolved.

Tips

  • Use BitLocker with Secure Boot. Secure Boot verifies the bootloader, while BitLocker encrypts the drive. Together they provide strong protection against offline attacks.
  • Set a UEFI password. A firmware password prevents unauthorized users from disabling Secure Boot or changing boot order.
  • Keep your TPM (Trusted Platform Module) enabled. TPM works with Secure Boot and is required for Windows 11. Check that it’s enabled in UEFI.
  • Know your manufacturer’s key. If you build your own PC, you may need to install the Microsoft UEFI CA key to enable Secure Boot. Most pre-built PCs have this pre-installed.
  • Check Secure Boot status after major updates. Occasionally, firmware updates may reset UEFI settings to defaults, disabling Secure Boot.

Troubleshooting

  • Secure Boot option is grayed out in UEFI. This usually means the firmware is in legacy/CSM mode. Switch the boot mode to UEFI (not legacy) in the UEFI settings, then try again. Note that changing boot mode may prevent your current OS from booting if it was installed in legacy mode.
  • After enabling Secure Boot, Windows fails to boot. This can happen if your system has a non-Windows bootloader or a custom boot configuration. Boot into Windows Recovery Environment, go to Troubleshoot > Advanced options > Startup Repair, and run it. If that fails, you may need to reset the Secure Boot keys to factory defaults (in UEFI, look for Restore Factory Keys or Reset Secure Boot Keys).
  • Secure Boot state shows “Off” even after enabling it. Ensure you saved changes and exited UEFI properly. Also, some motherboards have two separate settings: one for the feature and one for the mode (Standard/Custom). Make sure both are set correctly.
  • System Information shows “Unsupported” but your PC is relatively new. This means the firmware is in legacy BIOS mode. Convert to UEFI mode using the MBR2GPT tool (Windows 10/11) before enabling Secure Boot. This process is technical; back up your data first.
  • Cannot find Secure Boot option in UEFI. Search your manufacturer’s online manual for the exact location. Some laptops hide the option until you disable Fast Boot or set a supervisor password.

Frequently Asked Questions

Does Secure Boot slow down my PC?

No. Secure Boot adds a negligible amount of startup time (typically less than a second) because it only checks signatures during boot.

Can I install Linux with Secure Boot on?

Yes. Most major Linux distributions (Ubuntu, Fedora, etc.) are signed and work with Secure Boot. Some niche distributions may not be signed; you can disable Secure Boot for those, but re-enable it afterward.

Is Secure Boot the same as UEFI?

No. UEFI is the firmware interface that replaces BIOS. Secure Boot is a feature that runs within UEFI. You need UEFI to have Secure Boot, but having UEFI doesn’t mean Secure Boot is enabled.

What if my PC doesn’t support Secure Boot?

If your PC is from before ~2012, it likely uses legacy BIOS. Secure Boot is not available. Consider upgrading your hardware, as legacy BIOS is more vulnerable to bootkits.

Can I check Secure Boot status without booting Windows?

Yes, you can check in the UEFI settings. Look for a Secure Boot status indicator, usually on the main or boot tab. It may say “Enabled” or “Active”.

Does Secure Boot protect against ransomware?

No, Secure Boot only protects the boot process. Once Windows is running, you need antivirus and other security measures to protect against ransomware and other malware.

Related

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →