Summary
Secure Boot is a firmware feature and a system requirement for Windows 11. It ensures your Laptop or PC boots using only trusted software and prevents rootkits from executing during the critical startup phase. This guide covers what Secure Boot does, how to check its current status, and how to enable it from firmware settings.
If you have tried installing Windows 11 recently and the installation is getting stuck, it is most likely due to Secure Boot. It is an additional protection layer given in Windows 11. This tutorial outlines what exactly Secure Boot does, how to check the current status of Secure Boot, and safe methods to enable Secure Boot from PC firmware settings.
What is Secure Boot in Windows 11?
Secure Boot in Windows 11 is a security standard built into UEFI (Unified Extensible Firmware Interface), the modern replacement for BIOS (Basic Input/Output System). When the device powers on, Secure Boot analyzes all software that run at startup. It is a critical security feature designed to protect your system from malware and other software attempting unauthorized access during the boot process.
Secure Boot uses digital signatures to ensure that all the software that boots up are authentic, from a trusted source, and not corrupt. Secure Boot allows for clean and secure execution of software on the startup of your device. It prevents malware attacks. This is critical because malware like rootkits and bootkits can load before Windows and bypass antivirus detection at this stage.
How to Check if Secure Boot is Enabled?
Manufacturers ship Laptops and PCs with Secure Boot settings already turned on. Confirm the current state before changing BIOS/UEFI settings. However, if you still need to check follow the steps below:
- Run Search on Windows Desktop, then type System Information and press Enter.
- In the System Information window, stay on the System Summary in the left pane and look for Secure Boot State on the right.
- If the value is On, no further action is required. If it is Off, continue reading the article to meet further requirements.
On – Means the feature is Enabled.
Off – Means the feature is either Disabled or Not Supported.
What are the Prerequisites?
Check that your device meets the preconditions to turn on Secure Boot:
- UEFI firmware, not Legacy BIOS – Secure Boot only works when your system boots in UEFI mode. If System Information lists your BIOS Mode as Legacy, you’ll need to switch it first to UEFI.
- A GPT-formatted system disk – UEFI uses the GUID Partition Table (GPT) scheme rather than the older MBR (Master Boot Record) layout. If your drive is still MBR, Windows’ built-in MBR2GPT.exe tool can convert it without erasing data, but remember to backup your data beforehand.
- Up-to-date firmware – An outdated UEFI/BIOS version can hide the Secure Boot option entirely or generate compatibility issues. Check whether your Laptop/PC’s motherboard supports the latest firmware before proceeding. For this, refer to the manual given by the PC manufacturer or the better alternative is to google for up-to-date information.
- A recent backup – If you are not aware of handling BIOS/UEFI settings, it’s better to get to a knowledgeable person. Because any change into firmware settings carries risk of a misconfigured boot order or a system that won’t start. So, backup your data, before making changes to UEFI/BIOS settings.
How to Turn On Secure Boot in UEFI/BIOS?
With the prerequisites out of the way, you have two ways to turn on Secure Boot in Windows 11. Either by restarting and repeatedly pressing a key during boot, or by launching the same menu from inside Windows. The second route is more reliable since it avoids timing the key press.
From within Windows –
1. Click the Search button on the Windows TaskBar, type Settings and press Enter.
2. In the Settings window, navigate to System in the left pane.
3. Scroll down to the Recovery option on the right to select it.
- Next, under Advanced startup, select Restart now (save any open work first).
- Thereafter, on the blue screen menu, you will find System Diagnostics options. Navigate through Troubleshoot > Advanced options > UEFI Firmware Settings, then Restart.
Note: If System Information lists your BIOS Mode as Legacy, UEFI Firmware Settings option will not be available
From a cold boot (alternative) –
Restart the PC and soon after the manufacturer’s logo appears, repeatedly press the required key to enter BIOS Setup Utility directly. The commonly known keys are either Del, F2, F10, F12, or Esc; check your PC’s manual if none of those work, since it varies by brand.
Turning the setting on –
- Once inside the firmware utility, switch to Advanced Mode if you’re dropped into a simplified view.
- Navigate to the Boot or Security tab using the arrow keys, since Secure Boot is usually tucked into one of these two sections.
- Locate the Secure Boot entry and set it to Enabled.
- If your system offers a separate Boot Mode or CSM setting, make sure it’s set to UEFI rather than Legacy/CSM.
- Press the Save & Exit key to restart.
A representative UEFI Boot tab with Secure Boot switched to Enabled
After Windows loads back up, rerun System Information option to confirm Secure Boot state by following the given steps in How to Check Secure Boot is Enabled? At that point your PC meets this particular Windows 11 requirement, and you can continue with the upgrade or clean install.
Troubleshooting Common Issues
- Can’t find the Secure Boot option at all – Your firmware may be too old to support it. Check the manufacturer’s site for a UEFI update, since newer firmware sometimes adds the option.
- Windows won’t boot after enabling it – This usually means the drive is still using MBR (Master Boot Record) layout, or Windows was originally installed under Legacy mode. Converting to GPT with MBR2GPT.exe (after backing up) typically resolves it; a clean reinstall is the fallback if conversion isn’t possible.
- An error appears about untrusted or unsigned drivers – Some older or third-party hardware drivers aren’t signed for Secure Boot. Check with the hardware vendor for an updated, signed driver.
- You need to temporarily disable it – Certain older games, dual-boot Linux setups, or specific drivers may require Secure Boot off. Use the same Boot or Security menu to switch it back to Disabled, but re-enable it once the task is done, since leaving it off longer than necessary reduces your protection.
Conclusion
Secure Boot isn’t just a box to tick for a Windows 11 upgrade. It forms a meaningful barrier against malware that attacks at the firmware level that traditional antivirus software fail to detect.
Whether you’re setting up a new PC, upgrading an older one, or just tightening up a home machine, enabling it is a small step that closes a real gap, and one that’s well worth doing before you install Windows 11 rather than scrambling to fix it mid-setup.