Secure Boot State Unsupported? How to Fix It

Seeing Secure Boot State: Unsupported in Windows 11 does not always mean your PC is too old for Secure Boot.

On many systems, Windows shows Unsupported because the machine is still booting through Legacy BIOS or CSM, even though the motherboard itself supports UEFI and Secure Boot. On other PCs, the firmware genuinely does not provide Secure Boot, so no Windows setting can turn it on.

The important part is working out which situation you have before changing anything in BIOS.

Start With the One Check That Changes Everything

Press Windows + R, type:

msinfo32

and press Enter.

In System Summary, look at these two lines:

• BIOS Mode
• Secure Boot State

You will usually see one of these combinations:

BIOS Mode	Secure Boot State	What it points to
Legacy	Unsupported	Windows is not booting through UEFI
UEFI	Off	Secure Boot is supported but not active
UEFI	On	Secure Boot is already working
UEFI	Unsupported	Firmware support or configuration needs closer checking

That table matters because Secure Boot State: Unsupported is not the same problem as Secure Boot State: Off.

If Windows says UEFI + Off, use the Secure Boot activation path instead. If it says Legacy + Unsupported, do not begin by toggling Secure Boot in BIOS because Windows may not boot after an incorrect firmware-mode change.

What “Secure Boot State: Unsupported” Actually Means

Secure Boot is part of the UEFI firmware environment. Windows can only use it when the system is booting through a compatible UEFI path and the firmware exposes Secure Boot correctly.

Microsoft’s Confirm-SecureBootUEFI command makes this distinction clear.

Open Terminal (Admin) and run:

Confirm-SecureBootUEFI

Possible results are:

True

Secure Boot is active.

False

The PC supports Secure Boot, but it is currently disabled.

Cmdlet not supported on this platform

Windows cannot use the Secure Boot interface in the current environment. Microsoft says this can happen when the PC does not support Secure Boot or when Windows is running as a BIOS/non-UEFI system.

That is why the next question is not “How do I enable Secure Boot?”

It is:

“Is this PC actually booting in UEFI mode?”

If BIOS Mode Says Legacy

This is the most common configuration behind Secure Boot State: Unsupported on an otherwise capable PC.

Do not immediately enter BIOS and change Legacy/CSM to UEFI.

Windows was installed to boot in its current firmware mode. If the system disk is still formatted as MBR and you simply switch the firmware to UEFI, Windows may stop booting.

First check the partition style of the Windows disk.

Check whether the Windows disk is MBR or GPT

Right-click Start and open Terminal (Admin).

Run:

Get-Disk | Select-Object Number, FriendlyName, PartitionStyle, IsBoot, IsSystem

Find the disk that contains your Windows installation.

Look at PartitionStyle.

You will see either:

GPT

or:

MBR

If the disk is already GPT

A GPT system disk is compatible with UEFI booting, so the next thing to investigate is the firmware boot configuration.

Restart into BIOS/UEFI and look for settings named:

• Boot Mode
• UEFI/Legacy Boot
• CSM
• Compatibility Support Module
• Legacy Support

The goal is normally to boot Windows using UEFI and disable Legacy/CSM compatibility where your hardware supports it.

Do not change unrelated storage settings such as AHCI, RAID, VMD, or SATA mode while doing this.

After Windows starts again, run:

msinfo32

and check whether BIOS Mode now says UEFI.

If it does, Secure Boot may now appear as Off rather than Unsupported. That is progress. It means Windows can see Secure Boot and you can then enable it in firmware.

If the Windows Disk Is MBR

An MBR Windows installation needs more care.

Microsoft provides a built-in tool called MBR2GPT that can convert a supported Windows system disk from MBR to GPT without deleting the existing data.

Before using it, confirm that your PC actually supports UEFI. Check the motherboard or PC manufacturer’s documentation first.

Then open Command Prompt as administrator and validate the disk:

mbr2gpt /validate /allowFullOS

If validation completes successfully, Windows considers the disk layout suitable for conversion.

The conversion command is:

mbr2gpt /convert /allowFullOS

Do not run the conversion casually.

Back up important files first and make sure you have your BitLocker or Device Encryption recovery key if encryption is enabled.

Microsoft also states that after MBR2GPT converts the disk, the firmware must be changed to boot in UEFI mode.

You can read Microsoft’s MBR2GPT documentation before making the change.

Once Windows is booting successfully in UEFI mode, check msinfo32 again.

The expected result should move from:

BIOS Mode: Legacy
Secure Boot State: Unsupported

to something closer to:

BIOS Mode: UEFI
Secure Boot State: Off

or:

BIOS Mode: UEFI
Secure Boot State: On

At that point, Windows is finally using the firmware mode that Secure Boot requires.

If BIOS Mode Already Says UEFI but Secure Boot Still Says Unsupported

This is the more interesting case because Windows is already booting through UEFI.

