Secure Boot can be enabled in BIOS but not active in Windows 11, which is confusing because the firmware switch appears to be set correctly. In most cases, the problem is not the switch itself. Windows is either booting through the wrong firmware path, Secure Boot keys are not enrolled, or the PC is still in a setup state where Secure Boot cannot enforce trusted boot files.
The safest way to fix this is to check what Windows actually sees before changing more BIOS settings.
Read These Two Lines Before Changing Anything
Press Windows + R, type:
msinfo32and press Enter.
In System Summary, find:
- BIOS Mode
- Secure Boot State
Your target is:
BIOS Mode: UEFI
Secure Boot State: OnWhat you see determines what to do next.
| Windows reports | What it usually means | Where to focus |
|---|---|---|
| BIOS Mode: UEFI, Secure Boot State: Off | Windows is using UEFI, but Secure Boot is not being enforced | Secure Boot keys, Setup Mode, CSM, firmware settings |
| BIOS Mode: Legacy | Windows did not boot through UEFI | Disk partition style and UEFI conversion |
| Secure Boot State: Unsupported | Windows cannot use Secure Boot in the current configuration | Legacy/CSM mode, firmware support, boot configuration |
| BIOS Mode: UEFI, Secure Boot State: On | Secure Boot is already active | The app or game reporting the problem |
If Windows already says Secure Boot State: On, do not keep changing BIOS settings just because a game or utility says otherwise. Skip to the section on applications not detecting Secure Boot.
Why BIOS Can Say Enabled While Windows Says Off
Secure Boot is more than an Enable/Disable toggle.
For Secure Boot to actually enforce trusted boot software, the machine must be booting in UEFI mode and the firmware must have the required Secure Boot trust databases and Platform Key enrolled.
One particularly important state is Setup Mode.
When the Platform Key is not enrolled, UEFI can remain in Setup Mode. Microsoft documents that enrolling the Platform Key moves the firmware from Setup Mode into User Mode. A normal Secure Boot configuration therefore needs more than an enabled-looking switch.
This explains a common situation:
Secure Boot: Enabled
Platform Mode: Setupor:
Secure Boot: Enabled
Secure Boot State in Windows: OffThe firmware menu says the feature is enabled, but the trust chain is not yet active.
If BIOS Mode Is UEFI but Secure Boot State Is Off
This is the most relevant scenario for this keyword because Windows is already using UEFI.
Restart into your BIOS or UEFI settings and locate the Secure Boot page. Depending on the manufacturer, it may be under Boot, Security, Authentication, or a similar section.
Do not change unrelated settings such as AHCI, RAID, VMD, CPU voltage, or memory profiles.
Check Whether CSM or Legacy Support Is Still Enabled
Look for settings named:
- CSM
- Compatibility Support Module
- Legacy Boot
- Legacy Support
- UEFI/Legacy Boot
On a Windows installation that is already confirmed as BIOS Mode: UEFI, disable CSM or Legacy compatibility if your firmware requires that before Secure Boot can become active.
Some motherboards will not fully enforce Secure Boot while CSM remains enabled.
Save the change, restart Windows, run msinfo32 again, and check the Secure Boot State.
Do not assume this step is safe when msinfo32 says BIOS Mode: Legacy. That is a different case covered later in this guide.
Check Platform Mode and Secure Boot Keys
If Windows already boots in UEFI but Secure Boot remains Off, I would check the key state next.
Return to the Secure Boot section of your firmware.
You may see wording such as:
Platform Mode: Setupor:
System Mode: SetupYou may also find a Key Management section.
The exact wording differs across ASUS, MSI, Gigabyte, ASRock, Dell, HP, Lenovo, Acer, and other manufacturers.
Look for an option that restores or enrolls the manufacturer’s default Secure Boot keys. Typical names include:
- Install Default Secure Boot Keys
- Restore Factory Keys
- Enroll All Factory Default Keys
- Restore Secure Boot to Factory Defaults
- Install Factory Default Keys
Use the option that restores the default/factory Secure Boot keys for your hardware, then save the firmware settings and restart.
Do not choose an option named Clear Secure Boot Keys, Delete All Secure Boot Variables, or similar unless you have a specific reason and understand the consequences. Clearing the Platform Key can deliberately place the firmware back into Setup Mode, which is the opposite of what you are trying to achieve.
After Windows starts, run:
msinfo32again.
You want:
Secure Boot State: OnThis is one of the most important checks in the entire guide. There is no benefit in continuing through unrelated Windows fixes once System Information confirms that Secure Boot is active.
Standard Mode vs Custom Mode
Some firmware exposes a Secure Boot Mode setting with choices such as:
Standard
CustomCustom mode is not inherently broken. It exists so Secure Boot keys can be managed manually.
The problem is that a PC can end up with missing or altered keys after previous firmware changes, Linux installation work, custom Secure Boot configuration, or manual key management.
For an ordinary Windows 11 PC where you have never intentionally managed your own Secure Boot keys, Standard mode together with the manufacturer’s default keys is normally the configuration I would investigate first.
Do not switch modes blindly on a machine that intentionally uses custom Secure Boot keys. If the PC belongs to an organization or uses a deliberately customized boot environment, ask the administrator before replacing those keys.
Verify Secure Boot From PowerShell
System Information is enough for most readers, but Windows also includes a direct Secure Boot check.
Right-click Start, open Terminal (Admin), and run:
Confirm-SecureBootUEFIA normal active configuration returns:
TrueIf Secure Boot is supported but not active, it returns:
FalseIf the computer is not running in a compatible UEFI environment, PowerShell can report:
Cmdlet not supported on this platformMicrosoft documents Confirm-SecureBootUEFI specifically for checking whether UEFI Secure Boot is enabled.
