How To Enable Secure Boot On Windows

To enable Secure Boot on Windows, open your PC’s UEFI firmware settings, find Secure Boot under the Boot or Security menu, enable it, and save your changes. First check that Windows uses UEFI mode and that you can access your BitLocker recovery key if encryption.

Check whether Secure Boot is already enabled

Secure Boot is a UEFI firmware feature that checks boot software against trusted signatures before allowing it to load. It helps block unauthorised bootloaders and some malware that targets startup. It works alongside antivirus software and Windows security updates.

Before changing firmware settings, check your current configuration:

1. Press Windows + R to open Run.
2. Type msinfo32 and press Enter to open System Information.
3. Select System Summary and find BIOS Mode and Secure Boot State.

Use those values to decide what to do next:

• BIOS Mode: UEFI; Secure Boot State: On. Secure Boot is already active. No firmware change is needed.
• BIOS Mode: UEFI; Secure Boot State: Off. Check the preparations below, then enable the feature in firmware.
• BIOS Mode: Legacy, or Secure Boot State: Unsupported. Check your PC or motherboard documentation before changing anything. The current boot mode or hardware configuration may prevent Secure Boot from being available.

Do not switch a working Legacy installation directly to UEFI just to reveal the setting. Windows may stop booting if its disk layout and boot files are not prepared for UEFI. A Legacy installation may need an MBR-to-GPT conversion or a suitable Windows installation before you can proceed.

Prepare before changing firmware settings

Back up important files, save your work, and keep a laptop connected to power. Find the support instructions for your exact PC model or, for a custom-built computer, its motherboard model. Firmware menu names and required settings vary.

If BitLocker or device encryption is active, make sure you can retrieve the recovery key from another device or a separate saved copy. Boot configuration changes can trigger a recovery prompt. On a work or school computer, ask your IT administrator to handle the change.

Where required by your device’s instructions, temporarily suspend BitLocker protection before making boot or firmware changes, then resume it afterwards. Microsoft explains how to suspend and resume BitLocker protection. Suspending protection does not decrypt the drive.

If you need help finding the Control Panel category used for BitLocker settings, see where to find System and Security in Windows 10.

For a dual-boot PC, check that the other operating system’s bootloader supports Secure Boot. Also check any bootable recovery USB you rely on. Older or unsigned boot tools may be blocked once the feature is enabled.

Open UEFI firmware settings from Windows

You can usually enter firmware settings through Advanced startup, which avoids having to time a key press as the computer starts. Microsoft’s Secure Boot guidance describes this route.

1. Open Settings. In Windows 11, select System, then Recovery. In Windows 10, select Update & Security, then Recovery.
2. Under Advanced startup, select Restart now. Save any remaining work before confirming the restart.
3. On the recovery screen, select Troubleshoot, then Advanced options.
4. Select UEFI Firmware Settings, then Restart.

If UEFI Firmware Settings is missing, use your manufacturer’s startup method. Common setup keys include F2, Delete, Esc and F10, but the correct key depends on the model. Check the manual rather than guessing. A missing recovery-menu option alone does not establish whether the hardware supports Secure Boot.

Enable Secure Boot in the firmware menu

Once the firmware interface opens, follow the model-specific instructions. Microsoft’s manufacturer guidance directory can help you find the appropriate support page.

1. Find the Boot, Security or Authentication menu, or the Secure Boot page identified in your manual.
2. Check that the system is configured for UEFI boot. If you discover Legacy or Compatibility Support Module (CSM) settings, pause and confirm that the Windows installation is ready for UEFI before changing them.
3. Set Secure Boot to Enabled. If the manufacturer specifies a Standard mode or Windows UEFI mode, follow that instruction.
4. Use Save Changes and Exit, or the equivalent command shown on screen, and allow the PC to restart.

A simple enablement task should not require manually deleting or replacing Secure Boot keys. Some systems need their default keys enrolled, but use the manufacturer’s procedure for your firmware version. Avoid Custom key management unless you have a specific configuration to maintain.

Verify that Windows reports Secure Boot as active

After Windows starts, open System Information again using Windows + R and msinfo32. Check that BIOS Mode reads UEFI and Secure Boot State reads On. Successfully reaching the desktop does not, by itself, confirm that the feature is enabled.

If you suspended BitLocker, resume protection and confirm its status. Keep Windows and manufacturer firmware updates current so that startup protection continues to receive relevant fixes.

The Windows Security app provides access to other protection settings. If you need help locating those controls on a Lenovo laptop, see our guide to Windows Security controls on a Lenovo ThinkPad. Secure Boot configuration itself takes place in UEFI firmware.

Resolve missing options and startup problems

Secure Boot is missing, greyed out or still Off

Check the model’s documentation for prerequisites, including UEFI mode, CSM restrictions and default key enrolment. An option labelled Enabled may not mean protection is active if required keys are missing. If the instructions do not match your menus, check for a manufacturer firmware update and follow its installation directions.

Avoid resetting all firmware settings as a first troubleshooting step. That can alter storage and boot settings needed by your existing Windows installation.

Windows or another operating system will not start

Re-enter firmware settings and reverse the change you just made to recover the previous boot configuration. If you see a BitLocker recovery screen, use the matching recovery key. For a signature or security-policy error, check the affected bootloader or recovery media with its supplier before trying again.

For related protection tasks after setup, browse our Windows security guides.

Start by opening msinfo32 and recording BIOS Mode and Secure Boot State before your next restart.