Enabling Secure Boot on Windows 11 requires changing a setting in the system firmware (BIOS/UEFI) and then confirming its status in Windows. Below is a practical, step-by-step guide you can follow. If any step seems different on your machine, consult your PC or motherboard vendor’s support site for model- specific instructions. Direct answer
- Secure Boot must be enabled in the UEFI/BIOS, and Windows must be running in UEFI mode (not Legacy/CSM).
- After enabling Secure Boot in firmware, you can verify its status in Windows via System Information and ensure the OS is installed in UEFI mode.
Step-by-step guide
- Check current status in Windows
- Open System Information (search for “msinfo32” or “System Information”).
- Look for:
- BIOS Mode: should read UEFI.
- Secure Boot State: should read On if already enabled.
- If BIOS Mode is not UEFI, you may need to convert the installation to UEFI or reinstall Windows in UEFI mode. Note: converting from legacy to UEFI can be complex and may require data backup and possible reinstall. If unsure, back up your data and consult your PC’s documentation or a professional.
- Prepare for Secure Boot
- Ensure your PC has a compatible motherboard/firmware with Secure Boot support.
- If your system uses a motherboard with a custom firmware, you may need to enable a related option (e.g., "OS Optimized Defaults" or "Secure Boot" or "UEFI Boot" settings) in the firmware interface.
- Enable Secure Boot in the firmware (BIOS/UEFI)
- Reboot and enter the BIOS/UEFI setup:
- Common keys: Delete, F2, or F10 (the exact key is typically shown briefly on startup).
- Locate the Secure Boot setting:
- It is often under a tab labeled Security, Boot, or Authentication, or under an Advanced/Expert mode.
- If Secure Boot is currently Disabled:
- Change Secure Boot to Enabled.
- If you see an option for Platform Key (PK) enrollment, enable or confirm as prompted.
- Save changes and exit the firmware (usually F10 or a Save & Exit option).
- Confirm in Windows
- After Windows reboots, open System Information again.
- Check:
- BIOS Mode: should be UEFI.
- Secure Boot State: should be On.
- If Secure Boot State still shows Off, repeat the firmware steps, ensuring Secure Boot was enabled and that Windows was booted in UEFI mode.
- Troubleshooting and notes
- If your system uses legacy BIOS with no Secure Boot support, Secure Boot cannot be enabled without hardware/firmware changes.
- If Windows was installed in Legacy mode, enabling Secure Boot will prevent Windows from booting until the installation is compatible with Secure Boot (i.e., installed in UEFI mode with keys recognized by Secure Boot). In such cases, you may need to reinstall Windows in UEFI mode.
- Some systems require enabling "CSM/Legacy Boot" or switching off “Compatibility Support Module” to allow Secure Boot to take effect; after enabling Secure Boot, you may re-enable modern boot options as recommended by the manufacturer.
What to do if you’re unsure
- Check your PC or motherboard’s manual or support page for exact Secure Boot instructions for your model.
- If available, use your vendor’s instructions or a trusted guide specific to your hardware to avoid misconfigurations.
If you’d like, share your PC model or motherboard model, and the current BIOS/UEFI interface you’re seeing. I can tailor the exact menu path and wording for enabling Secure Boot on that hardware.
