How To Enable Secure Boot State On Windows 10 | UEFI Setup Walk

To enable Secure Boot on Windows 10, enter UEFI firmware via Advanced Startup, disable CSM, set OS Type to Windows UEFI mode, and toggle Secure Boot to Enabled.

Most Windows 10 PCs ship with Secure Boot already active, but a clean install, a motherboard swap, or a BIOS reset can leave it sitting at Disabled. Whether you are researching how to enable Secure Boot state on Windows 10 for a new game like Call of Duty or a security requirement, the process takes about five minutes from start to finish — as long as your hardware is set up for it.

What You Need Before Enabling Secure Boot

Secure Boot is not a simple toggle you can flip on any PC. Your system must meet several hardware and software requirements before the option becomes available or works correctly.

Your motherboard must run UEFI firmware rather than legacy BIOS. The system drive must use the GPT partition scheme, not the older MBR format. TPM 2.0 needs to be enabled in your BIOS settings. And your copy of Windows 10 should be version 20H2 or newer — version 22H2 is required for certain games that mandate Secure Boot.

The table below shows every prerequisite and how to check it.

Step 1: Check Your Current System Status

Before changing anything in the BIOS, verify where your system stands. Open the Run dialog with Windows Key + R, type msinfo32, and press Enter. In the System Information window, look for two items:

• BIOS Mode — must read UEFI. If it says Legacy, you cannot enable Secure Boot without reinstalling Windows.
• Secure Boot State — if it reads Off, the feature is ready to be enabled in firmware.

Next, check your drive partition style. Open Disk Management (right-click the Start button and select Disk Management), right-click your OS drive (C:), choose Properties, go to the Volumes tab, and confirm the Partition Style reads GUID Partition Table (GPT). If it says Master Boot Record (MBR), you will need to convert it before proceeding.

Step 2: Access UEFI Firmware Settings

The safest way to enter your motherboard’s firmware menus is through Windows itself. Go to Start > Settings > Update & Security > Recovery. Under Advanced startup, click Restart now. Once the blue menu appears, select Troubleshoot > Advanced options > UEFI Firmware Settings, then click Restart. Your PC will boot directly into the BIOS interface.

If Windows will not load, you can enter the BIOS by pressing Delete or F2 repeatedly during the initial boot screen. The exact key varies by motherboard manufacturer — Dell systems often use F2, while many MSI and Gigabyte boards use Delete.

Step 3: Configure the BIOS for Secure Boot

Once inside the BIOS menu, the exact labels vary by manufacturer, but the logic is the same across all systems. Switch to Advanced Mode if your BIOS offers a basic and advanced view — usually triggered by pressing F7.

Navigate to the Boot tab (sometimes labeled Security on Dell systems). Find the CSM (Compatibility Support Module) option and set Launch CSM to Disabled. CSM emulates legacy BIOS behavior and blocks Secure Boot from activating.

Next, locate the Secure Boot section. Set OS Type to Windows UEFI mode. If you see a Secure Boot mode option, set it to Standard to use the factory-installed keys. On older Intel motherboards, you may need to enter Key Management and select Install Default Secure Boot Keys before the Secure Boot toggle becomes available. Microsoft’s Secure Boot documentation confirms this sequence for systems that meet the hardware prerequisites.

Finally, change Secure Boot State from Disabled to Enabled. Navigate to the Exit tab, select Save Changes & Reset, and confirm. Some systems use F10 as a shortcut to save and exit.

Step 4: Confirm Secure Boot Is Active

After the PC restarts, log into Windows and run msinfo32 again. The Secure Boot State line should now read On. If it still shows Off, re-enter the BIOS and double-check that CSM is disabled and that you saved changes before exiting.

Common Issues That Block Secure Boot

Even with the correct steps, several pitfalls can prevent Secure Boot from turning on. The table below covers the most frequent problems and their solutions.

One issue worth extra attention: the original Windows Secure Boot 2011 certificates expire in June 2026. Systems still using those certificates may face boot verification failures after that date. Moving to the 2023 Secure Boot certificates is recommended, and for Windows 10 systems not upgraded to Windows 11, this update requires enrollment in the Consumer Extended Security Updates (ESU) program.

Enabling Secure Boot: The Complete Sequence

Here is the full workflow from start to finish, condensed into the order that works every time:

1. Run msinfo32 to confirm BIOS Mode is UEFI and Secure Boot State is Off.
2. Verify your drive uses GPT in Disk Management.
3. Enter the UEFI firmware via Windows Advanced Startup or the BIOS key.
4. Disable CSM (Launch CSM set to Disabled).
5. Set OS Type to Windows UEFI mode.
6. Set Secure Boot mode to Standard (install default keys if needed).
7. Enable Secure Boot State.
8. Save changes and exit — the system will reboot.
9. Confirm Secure Boot State reads On in msinfo32.

If Secure Boot still will not enable after following all nine steps, your motherboard may need a firmware update, or the system may require a clean installation of Windows 10 in UEFI mode to switch from MBR to GPT.