How To Enable Secure Boot In ASUS BIOS | Step-By-Step Setup

Enabling Secure Boot on an ASUS motherboard requires setting OS Type to Windows UEFI mode, disabling CSM, and confirming TPM 2.0 is active — all inside the BIOS Advanced Mode.

Missing a single step when you learn how to enable Secure Boot in ASUS BIOS can leave the option grayed out. The fix is three changes in the right order, and this guide walks through each one with the exact menu names and button labels you will see on screen. Skip the guesswork and get Secure Boot enabled on the first try.

What Do You Need Before Enabling Secure Boot?

Secure Boot only works on systems running in UEFI mode with TPM 2.0. Before opening the BIOS, confirm your PC meets both requirements or the option stays locked.

Check Your BIOS Mode

Press Win + R, type msinfo32, and hit Enter. Look for BIOS Mode — it must show UEFI. If it says Legacy, Secure Boot is not available until you switch to UEFI mode, which requires reinstalling Windows.

Confirm TPM 2.0

In the same System Information window, check for TPM 2.0 listed under Device Encryption Support or a similar heading. If missing, enable fTPM in the BIOS at Advanced → Trusted Computing → set TPM Device Selection to Firmware TPM.

How To Enable Secure Boot In ASUS BIOS: Step-By-Step

These steps apply to every ASUS motherboard — ROG, TUF, Prime, and ProArt — as well as ASUS laptops like the Vivobook and TUF series. Enter the BIOS first, then make the changes in order.

1. Enter BIOS — Restart the PC and press Delete repeatedly during boot. On some ASUS laptops, use F2 instead.
2. Switch to Advanced Mode — Press F7 if the BIOS opens in Easy Mode. Advanced Mode reveals all settings.
3. Disable CSM — Go to Boot → find CSM (Compatibility Support Module) → set it to Disabled. CSM must be off for Secure Boot to work.
4. Open Secure Boot Menu — Still under Boot, select Secure Boot.
5. Set OS Type — Change OS Type from Other OS to Windows UEFI mode. This is the single switch that turns Secure Boot on.
6. Install Default Keys (if needed) — If Secure Boot State shows Setup, go to Key Management → select Install Default Secure Boot Keys → confirm Yes. The state should change to User.
7. Set Secure Boot Mode to Standard — Confirm Secure Boot Mode is set to Standard, not Custom.
8. Save and Exit — Press F10 → select Save Changes & Reset.

The PC reboots with Secure Boot active. If it hangs or fails to boot, see the troubleshooting section below.

Secure Boot Settings Reference

Use this table to verify every setting is in its correct state before saving and exiting the BIOS.

How Do You Know Secure Boot Is Actually On?

Press Win + R, type msinfo32, and press Enter. In the System Summary list, find Secure Boot State. It must show On. A second path is Windows Security → Device Security → check the Security Processor section for Secure Boot status.

If it still shows Off, review the common mistakes below — ASUS’s official Secure Boot guide confirms the same procedure.

Common Mistakes That Cause Secure Boot To Stay Off

Most failed attempts trace back to one of these five errors. Each is easy to miss and easy to fix.

• OS Type still set to Other OS — This is the number one cause. Other OS disables Secure Boot by design. Switch it to Windows UEFI mode.
• CSM still enabled — CSM and Secure Boot cannot coexist. Disable CSM under Boot and try again.
• Secure Boot keys missing — If the state says Setup instead of User, no keys are installed. Use Install Default Secure Boot Keys in the Key Management menu.
• TPM 2.0 not active — Some ASUS boards ship with fTPM disabled. Enable it at Advanced → Trusted Computing → set TPM Device Selection to Firmware TPM.
• Windows installed in Legacy mode — Systems originally set up with CSM or Legacy BIOS must be converted to UEFI or Windows reinstalled. Check msinfo32 first.

What To Do If Your PC Won’t Boot After Enabling Secure Boot

A boot failure after enabling Secure Boot usually points to a legacy driver or device that isn’t UEFI-compatible. The fix is straightforward.

Restart the PC and press Delete to re-enter the BIOS. Go to Boot → Secure Boot and temporarily set OS Type back to Other OS to disable Secure Boot. Boot into Windows, then update all drivers — especially storage and network controllers — to UEFI-compatible versions from the manufacturer’s site. Once updated, repeat the enabling steps above.

For dual-boot systems running Linux, switching OS Type to Windows UEFI mode will block the Linux bootloader. Linux users should leave OS Type on Other OS and use a signed bootloader such as Shim instead.

Troubleshooting Quick Reference

Final Checklist: Secure Boot Is Active

Run through these four confirmations to close the task completely:

1. BIOS shows Secure Boot State as User — confirms keys are installed and active.
2. Windows msinfo32 reports Secure Boot State: On — the OS confirms the hardware is protected.
3. TPM 2.0 is visible in Device Security — the full security chain is in place.
4. All devices boot normally — no errors, no Safe Mode loops.

Once these four checks pass, Secure Boot is fully enabled and your ASUS system is running with Microsoft’s recommended firmware security in place.