How To Enable Secure Boot On My PC | UEFI Setup Steps

Enabling Secure Boot means switching your PC from Legacy to UEFI mode, converting the drive to GPT, and turning the Secure Boot setting on in BIOS.

Secure Boot is mandatory for Windows 11, and missing this single setting is why most upgrade attempts fail. The process for how to enable Secure Boot on my PC involves three changes: switching the firmware from Legacy to UEFI mode, converting the hard drive to GPT if it isn’t already, and toggling Secure Boot on in BIOS. Each step builds on the one before it, and the wrong order can make the whole thing seem broken when it’s not.

What Do You Need Before Enabling Secure Boot?

Three things must be true before Secure Boot can turn on. The PC must have UEFI firmware — most systems built after 2012 have it, but older budget boards may not. The operating system drive must use the GPT partition format, not MBR. And the system needs TPM 2.0, though that’s usually active on modern hardware already. Each one blocks Secure Boot if missing, and none can be skipped.

Microsoft’s official Windows 11 Secure Boot requirements spell out every detail. All editions — Home, Pro, Enterprise, Education — demand Secure Boot enabled.

Step 1: Check and Convert Your Drive to GPT

The drive partition style determines whether Secure Boot can engage at all. MBR drives block it entirely. Checking takes about ten seconds.

Press Windows Key + X and select Disk Management. Right-click the gray box labeled Disk 0 (the drive holding Windows) and choose Properties. Open the Volumes tab. Look at Partition style. If it says GUID Partition Table (GPT), move to the next section. If it says Master Boot Record (MBR), conversion is required.

Windows includes a tool called mbr2gpt that converts the drive without wiping it. Back up important files first. Open an admin Command Prompt — right-click the Start button and choose Terminal (Admin) — then run:

mbr2gpt /validate

If validation passes, run:

mbr2gpt /convert

The tool restructures the partitions and creates the EFI system partition. After a reboot, the drive reads as GPT.

Step 2: Access the UEFI Firmware Settings

Getting into the UEFI menu depends on whether Windows still boots. If it does, the cleanest path runs through the operating system itself.

Open Settings > System > Recovery. Under Advanced startup, click Restart now. On the blue screen that appears, select Troubleshoot > Advanced options > UEFI Firmware Settings > Restart. The PC reboots straight into the firmware interface.

If Windows won’t start, use the manual key. Restart the PC and press the correct key as soon as the manufacturer logo appears — F2 on most Dell and Lenovo systems, F10 on HP and Asus, Del on many desktop motherboards. Starting the presses the instant the screen wakes up catches the brief window.

Enable Secure Boot On Your PC: The Exact Step Sequence

Inside the UEFI interface, the settings live under Boot, Security, or Authentication depending on the manufacturer. The changes must happen in a specific order or Secure Boot stays grayed out.

• Disable CSM Support (Compatibility Support Module). This legacy compatibility layer blocks Secure Boot entirely.
• Change Boot Mode (sometimes labeled Boot List Option) from Legacy to UEFI. The switch enables the modern boot path Secure Boot requires.
• Locate Secure Boot and set it to Enabled or On.
• Set OS Type to Windows UEFI Mode. Leaving it on Other OS or Linux keeps Secure Boot inactive.
• If Secure Boot Mode appears, set it to Standard. If it reads Custom, find the Restore Factory Keys or Install Default Secure Boot Keys option and run it before exiting.

After all five settings are correct, go to the Exit tab, select Save Changes and Exit, and confirm the prompt. The screen should flash and Windows begins loading normally.

Step 4: Verify Secure Boot Is Active

Once Windows loads, confirm the changes took hold. Search for System Information — typing msinfo32 in the search bar works too. In the System Summary, check two lines:

• BIOS Mode must show UEFI. Legacy means the boot mode change didn’t save.
• Secure Boot State must show On. Off means the setting didn’t enable despite UEFI mode being active.

Both values must read correctly. A UEFI BIOS mode with Secure Boot Off means the setting itself needs revisiting — go back into UEFI and confirm step three.

Common Mistakes That Block Secure Boot

Most failures trace back to one overlooked setting. The table below lists the typical culprits and what to do about each.

Why Won’t Secure Boot Turn On?

When the system still refuses, the blocker is usually hidden in plain sight. Double-check the partition style first — MBR is the most common stealth issue. Run mbr2gpt /validate from an admin prompt even if Disk Management looked fine, because validation catches edge cases the GUI doesn’t surface.

Another hidden problem: some motherboards ship with Secure Boot set to Custom rather than Standard. Custom mode expects manually loaded keys and typically blocks the feature. Switching to Standard and restoring factory keys resolves this on most Gigabyte, MSI, and ASRock boards.

Older graphics cards without a UEFI-compatible VBIOS can also cause a black screen when CSM is disabled. If the display stays dark after switching to UEFI mode, connect the monitor to the motherboard’s video port or update the GPU’s firmware to a UEFI-compatible version.

Quick Reference Checklist

Run through this list one item at a time. Every checkmark removes a reason Secure Boot stays off.

With all eight items confirmed, Secure Boot is active and your PC meets the Windows 11 security requirement.