Do not assume the motherboard supports Secure Boot just because it supports UEFI. Secure Boot is a UEFI feature, but older firmware implementations can still lack it or expose it incorrectly.

Restart into firmware setup and look for a Secure Boot section.

Depending on the manufacturer, it may appear under:

• Security
• Boot
• Authentication
• Windows OS Configuration
• Trusted Computing

If there is no Secure Boot option anywhere, check the manual or official support page for your exact motherboard or PC model.

My guide to checking the BIOS version in Windows 11 can help you identify the currently installed firmware before comparing it with the manufacturer’s support page.

Check whether CSM is still enabled

Some systems can report UEFI while still keeping compatibility features enabled.

Look for:

CSM, Legacy Support, or Compatibility Support Module.

If the PC is already confirmed to boot from a GPT system disk in UEFI mode, disabling CSM may allow the Secure Boot controls to appear or become usable.

Save the change, restart Windows, and check msinfo32 again.

Do not make this change if you still depend on older hardware, expansion cards, or boot devices that require Legacy compatibility.

Secure Boot Option Missing in BIOS

A missing Secure Boot setting usually falls into one of three groups.

1. The firmware truly does not support Secure Boot

Some older motherboards have UEFI firmware but predate practical Secure Boot support.

If the manufacturer documentation does not list Secure Boot and there is no relevant firmware update, Windows cannot add the feature on its own.

2. Secure Boot is hidden until another setting changes

Some firmware hides Secure Boot until:

• CSM is disabled
• UEFI-only mode is selected
• an OS type such as Windows UEFI Mode is selected
• a supervisor/administrator BIOS password is configured
• default Secure Boot keys are installed

These requirements vary by vendor, so use the documentation for your exact model rather than copying settings from a different motherboard.

3. The firmware is outdated

A BIOS/UEFI update can sometimes add or repair Secure Boot support, but I would not flash the BIOS simply because Windows says Unsupported.

First confirm that the manufacturer actually lists a newer firmware version with relevant boot, UEFI, or security changes.

Updating firmware without a reason introduces unnecessary risk.

If Secure Boot Changes From Unsupported to Off

That is usually a good sign.

It means Windows can now see the Secure Boot capability, but the feature is not yet active.

At this stage, enter BIOS/UEFI and enable Secure Boot.

You may also need to:

• select Standard Secure Boot mode;
• restore or install the manufacturer’s default Secure Boot keys;
• disable CSM;
• make sure Windows Boot Manager is the active UEFI boot entry.

After saving the changes, return to Windows and check:

msinfo32

The target is:

BIOS Mode: UEFI
Secure Boot State: On

Then run:

Confirm-SecureBootUEFI

and confirm that it returns:

True

If Secure Boot is enabled in firmware but Windows still reports Off, that is a different fault from Unsupported and should be treated separately rather than repeating the Legacy-to-UEFI process.

What If You Need Secure Boot for Windows 11?

Microsoft requires Windows 11-compatible hardware to be Secure Boot capable.

If your PC is showing Secure Boot State: Unsupported because Windows is booting in Legacy mode, converting the boot configuration to UEFI may expose Secure Boot if the hardware supports it.

If the motherboard genuinely has no Secure Boot capability, however, changing Windows settings will not create it.

That is why I would verify the hardware model before spending time modifying partitions or firmware.

Microsoft’s current Windows 11 Secure Boot guidance also notes that firmware configured for Legacy/CSM can make Secure Boot appear unavailable and recommends switching supported systems to UEFI.

What If a Game Says Secure Boot Is Unsupported?

Games with kernel-level anti-cheat systems can expose this problem before Windows itself causes any obvious trouble.

VALORANT is a common example.

Do not begin by reinstalling the game.

First verify the Windows state:

BIOS Mode: UEFI
Secure Boot State: On

and:

Confirm-SecureBootUEFI

should return:

True

If Windows still reports Secure Boot as Unsupported, the game cannot solve the underlying firmware problem.

For Vanguard-specific errors after Secure Boot is available, use my VALORANT Secure Boot troubleshooting guide.

When “Unsupported” Is the Correct Answer

Not every PC can be converted into a Secure Boot system.

I would stop trying to force the feature when all of these are true:

• Windows is already booting in UEFI mode;
• the manufacturer’s documentation does not list Secure Boot support;
• there is no Secure Boot option in firmware;
• no firmware update adds the capability;
• Confirm-SecureBootUEFI continues to report that the platform is unsupported.

At that point, Unsupported is describing a hardware or firmware limitation rather than a broken Windows setting.

That distinction is important because random Registry edits, third-party utilities, reinstalling Windows, or changing TPM settings cannot add Secure Boot to firmware that does not implement it.

The safest troubleshooting path is therefore simple: check BIOS Mode first, check the system disk second, then investigate the firmware. Once Windows is actually booting through a Secure Boot-capable UEFI configuration, the status will normally change from Unsupported to either Off or On, and you can deal with the remaining Secure Boot setting from there.