Enable Secure Boot Windows 11: Turn On and Fix Greyed Out

Secure Boot is a firmware feature that only lets trusted, digitally signed software run while the PC starts, which blocks a whole class of malware that loads before Windows. It also comes up when a game’s anti-cheat, a Windows 11 compatibility check or device encryption complains that it is off. This guide shows how to check it, how to enable Secure Boot for Windows 11 from the Settings app, why the option is sometimes greyed out, and what to watch out for so the PC still starts afterwards.

The steps apply to Windows 11 version 24H2, 25H2 and 26H2. Firmware menus differ between PC makers, so the exact names in the last steps vary.

Step 1: Check the current state

1. Press Windows logo key + R, type msinfo32 and press Enter.
2. In System Summary, find Secure Boot State and BIOS Mode.

Secure Boot State	BIOS Mode	Meaning
On	UEFI	Nothing to do
Off	UEFI	Supported but switched off; turn it on in firmware
Unsupported	Legacy	The PC boots in Legacy/CSM mode; Secure Boot needs UEFI
Unsupported	UEFI	Firmware does not offer it, or it needs default keys installed

Microsoft’s Windows 11 and Secure Boot page describes this msinfo32 check. The Windows Security app shows the same thing under Device security: if Secure Boot is missing from the hardware security list, it is off or not available.

Step 2: Before you change anything

• BitLocker or device encryption: changing Secure Boot can trigger the BitLocker recovery screen. Make sure you can find the recovery key first; see Windows 11 BitLocker and BitLocker recovery key.
• Dual boot: Microsoft notes that you might need Secure Boot off to run some hardware or operating systems such as some Linux distributions or older Windows versions. Check that your other system supports Secure Boot.
• Older graphics cards: some older cards lack UEFI firmware and may show no picture with Secure Boot on. Check the card maker’s documentation.

Step 3: Open the firmware settings from Windows

Microsoft documents this route, which works even when the firmware key is hard to catch at power-on:

1. Open Settings > System > Recovery.
2. Next to Advanced startup, select Restart now.
3. On the blue menu, select Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.

The PC restarts into its firmware setup (often still called the BIOS).

Step 4: Turn on Secure Boot

Look under tabs called Boot, Security or Authentication. Set Secure Boot to Enabled, then save and exit (often F10). If you see Secure Boot Mode, Standard is the usual choice. If there is an option to Install default Secure Boot keys or Restore factory keys, you may need it before Secure Boot can be enabled.

Then return to Windows and run msinfo32 again to confirm Secure Boot State: On.

Secure Boot greyed out: Legacy/CSM mode

If the option cannot be selected, the PC is almost certainly booting in Legacy or CSM mode. Microsoft’s page says you need to switch the boot mode from Legacy BIOS (CSM) to UEFI, with UEFI as the first or only option.

There is a catch. Microsoft’s BitLocker documentation warns that an operating system installed in Legacy mode stops booting when the firmware is changed to UEFI, and points to the MBR2GPT tool to prepare the disk first. In plain terms:

1. Check BIOS Mode in msinfo32. If it says Legacy, the disk is probably MBR.
2. Convert the system disk to GPT with Microsoft’s MBR2GPT tool (documented on Microsoft Learn for IT pros), or back up and do a clean install in UEFI mode.
3. Only then switch the firmware to UEFI and enable Secure Boot.

If you are not comfortable with disk conversion, ask the PC maker’s support or a technician. Getting this wrong leaves a PC that will not start until the setting is reverted.

Other reasons it will not enable

• A firmware password is required: some firmware only unlocks Secure Boot settings once a supervisor password is set.
• Custom or cleared keys: use the option to restore factory or default keys.
• Old firmware: install the latest BIOS/UEFI update from the PC or motherboard maker.

The 2026 Secure Boot certificate update

Microsoft has been replacing the Secure Boot certificates issued in 2011, which began expiring in June 2026. Devices running a supported Windows version receive the new certificates through regular updates. Keep Windows Update on and install firmware updates from your PC maker; there is nothing to do by hand on a home PC.

Secure Boot and games

Some online games’ anti-cheat systems now check that Secure Boot is on, and refuse to start or show a warning otherwise. If a game asks for it, the steps above are all you need; there is no game-specific setting. After enabling, also check that TPM 2.0 is on, as the same games often require it; see enable TPM 2.0. If the game still complains, confirm with msinfo32 and update the game, since some check only at launch.

Do you need Secure Boot for Windows 11?

Microsoft’s Windows 11 requirement is that the PC is Secure Boot capable. Turning it on is recommended for security and is needed for some features, including automatic device encryption on many PCs. If you are checking compatibility, see Windows 11 compatibility check and our guide to enable TPM 2.0, the other firmware setting that often needs attention. Our Secure Boot explained checklist covers the background, and the Windows 11 security hub covers the rest.