I would use this command as confirmation, not as a method for forcing Secure Boot on. The firmware controls the Secure Boot state.
If BIOS Mode Says Legacy, Stop Before Disabling CSM
This is the point where many Secure Boot tutorials become risky.
If msinfo32 says:
BIOS Mode: Legacyyou cannot fix the problem by simply turning on Secure Boot.
Secure Boot is a UEFI feature. A Windows installation currently booting in Legacy BIOS mode must first be capable of booting through UEFI.
Before changing the firmware boot mode, check whether the Windows system disk uses MBR or GPT.
Open Terminal (Admin) and run:
Get-Disk | Select-Object Number, FriendlyName, PartitionStyle, IsBoot, IsSystemFind the Windows system disk.
If its partition style is GPT, the installation may already be suitable for UEFI and the remaining problem may be the firmware boot configuration.
If the Windows system disk is MBR, do not switch the firmware straight from Legacy/CSM to UEFI. Windows may stop booting.
Microsoft provides MBR2GPT.exe for converting a supported Windows system disk from MBR to GPT without deleting the data on the disk.
You can first validate the disk from an elevated Command Prompt:
mbr2gpt /validate /allowFullOSOnly after the disk passes validation should you consider conversion:
mbr2gpt /convert /allowFullOSBack up important data first and make sure you have your BitLocker or Device Encryption recovery key if encryption is enabled.
After a successful MBR-to-GPT conversion, the firmware must be changed to boot Windows in UEFI mode. Microsoft documents this requirement in its MBR2GPT guidance.
If you are not comfortable changing the disk and firmware boot mode, stop here rather than experimenting. This is no longer a simple Secure Boot toggle.
Save Your BitLocker Recovery Key Before Firmware Changes
Secure Boot, TPM, and boot configuration changes can affect the measurements BitLocker uses to verify that the startup environment has not been altered.
Before making significant firmware changes, make sure you can recover the encrypted drive.
If BitLocker or Device Encryption is enabled, save the recovery key somewhere you can access without the affected PC.
For more disruptive firmware or boot changes, temporarily suspending BitLocker may also be appropriate. Microsoft specifically warns that some UEFI, TPM, and Secure Boot changes can trigger BitLocker recovery.
Do not discover that you need the recovery key only after the machine is already asking for it.
What If the Secure Boot Option Is Greyed Out?
A greyed-out Secure Boot control does not have one universal cause.
Check the surrounding firmware settings before assuming the motherboard is faulty.
Common things to investigate are:
- CSM or Legacy mode is still enabled.
- The firmware requires Windows UEFI Mode or a similar OS-type setting.
- Secure Boot keys have not been enrolled.
- The firmware is currently in Setup Mode.
- A laptop requires an administrator or supervisor BIOS password before security settings can be changed.
- The motherboard BIOS is old enough to have a firmware-specific Secure Boot problem.
Change only one relevant setting at a time.
If the option remains unavailable, identify the exact PC or motherboard model and check the manufacturer’s instructions. The wording and prerequisites differ too much between vendors for one universal BIOS path to be reliable.
Before considering a firmware update, you can use my guide to checking the BIOS version in Windows 11 and compare it with the version offered for your exact hardware.
Do not update the BIOS solely because Secure Boot says Off. First exhaust the configuration checks above.
Secure Boot Is On in Windows but a Game Still Says It Is Disabled
Once Windows reports:
BIOS Mode: UEFI
Secure Boot State: Onand:
Confirm-SecureBootUEFIreturns:
Truethe firmware problem is largely resolved.
At that point, focus on the application that still claims Secure Boot is disabled.
Restart Windows fully rather than using sleep or hibernation. Then update or restart the relevant anti-cheat service or game launcher.
For Riot Vanguard specifically, use my VALORANT Secure Boot error guide. That article covers TPM 2.0, VAN 9003, and Vanguard-specific checks without repeating all of the firmware diagnosis here.
Other games may have their own anti-cheat requirements, so read the exact error instead of assuming every Secure Boot warning has the same cause.
What About the 2026 Secure Boot Certificate Changes?
Microsoft is replacing older Secure Boot certificates that began reaching expiration in 2026.
That is important, but it is not the same problem as Windows reporting:
Secure Boot State: OffIf msinfo32 says Secure Boot State: On, Secure Boot is active even if Windows Security separately reports that newer Secure Boot certificates still need to be applied.
Do not clear your Secure Boot keys simply because you read about the 2026 certificate transition.
Microsoft’s current Windows 11 Secure Boot guidance explains that supported Windows systems are receiving the newer certificate updates through servicing.
Treat a certificate-update warning as its own issue rather than turning a working Secure Boot configuration into a broken one.
The Result That Actually Matters
Do not judge Secure Boot only by what the BIOS toggle says.
After every meaningful firmware change, come back to Windows and verify:
BIOS Mode: UEFI
Secure Boot State: OnThen, if you want a second check:
Confirm-SecureBootUEFIshould return:
TrueIf the firmware says Enabled but Windows still says Off, concentrate on CSM, Platform/Setup Mode, and the default Secure Boot keys. If Windows says Legacy, deal with the UEFI and disk configuration before attempting to enable Secure Boot.
That approach is safer than repeatedly toggling the same BIOS option, and it tells you exactly which part of the Secure Boot chain is preventing Windows from treating the feature as active.
