Secure Boot: How to Enable or Disable It

Secure Boot is a security feature found on most modern PCs. It kicks in the moment you power the machine on: only start-up components with a signature recognised by the UEFI firmware are allowed to load, which helps stop certain malware — bootkits and some rootkits in particular — from running before the operating system even starts. It’s also one of Windows 11’s requirements, which is why there are so many questions around turning it on. This guide covers the lot: checking its status, enabling it, unblocking the stubborn cases, and disabling it when there’s good reason to.

What Is Secure Boot?

Secure Boot is a UEFI security feature that checks whether the software components needed to start your PC carry a signature the firmware recognises — blocking anything unapproved from loading, bootkits and rootkits chief among them.

UEFI is the low-level program that runs on your machine before the operating system even loads. It’s the successor to the traditional BIOS — the two terms are often used interchangeably, but UEFI is the modern version, and it’s what makes Secure Boot possible. Secure Boot is enabled, disabled and configured from within this UEFI interface.

How to Check Whether Secure Boot Is On

Before you change anything, the first thing to do is find out whether Secure Boot is already protecting your machine. Here are two methods, from the simplest to the most technical.

The Quickest Method (One Minute)

1. Press Win + R together to open the Run dialog.
2. Type msinfo32 and confirm — the System Information page opens.
3. Find the “Secure Boot State” line.

There are three possible results:

• On: the feature is available and active — your machine is protected.
• Off: the feature is available but inactive (see below for how to turn it on).
• Unsupported: the feature isn’t available as things stand — see the “Secure Boot Unsupported or Won’t Enable” section to understand why.

For Users Comfortable with the Command Line

You can also check the status via PowerShell:

1. Open PowerShell as an administrator (right-click the Start menu → “Terminal (Admin)” or “PowerShell (Admin)”).
2. Enter the following command: Confirm-SecureBootUEFI

Depending on what it returns:

• True: Secure Boot is supported and already on.
• False: the feature is supported but turned off.
• “cmdlet not supported on this platform”: Secure Boot isn’t supported (the machine is in Legacy/CSM mode — see below).

Why Windows 11 Requires Secure Boot

To install Windows 11, Microsoft requires the machine to have Secure Boot-capable UEFI firmware and a TPM 2.0 module. These are two separate requirements: Secure Boot is a function of the UEFI firmware, while TPM 2.0 is a separate hardware module.

Their roles complement each other:

• Secure Boot checks that each software component is trusted before it runs at start-up.
• TPM 2.0 securely stores encryption keys and measures the integrity of the platform.

Worth noting: this requirement applies to desktops and laptops meant for Windows 11, not server-type setups, which follow different rules. In practice, to meet the requirements, Secure Boot needs to be on and the drive set up as GPT (not MBR)， we’ll cover how to check and fix these below.

How to Enable Secure Boot (Windows 11)

Prerequisites

The steps to enable Secure Boot on Windows 11 vary by manufacturer: the access keys and some of the confirmation screens differ.

Before enabling Secure Boot, the key thing is that Windows boots in UEFI mode and that your firmware supports Secure Boot — that’s the real technical requirement. For Windows 11, TPM 2.0 is also required, but that’s a separate requirement from Secure Boot. On top of that, a Windows 11 install in UEFI mode usually uses a drive set up as GPT: if your current install is on MBR and boots in Legacy mode, you’ll generally need to convert it to GPT before switching to UEFI boot (see below).

Let’s first check whether TPM 2.0 is active:

1. Press Win + R to open the Run dialog.

2. Type tpm.msc and click OK (or press Enter).

3. Check the TPM status. If it’s ready to use, move on to checking the drive. If not, you’ll need to check your manufacturer’s guide for more.

Now let’s check how the Windows drive is set up:

1. From the desktop, press Win + X and choose “Disk Management”.

2. Find the drive Windows is on (usually the C drive), right-click it, then choose Properties.

3. Open the “Volumes” tab: the “Partition style” line shows either GUID Partition Table (GPT) — the setup you want for UEFI boot — or Master Boot Record (MBR).

If the drive is on MBR, you’ll need to convert it to GPT before switching to UEFI boot (see the “Secure Boot Unsupported or Won’t Enable” section).

Once you’re in the UEFI, enabling it follows the same logic whatever the manufacturer:

• Restart your machine and get into the UEFI by pressing the key for your brand (see the table below) as soon as it starts up. You often need to press it several times in a row.
• Go to the Security tab or the Boot tab.
• Find the Secure Boot option and switch it to ‘Enabled’.
• Select ‘Save’ then ‘Exit’ (Save & Exit), depending on your machine’s brand.

The computer then restarts with Secure Boot enabled.

For reference, the most common UEFI access keys by brand:

Manufacturer	UEFI access key
GEEKOM	Del or Esc
Asus	F2 or Del
Dell	F2
HP	Esc or F10
Lenovo	F1 or F2
MSI	Del
Acer	F2

If the Secure Boot option is greyed out or missing, it’s usually down to Legacy/CSM mode or a drive on MBR — see the next section.

