Enabling Secure Boot on a GIGABYTE board requires disabling CSM, enabling fTPM or PTT, and restoring factory keys in the BIOS.
Windows 11 requires it. Modern anti-cheat software demands it. If your GIGABYTE build is running with Secure Boot off, you are leaving a critical line of defense disabled. The fix is a straight path through the BIOS, but it requires a specific sequence. You can’t just flip one switch.
If you need to know how to enable Secure Boot on Gigabyte motherboards, the process boils down to three stages: removing the old compatibility layer (CSM), turning on the hardware security module (fTPM or PTT), and initializing the Secure Boot database with factory keys.
Why Enable Secure Boot on GIGABYTE Motherboards?
Secure Boot prevents unauthorized code—like rootkits and bootloaders—from running during system startup. It is a mandatory requirement for Windows 11 64-bit installations and for many popular games and high-security applications.
Without Secure Boot set to Active, tools like the PC Health Check app will flag your system as incompatible, and some software will refuse to launch entirely. It’s not an optional feature for modern computing.
Prerequisites: What Your System Needs
Before entering the BIOS, verify your current setup. Secure Boot only works under specific conditions. If you fail any of these checks, the option will remain hidden or grayed out.
- UEFI Mode: Your system must be booting in UEFI mode, not Legacy BIOS.
- GPT Disk: Your Windows drive must use the GPT partition scheme. MBR drives are incompatible.
- TPM 2.0: The Trusted Platform Module must be enabled and set to version 2.0.
- Latest BIOS: GIGABYTE regularly releases updates that improve UEFI stability. Update to the latest version for your specific board model to prevent missing menu options.
Enabling Secure Boot on Your GIGABYTE Motherboard: The Complete Sequence
The table below outlines the exact order of operations. This sequence is derived from GIGABYTE’s official support documentation and verified across popular GIGABYTE models like the B450M, Z390 UD, and X570 AORUS boards.
| Step | Action | Critical Notes |
|---|---|---|
| 1 | Verify Disk Partition | Open Disk Management. If your OS drive says MBR, stop here. You must convert it to GPT using the MBR2GPT tool before proceeding. |
| 2 | Enter BIOS | Restart and press Delete or F2 repeatedly during the initial startup screen. |
| 3 | Enable fTPM (AMD) / PTT (Intel) | AMD: Navigate to Settings > AMD CPU fTPM, set to Enabled. Intel: Navigate to Peripherals > Intel Platform Trust Technology, set to Enabled. |
| 4 | Disable CSM Support | Go to Boot tab, find CSM Support, and set it to Disabled. If the option is missing, ensure your storage boot control is set to UEFI only. |
| 5 | Save and Reboot | Press F10 to save changes. The system will restart. This step confirms the UEFI environment is stable before you touch Secure Boot. |
| 6 | Enable Secure Boot | Re-enter BIOS. Go to Boot > Secure Boot and set it to Enabled. At this stage, it may show a status of “Not Active.” This is normal. |
| 7 | Restore Factory Keys | Change Secure Boot Mode to Custom. Go to Key Management and select Restore Factory Keys. Confirm the prompt to install factory defaults. This populates the Secure Boot database. |
| 8 | Set Mode Back to Standard | Re-enter BIOS one more time. Under Secure Boot, set the Secure Boot Mode back to Standard. |
| 9 | Verify Final Status | Check the Secure Boot status in BIOS. It should now read Active. Boot into Windows, press Win + R, type msinfo32, and confirm Secure Boot State is On. |
This process mirrors the official walkthrough provided by GIGABYTE for their AM4 300-series motherboards. If you encounter a stubborn “Not Active” state, restoring the factory keys is usually the missing piece.
Troubleshooting: Why Does Secure Boot Say “Not Active”?
This is the most common hurdle. You enabled Secure Boot in the BIOS, but the status line still reads “Not Active” or “Disabled.”
The issue is almost always the Secure Boot database. When you enable Secure Boot for the first time, the motherboard needs a set of authorized signatures to verify against. These signatures are stored in the Key Management section. By selecting Restore Factory Keys (Step 7), you upload these default Microsoft and UEFI signatures. Skipping this step leaves the database empty, so the system cannot validate a boot chain, effectively keeping Secure Boot dormant even though the switch is flipped to “Enabled.”
If the option to restore keys is grayed out, ensure you have changed the Secure Boot Mode to Custom first. Once the keys are loaded, reverting to Standard mode finalizes the configuration.
Common Secure Boot Mistakes and How to Fix Them
These four mistakes account for nearly every failed Secure Boot setup on GIGABYTE hardware. Run down this list if you are stuck.
| Mistake | Symptom | The Fix |
|---|---|---|
| CSM Still Enabled | Secure Boot option missing or grayed out. | Disable CSM Support under the Boot tab. If it won’t disable, check if your GPU or storage device supports UEFI GOP. |
| MBR Partition Style | System boots to a black screen or fails to start. | Boot into Windows recovery, use the MBR2GPT tool to convert the disk without losing data. |
| Skipped Key Restoration | Shows “Enabled” but clearly says “Not Active”. | Enter BIOS, switch to Custom mode, locate Key Management, and Restore Factory Keys. |
| Left in Custom Mode | Boot stability issues or keys not being read. | After restoring keys, always set the mode back to Standard to lock the configuration. |
| Multiple Drives Connected | Boot failure after enabling Secure Boot (common on Z390 UD). | Unplug all SATA and USB storage devices except your boot M.2 SSD, then retry the key restoration process. |
How to Check If Secure Boot Is Working
After completing the steps, you need to verify the result in two places.
In the BIOS: Navigate to the Boot tab. The line for Secure Boot should show Active rather than just Enabled. This confirms the database is populated and the feature is enforcing.
In Windows: Press Windows Key + R, type msinfo32, and hit Enter. Look for the Secure Boot State entry. It must read On. If it reads “Off” or “Unsupported,” review the table above to identify the overlooked step.
If you cannot boot into Windows after making these changes, power off the system, unplug the power cord, and remove the small circular CMOS battery on the motherboard for about two minutes. This resets the BIOS to factory defaults and will restore your ability to boot. From there, you can reattempt the sequence with the notes above in mind.
Checklist: Your Secure Boot Task is Done
- CSM Support set to Disabled.
- fTPM (AMD) or PTT (Intel) set to Enabled.
- System disk is GPT.
- Secure Boot set to Enabled.
- Secure Boot Mode set to Standard after key restoration.
- BIOS status reads Active.
- Windows
msinfo32confirms Secure Boot State: On.
References & Sources
- GIGABYTE Official FAQ. “How to enable Secure Boot for GIGABYTE motherboards?” Provides the official step-by-step procedure for AM4 300-series and newer boards.