How To Enable Secure Boot In User Mode | Enroll PK First

Enable Secure Boot in User Mode by restoring factory default keys in UEFI firmware—this enrolls the Platform Key (PK) and exits Setup Mode.

Here’s how to enable Secure Boot in User Mode: enroll the Platform Key by restoring factory default keys in UEFI firmware. Without the PK, the system stays in Setup Mode and the Secure Boot toggle snaps back to Disabled every time you try to flip it. The fix takes about two minutes and works on ASUS, MSI, Gigabyte, ASRock, Dell, HP, and Lenovo machines.

What Does “Setup Mode” Actually Mean?

Setup Mode is the UEFI state where the Platform Key (PK) has been cleared or was never written into NVRAM. Without the PK installed, the firmware cannot verify the chain of trust—the Key Exchange Key (KEK), the Database Key (DB), and every bootloader that depends on them. Secure Boot stays disabled in this state regardless of what you toggle in the menu.

User Mode is the opposite: the PK is enrolled, the KEK and DB are present, and Secure Boot enforces that only signed, trusted code runs at boot. The system will not allow Secure Boot to activate until it detects a valid PK. That is why toggling “Enabled” on a Setup Mode system always reverts—the firmware has no root key to enforce against.

What You Need Before Starting

Three conditions must be true before the firmware will accept a PK enrollment:

• CSM must be Disabled. Compatibility Support Module (Legacy BIOS emulation) blocks Secure Boot entirely. Find CSM under the Boot or Advanced tab and set it to Disabled. If you cannot find it, look for “Legacy Boot” or “BIOS Mode” and disable that instead.
• UEFI firmware must be active with GPT. If your system drive uses MBR, convert it to GPT using Windows’ built-in mbr2gpt tool before proceeding—Secure Boot requires GPT partitioning. Run mbr2gpt /validate first, then mbr2gpt /convert from an elevated command prompt.
• TPM 2.0 is required for Windows 11 (which mandates Secure Boot) but is not needed for the User Mode transition itself. The mode change happens at the firmware level and works on systems without a TPM installed.

Setting Secure Boot To User Mode: The PK Enrollment Sequence

The single action that fixes the error is enrolling the Platform Key. Most UEFI firmware provides a direct path for this, and the steps are nearly identical across motherboard brands.

Step 1: Enter UEFI Firmware Settings. From Windows, go to Settings > System > Recovery > Advanced startup > Restart now. On the blue screen, select Troubleshoot > Advanced options > UEFI Firmware Settings > Restart. Alternatively, press F2, Del, or F10 repeatedly during power-on—the exact key appears briefly on the boot splash screen.

Step 2: Disable CSM. Navigate to Boot > CSM (or Advanced > CSM) and set it to Disabled. Secure Boot will not accept key enrollment while CSM is on. Save and reboot if the option was previously enabled, then re-enter UEFI firmware.

Step 3: Enroll factory default keys. Locate the Secure Boot section—it lives under Security, Boot, or Windows OS Configuration depending on your motherboard vendor. If the status reads “Setup Mode” and the enable option keeps reverting:

• Set Secure Boot Mode to Custom (this unlocks the key management menus).
• Select Enroll all factory default keys, Restore Factory Keys, or Install Default Secure Boot Keys—the exact label varies by brand.
• Confirm with Yes when prompted.

The firmware writes the Platform Key into NVRAM. When you return to the Secure Boot main page, the status should now read “User Mode.” If your BIOS lacks a Custom/Standard toggle, the Restore Factory Keys option alone accomplishes the same thing.

Step 4: Revert to Standard mode and enable Secure Boot. Set Secure Boot Mode back to Standard. Then set Secure Boot to Enabled and OS Type to Windows UEFI Mode (not “Other OS”). Press F10 to save and exit. After reboot, Secure Boot runs in User Mode.

Common Secure Boot Errors And Their Fixes

Microsoft’s official guidance on Windows 11 and Secure Boot confirms that enrolling the PK is the required step for transitioning from Setup Mode to User Mode.

How To Confirm Secure Boot Is Active

Open System Information (type msinfo32 in the Start menu) and look for Secure Boot State—it should read “On.” You can also open PowerShell and run Confirm-SecureBootUEFI; a True result confirms User Mode is active and Secure Boot is enforcing. If the result is “False” or the command throws an error, the PK enrollment did not stick and you need to repeat Step 3.

What Happens If The System Won’t Boot?

Enabling Secure Boot can block older graphics cards, unsigned drivers, or non-Windows operating systems from loading. If your PC fails to start after the change, enter UEFI firmware again using the power-on key and set Secure Boot to Disabled. For long-term compatibility with User Mode, verify that your GPU supports UEFI GOP (check the manufacturer’s spec sheet) and that all boot devices use GPT with signed EFI binaries. Some add-on cards like older RAID controllers or capture cards lack UEFI Option ROMs and will not work in User Mode at all.

Secure Boot Settings Location By Motherboard Brand

Final Checklist: Enable Secure Boot In User Mode

1. Disable CSM under the Boot tab in UEFI firmware.
2. Set Secure Boot Mode to Custom (if available) and enroll factory default keys.
3. Confirm the status changes from “Setup Mode” to “User Mode.”
4. Switch Secure Boot Mode back to Standard.
5. Set Secure Boot to Enabled and OS Type to Windows UEFI Mode.
6. Save with F10, reboot, and verify with msinfo32 that Secure Boot State reads “On.”