Secure Boot Unsupported or Won’t Enable: The Causes

If msinfo32 shows ‘Unsupported’ for the Secure Boot State, or the option simply won’t enable, it usually means Windows isn’t booting in UEFI mode, or the firmware doesn’t properly support Secure Boot. The cause almost always comes down to one of the following three things.

Legacy / CSM Mode Is On

The CSM (Compatibility Support Module) runs UEFI in ‘Legacy’ mode — that is, imitating an older BIOS. In this mode, Secure Boot is unavailable by design, so you’ll need to turn CSM off in the UEFI settings. Careful, though: if your system was installed in Legacy mode, switching it to UEFI without preparation will stop the machine from booting — which is exactly why you should check the drive mode first (below).

Drive on MBR Instead of GPT

Booting in UEFI mode (which Secure Boot needs) generally assumes a system drive partitioned as GPT, whereas Legacy mode relies on MBR. If your drive is still on MBR and boots in Legacy, you’ll usually need to convert it to GPT before moving to UEFI boot.

Windows provides the mbr2gpt tool for this, which — when it works as intended — converts the drive without deleting your data. Here’s how:

1. Back up your important data — any work on the system drive carries a risk.
2. Open a Command Prompt as administrator.
3. Check that the drive can be converted: mbr2gpt /validate
4. Run the conversion: mbr2gpt /convert
5. Restart, go into the UEFI, switch the boot mode to UEFI (instead of Legacy), then enable Secure Boot.

⚠️ Important: only run the conversion if mbr2gpt /validate confirms the drive is eligible. If you run the tool from a full Windows session (rather than from Windows PE), you may need the /allowFullOS option: mbr2gpt /validate /allowFullOS. Forcing a conversion on a non-compliant drive can leave the system unable to boot.

Outdated Firmware/BIOS

If Secure Boot is still unavailable after you’ve checked the boot mode (UEFI) and the security settings, start by restoring the default Secure Boot keys in the UEFI (an option often called ‘Restore Default Secure Boot Keys’). If that’s not enough, check whether a firmware update is available for your model: on some older motherboards, Secure Boot only appears after this update. As a last resort, contact your manufacturer’s support.

See also our guide: How to Update the BIOS on Windows 11.

How to Disable Secure Boot

Disabling Secure Boot makes sense in a few specific cases: installing a Linux distribution whose bootloader isn’t signed, setting up an unusual dual boot, or using an older unsigned driver or piece of hardware.

The process mirrors enabling it:

1. Get into the UEFI (see the keys above).
2. Go to the Security tab or the Boot tab.
3. Switch Secure Boot to “Disabled”.
4. Save and exit (Save & Exit).

One trade-off to be aware of: disabling Secure Boot means giving up protection against bootkits and rootkits that run before the operating system. Only do it if you know why you’re doing it, and turn it back on as soon as you can.

If your goal is to install another operating system, consider a dual boot as well, which often lets you keep Secure Boot enabled.

Secure Boot and Linux: Do You Really Need to Disable It?

The short answer: in the vast majority of cases, no — you don’t need to disable Secure Boot to run Linux. The most common distributions work perfectly well with Secure Boot enabled. Disabling it is only necessary in specific situations: an unsigned driver, a custom kernel, or a special boot configuration. Put simply, it isn’t Linux “refusing” Secure Boot — more often it’s a chain of signatures that doesn’t match your particular setup.

Ubuntu and Linux Mint

Both Ubuntu and Linux Mint boot with Secure Boot enabled, no extra setup needed: their bootloader (shim) is signed. An extra step is only needed for certain third-party drivers (DKMS), which require enrolling a MOK key.

Debian

Debian has supported Secure Boot since version 10 and boots normally with the feature enabled. Disabling it is still possible for specific needs.

Fedora

Fedora supports Secure Boot natively and builds it into its boot chain. Only certain third-party modules (unsigned drivers) may need an extra step: enrolling a MOK (Machine Owner Key).

Proxmox

With Proxmox, this is more of a “server/homelab” case than a desktop one: Secure Boot is mainly there to lock down boot integrity on a machine hosting VMs and containers. You can use it, but depending on the bootloader and storage, you sometimes have to go through proxmox-secure-boot-support and a more careful UEFI configuration; it’s useful when you want to harden a host, not essential for a small lab.

Disabling Secure Boot mainly makes sense if you’re installing an unsigned DKMS or proprietary driver, compiling your own kernel, or your machine is blocking a legitimate bootloader because of temperamental firmware. Put simply: it isn’t Linux “refusing” Secure Boot — it’s often the chain of signatures not matching your setup.

Accessing Secure Boot on a GEEKOM Mini PC

On GEEKOM mini PCs, you get into the UEFI by pressing the Del (or Esc) key several times as soon as the machine starts, right after you power it on. The F7 key, meanwhile, opens the boot menu (for choosing the boot device), don’t confuse it with getting into the BIOS. Once you’re in the UEFI, the Secure Boot option is under the Security or Boot tab.

FAQs