How To Enable Safe Boot | Activating Secure Boot in UEFI

Enabling Safe Boot on a modern PC actually means turning on Secure Boot in the UEFI firmware, a critical security layer that blocks rootkits and unauthorized code during startup.

If you’re searching for how to enable Safe Boot on your Windows PC, you almost certainly need to activate Secure Boot in your system’s UEFI firmware settings. “Safe Boot” is a common misnomer for the security feature Secure Boot, though Safe Boot itself is a real thing—a Windows diagnostic startup mode. The steps below cover turning on the UEFI security feature that protects your machine from low-level infections before the operating system even loads, whether you are on Windows 10 or 11.

What Is The Difference Between Safe Boot And Secure Boot?

Safe Boot (often called Safe Mode) is a minimal Windows startup environment used for troubleshooting driver conflicts and malware removal. You access it by interrupting the boot process or using the Recovery menu. Secure Boot, on the other hand, is a UEFI firmware standard that verifies every piece of code running during the boot sequence is signed by a trusted authority. It is a required feature for Windows 11 and for many modern anti-cheat systems.

The gate that trips most people up: Secure Boot only works on machines using UEFI firmware with a GPT-partitioned drive. Older Legacy BIOS systems simply cannot run it. If your BIOS mode is set to Legacy, the Secure Boot option will be entirely absent or grayed out.

Prerequisites For Enabling Secure Boot

Before you enter the firmware menus, confirm your system supports the feature. The table below outlines exactly what you need. Skipping these checks is the single most common reason the option stays hidden.

Check Your Current Secure Boot State

Windows can tell you immediately whether Secure Boot is on, off, or unsupported. Press Win + R, type msinfo32, and hit Enter. Look for two lines in the System Summary pane: BIOS Mode and Secure Boot State. If BIOS Mode says UEFI and Secure Boot State says Off, you are in the clear to enable it. If it says Unsupported, your drive may be in Legacy mode or the partition is MBR.

A quicker check: open PowerShell as an administrator and run Confirm-SecureBootUEFI. A return of True means it is active, False means it is supported but disabled, and an error message means the system does not support Secure Boot at the firmware level.

How To Enable Secure Boot In The UEFI Firmware

Once you have confirmed the prerequisites are met, follow this exact sequence. The most reliable entry method is through Windows itself, which avoids guessing the right F-key during boot.

Step 1: Access the UEFI Firmware Settings
Go to Settings > System > Recovery. Under Advanced startup, click Restart now. When the blue menu appears, select Troubleshoot > Advanced options > UEFI Firmware Settings > Restart. This boots you straight into the UEFI menu regardless of your motherboard brand.

Step 2: Disable CSM (Compatibility Support Module)
Inside the UEFI interface, navigate to the Boot tab. Locate CSM or Compatibility Support Module and set it to Disabled. On some systems, saving and rebooting is required before the Secure Boot option appears.

Step 3: Enable Secure Boot
Go to the Security tab or the Boot tab depending on your vendor. Find Secure Boot and set it to Enabled. Set OS Type to Windows UEFI Mode and Secure Boot Mode to Standard. Do not leave it in Custom mode unless you are managing your own keys.

Step 4: Enroll Default Secure Boot Keys
Navigate to Key Management or a similarly named submenu. Select Install Default Secure Boot Keys or Restore Factory Keys. This step is critical—enabling Secure Boot without installing the default keys will leave the hardware in a state where it may refuse to boot any operating system.

Step 5: Save and Exit
Press F10 or select Save & Exit. The machine will reboot. During the first boot after enabling Secure Boot, drivers are re-signed and validated. A longer-than-normal boot time on the first restart is expected.

Common Mistakes And How To Avoid Them

Even with the correct steps above, a few issues tend to stall the process. The table below covers the most frequent blockers:

Verify Secure Boot Is Active

After the PC reboots into Windows, run msinfo32 again. Confirm that Secure Boot State now reads On. You can also open PowerShell and run Confirm-SecureBootUEFI—a True result means everything is working correctly. If you are moving to Windows 11, the PC Health Check app will now show Secure Boot as a satisfied requirement.

That single verified status check is the final signal that your boot chain is locked down from unauthorized firmware and driver injections. The entire process takes about ten minutes once prerequisites are confirmed, and it is one of the strongest baseline protections you can enable on a modern Windows machine.