How to Enable Secure Boot on Windows 11 [2025 Updated]

As cybersecurity threats continue to evolve, operating systems like Windows 11 have taken major strides toward protecting users from sophisticated attacks. One of the core components of this security infrastructure is Secure Boot. Secure Boot leverages digital signatures to verify the authenticity of the bootloader and operating system, preventing rootkits and boot-level malware from gaining control before Windows even loads.

Since its release, Windows 11 has required Secure Boot as part of its minimum system requirements, alongside TPM 2.0 and UEFI. This shift marks a significant push toward enhanced system integrity and resilience, especially for everyday users who might not be aware of firmware-level vulnerabilities. However, many users upgrading from older systems or installing Windows 11 manually may find that Secure Boot is disabled—or even unsupported—by default.

This guide provides a comprehensive, updated walkthrough for 2025 on how to enable Secure Boot, covering everything from system prerequisites and UEFI configuration to troubleshooting common errors. Whether you’re preparing your device for an OS upgrade or tightening your security posture, this guide will help you navigate the process with confidence.

What is Secure Boot?

Secure Boot is a security feature built into modern UEFI (Unified Extensible Firmware Interface) firmware that helps protect your computer during the boot process. Its primary function is to ensure that only trusted, digitally signed software is allowed to run when your PC starts up. This prevents malicious programs—such as rootkits, bootkits, or unauthorized bootloaders—from hijacking your system before the operating system even loads.

When Secure Boot is enabled, the UEFI firmware checks the digital signatures of each piece of boot software, including the bootloader, OS kernel, and essential drivers. If any of these components are unsigned or tampered with, the system will refuse to boot, effectively blocking potentially dangerous code from running at a critical stage.

Why Secure Boot Matters for Windows 11?

Secure Boot plays a critical role in protecting the integrity and security of modern Windows systems—particularly Windows 11. As cyberattacks become more sophisticated, attackers increasingly target the boot process, where traditional antivirus and endpoint protections are inactive. Secure Boot mitigates these risks by ensuring that only trusted and verified code is executed during startup.

For Windows 11, Secure Boot isn’t optional—it’s part of Microsoft’s minimum system requirements. Alongside TPM 2.0 and UEFI, Secure Boot is a cornerstone of the security enhancements in Windows 11. It works by validating digital signatures on bootloaders, drivers, and the operating system kernel. If a component has been altered or isn’t signed by a trusted certificate authority, the system will halt the boot process, blocking potentially harmful code from taking over your machine.

Benefits of Secure Boot on Windows 11:

• Enhanced defense against ransomware and rootkits
• Better support for BitLocker full disk encryption
• Compliance with corporate security standards
• Protection for Windows Hello and credential storage

Prerequisites Before Enabling Secure Boot

Before you can enable Secure Boot, ensure the following:

UEFI Firmware: Secure Boot only works with UEFI. If your system is still running in Legacy BIOS mode, you’ll need to convert it to UEFI.

GPT Partition Style: UEFI requires the system disk to use GPT (GUID Partition Table) instead of MBR (Master Boot Record). You can convert MBR to GPT without data loss using the mbr2gpt tool (see below).

TPM 2.0 Module (Optional, but required for Windows 11): While not directly related to Secure Boot, TPM 2.0 is another requirement for Windows 11 security.

Step-by-Step Guide to Enable Secure Boot on Windows 11

Step 1: Check Current Secure Boot State

1. Press Windows + R, type msinfo32, and hit Enter.
2. In the System Information window:
   • Look for “Secure Boot State”
   • If it says “Off” or “Unsupported”, follow the steps below

Step 2: Verify UEFI Mode is Enabled

1. Still in msinfo32, check the value of “BIOS Mode”:
   • If it says UEFI, you’re good to go.
   • If it says Legacy, you must convert to UEFI.

Step 3: Convert MBR to GPT (If Needed)

⚠️ Important: Backup your data before proceeding.

1. Open Command Prompt as Administrator
2. Type: cmdCopyEditmbr2gpt /validate /allowFullOS
   • If successful, then:
   cmdCopyEditmbr2gpt /convert /allowFullOS
3. Restart your PC and enter the BIOS/UEFI settings (commonly by pressing Del, F2, or Esc at boot).
4. Change the boot mode from Legacy to UEFI

Step 4: Enter UEFI Firmware Settings

1. Go to Settings > System > Recovery
2. Under Advanced startup, click Restart now
3. Click:
   • Troubleshoot → Advanced options → UEFI Firmware Settings → Restart

Step 5: Enable Secure Boot in UEFI

1. Inside the UEFI firmware menu, locate the Secure Boot option (usually under “Boot”, “Security”, or “Authentication” tab).
2. If the option is greyed out, set “OS Type” to Windows UEFI Mode
3. Change “Secure Boot” to Enabled
4. Save and Exit (usually F10)

Step 6: Optional – Clear or Install Secure Boot Keys

If you’re building a custom PC or installed an OS that altered default keys:

1. In UEFI, find the Secure Boot Keys section
2. Choose “Install Default Keys” or “Reset to Factory Keys”
3. Save changes and exit

6. Verifying Secure Boot is Enabled

After restarting into Windows:

1. Press Windows + R, type msinfo32, and press Enter
2. Under System Summary, verify:
   • Secure Boot State: On
   • BIOS Mode: UEFI

Alternatively, use PowerShell:

Confirm-SecureBootUEFI

Returns True if Secure Boot is enabled.

Frequently Asked Questions (FAQs)

Conclusion

Enabling Secure Boot on Windows 11 is a relatively simple but critical step to ensure your system remains secure against firmware-level attacks. Whether you’re upgrading from Windows 10, migrating from BIOS to UEFI, or just tightening your PC’s defenses, Secure Boot is one of the foundational pillars of a secure computing environment in 2025 and beyond.

If you follow this guide carefully and check compatibility, you’ll be able to enable Secure Boot confidently without losing data or compromising performance.