Fix Secure Boot Enabled but Not Active in Windows 11

If Windows 11 shows “Secure Boot is enabled but not active,” your PC meets the hardware requirement but the feature isn’t actually running, which can block upgrades or cause compatibility warnings. This guide walks you through the exact steps to make Secure Boot truly active, from checking your current status to adjusting BIOS/UEFI settings and handling common pitfalls.

What You’ll Need

• Access to your PC’s BIOS/UEFI firmware (usually by pressing Del, F2, F10, or Esc during startup).
• Your Windows login credentials (in case you need to verify settings in Windows).
• A few minutes of patience—changes require a restart.

Step-by-Step

1. Check the current Secure Boot status in Windows. Press Win + R, type msinfo32, and press Enter. In the System Information window, look for “Secure Boot State.” If it says “Off” or “Unsupported,” proceed to the next step.
2. Restart and enter your BIOS/UEFI. Click the Start menu, select Power, then hold Shift while clicking Restart. In the blue menu, choose Troubleshoot > Advanced Options > UEFI Firmware Settings, then click Restart. Alternatively, restart and press the BIOS key (often Del or F2) repeatedly during boot.
3. Locate Secure Boot settings. The exact menu varies by motherboard. Look for tabs like “Boot,” “Security,” “Authentication,” or “Startup.” On many systems, it’s under “Boot > Secure Boot” or “Security > Secure Boot.”
4. Enable Secure Boot. If it’s set to Disabled, change it to Enabled. Some systems have a toggle that says “Standard” or “Custom”—choose “Standard.”
5. Set the Secure Boot mode to “Windows UEFI mode.” Some BIOS versions have an option like “OS Mode” or “Secure Boot Mode.” Ensure it’s set to “Windows” or “UEFI” (not “Other OS” or “Legacy”).
6. Disable CSM (Compatibility Support Module). If you see an option for CSM or “Legacy Boot,” disable it. Secure Boot only works in pure UEFI mode, and CSM often forces legacy BIOS behavior.
7. Save changes and exit. Press F10 (or select “Save & Exit”) and confirm. Your PC will restart.
8. Verify Secure Boot is now active. Once Windows loads, run msinfo32 again. The “Secure Boot State” should now read “On.” If it still says “Off,” continue to the troubleshooting section.

Common Mistakes

• Enabling Secure Boot but leaving CSM on. This is the most frequent cause—Secure Boot simply won’t activate if legacy boot is still enabled.
• Setting the wrong OS mode. Some systems have a “Secure Boot Mode” with options like “Standard” and “Custom.” Choosing “Custom” without proper keys can leave Secure Boot inactive.
• Not saving changes before exiting. If you just press the power button or exit without saving, your changes are lost.
• Assuming Secure Boot is the same as TPM. These are separate features. Secure Boot protects the boot process, while TPM (Trusted Platform Module) handles encryption. Both are required for Windows 11, but enabling one doesn’t enable the other.
• Ignoring “Secure Boot State: Unsupported.” This usually means your system is in legacy BIOS mode, not UEFI. You must switch to UEFI mode (often by changing the boot mode in BIOS) before Secure Boot can work.

Tips

• Update your BIOS/UEFI. Manufacturers often release firmware updates that improve Secure Boot compatibility and add missing options. Check your motherboard or PC maker’s support site.
• Reset to factory defaults first. If you’ve changed many settings, loading “Optimized Defaults” in BIOS can clear conflicting configurations. Then re-enable Secure Boot.
• Use the Windows PC Health Check app. After making changes, run it to confirm your system meets all Windows 11 requirements, including Secure Boot.
• Keep your BitLocker recovery key handy. If you use BitLocker, changing Secure Boot settings may trigger recovery mode. Have your recovery key ready before you restart.
• Check the manufacturer’s manual. Laptops and prebuilt PCs often have unusual BIOS layouts—the manual will show you exactly where Secure Boot is.

Troubleshooting

If Secure Boot still shows as not active after following the steps, try these in order:

1. Verify the boot mode is UEFI, not Legacy. In BIOS, look for “Boot Mode” or “UEFI/Legacy Boot” and set it to “UEFI only” (or “UEFI first”). Save and restart.
2. Clear Secure Boot keys. In BIOS, find “Key Management” or “Secure Boot Key Management.” Select “Reset to Setup Mode” or “Restore Factory Keys.” This reinstalls the default Microsoft keys. Save and restart.
3. Disable Fast Boot. Some systems skip initializing Secure Boot properly when Fast Boot is on. Temporarily disable it in BIOS, then re-enable Secure Boot and test.
4. Check for a “Secure Boot Control” toggle. On some ASUS boards, there’s a separate “Secure Boot Control” option that must be enabled in addition to the main Secure Boot setting.
5. Reset the BIOS to defaults. This is a last resort. Load “Optimized Defaults,” then re-enable Secure Boot and CSM off. If it works, you can gradually re-apply your other settings.
6. Test with a clean boot. If Windows shows Secure Boot as off but BIOS says it’s enabled, try a clean boot (disable all startup items) to rule out software interference. If it still shows off, the issue is likely firmware-level.
7. Update the BIOS. If nothing else works, a firmware update may fix a bug where Secure Boot doesn’t activate. Download the latest BIOS from your manufacturer’s site and follow their flashing instructions carefully.

Frequently Asked Questions

Why does Windows say Secure Boot is enabled but not active?

This usually means the BIOS has the setting turned on, but the system is booting in legacy mode or CSM is still enabled. Secure Boot only functions when the PC boots in UEFI mode.

Can I enable Secure Boot without reinstalling Windows?

Yes, in most cases. If your system is already installed in UEFI mode, you can simply enable Secure Boot in BIOS and restart. If your Windows is installed in legacy BIOS mode, you’ll need to convert the disk to UEFI using the MBR2GPT tool, which is more involved.

Will enabling Secure Boot erase my data?

No, enabling Secure Boot does not erase data. However, if you use BitLocker, you may need your recovery key after changing firmware settings.

My BIOS doesn’t have a Secure Boot option. What now?

If your PC is older than 2012 or the BIOS lacks the option, your hardware likely doesn’t support Secure Boot. You may need to update the BIOS or consider a hardware upgrade to meet Windows 11 requirements.

Is Secure Boot the same as TPM?

No. Secure Boot verifies the bootloader’s signature, while TPM (Trusted Platform Module) provides hardware-based security for encryption and attestation. Windows 11 requires both.

What if I have a custom-built PC?

Check your motherboard’s manual for the exact Secure Boot location. Most modern boards from ASUS, MSI, Gigabyte, and ASRock have it under “Boot” or “Security.” If you can’t find it, search for your motherboard model plus “Secure Boot” online.

Related

• Proxmox VM CPU Type: Fixing the kvm64 Default
• Google Pixel Slow Charging: Solved?
• HP Software Framework Not Installed Error Fix