Enabling Secure Boot on an MSI motherboard requires switching to UEFI mode, enabling TPM, and activating Secure Boot in the Security menu.
Windows 11 and modern anti-cheat systems like Vanguard demand Secure Boot. If you’re staring at an MSI BIOS screen wondering where the toggle is, the answer is often buried behind two other settings: CSM must be off, and the TPM must be awake. Here are the exact keystrokes to get it done.
Three Requirements For Secure Boot On MSI
Before entering the BIOS, three things must be true. Secure Boot is a UEFI-only feature, so an MBR drive or an active CSM module will block it entirely.
| Requirement | Why It Matters | How To Validate / Fix |
|---|---|---|
| UEFI Mode | Secure Boot is part of the UEFI spec. | Enter BIOS → Settings → Boot. Set CSM/UEFI Mode to UEFI. |
| GPT Partition | Secure Boot cannot verify an MBR disk. | Run in Windows: mbr2gpt /validate /allowFullOS then mbr2gpt /convert /allowFullOS. |
| TPM 2.0 Enabled | Works with Secure Boot to validate boot components. | Go to Settings → Security → Trusted Computing. Enable Security Device Support. |
| BIOS Version | Must include the 2023 Windows UEFI CA keys. | Check the MSI support page for your motherboard model. |
How To Enable Secure Boot On MSI AM4 Motherboards
The following is the official path documented for MSI AM4 boards like the MAG B550 TOMAHAWK. It is the most reliable way to activate the feature.
- Restart your PC and press Delete repeatedly to enter the BIOS.
- Navigate to Settings → Security → Trusted Computing.
- Enable Security Device Support. Save and reboot (F10).
- Re-enter the BIOS and go to Settings → Security → Secure Boot.
- Set Secure Boot to Enabled.
- Press F10 to save and exit.
Success State: On the next boot, Secure Boot is active.
On some MSI BIOS versions, the toggle lives under Settings → Advanced → Windows OS Configuration → Secure Boot.
Is Secure Boot Actually Enabled? Check In Windows.
A quick check in Windows confirms the setting is active.
Press Windows Key + R, type msinfo32, and hit Enter. In the System Information window, check the Secure Boot State entry. It must read On.
Facing A Setup Mode Or Disabled Error? Try This.
If Secure Boot shows as “Disabled” or “Setup Mode,” the firmware lacks the factory Platform Keys (PK). Enrolling them manually resolves this.
| Step | Action | Notes |
|---|---|---|
| 1 | Set Secure Boot Mode to Custom | This unlocks the Key Management menu. |
| 2 | Select Key Management → Install all Factory Default Keys | Select YES when the prompt appears. |
| 3 | Press F10 to save and reboot | If you see “Reset Without Saving,” select NO. |
| 4 | Re-enter the BIOS and check the status | Ensure Secure Boot is set to Enabled. |
| 5 | Press F10 to save and exit | The system will reboot with Secure Boot active. |
Common Secure Boot Mistakes On MSI Boards
A few specific pitfalls cause most failed attempts.
- Skipping the MBR-to-GPT conversion. Enabling Secure Boot on an MBR drive will cause a boot failure. Always validate with
mbr2gpt /validatefirst. - Forgetting the BIOS update. MSI recommends updating to a BIOS version that includes “Windows UEFI CA 2023” keys. Check the MSI support page for your exact motherboard model.
- Incorrect key enrollment. When prompted to install factory defaults, selecting “Reset Without Saving” at the wrong time can clear the newly enrolled keys. Follow the table above closely.
- Leaving CSM enabled. Secure Boot will not function if CSM is turned on, even if other settings look correct.
Final Checklist For A Successful Secure Boot Activation
1. Drive is GPT.
2. BIOS mode is UEFI (CSM disabled).
3. Security Device Support is Enabled (fTPM 2.0 active).
4. Secure Boot is Enabled under Settings → Security.
5. Windows System Information shows Secure Boot State: On.
References & Sources
- MSI. “How to Enable Secure Boot and TPM 2.0 on MSI AM4 Motherboards.” Official step-by-step guide and menu paths.
- MSI FAQ. “BIOS Update for Secure Boot Key.” Details on the Windows UEFI CA 2023 key requirement.