Secure Boot is a UEFI security feature that helps stop untrusted software from loading before Windows starts. Before changing firmware settings, save your work and make sure you can access your BitLocker or device-encryption recovery key if encryption is enabled.
Check Secure Boot First
- Press Windows + R.
- Type msinfo32 and press Enter.
- Check BIOS Mode and Secure Boot State.
If BIOS Mode says UEFI and Secure Boot State says On, no change is needed. If Secure Boot says Unsupported, investigate the boot mode and hardware before changing settings.
Enter UEFI Settings
- Open Settings.
- Choose System > Recovery.
- Next to Advanced startup, select Restart now.
- Choose Troubleshoot > Advanced options > UEFI Firmware Settings.
- Select Restart.
Enable Secure Boot
- Locate Secure Boot in the UEFI utility. It may be under Security, Boot, or Authentication.
- Confirm that the computer is configured for UEFI rather than Legacy/CSM boot.
- Set Secure Boot to Enabled.
- Save the changes and exit.
- After Windows starts, open System Information again and verify that Secure Boot State says On.
If Secure Boot Is Unavailable
Do not blindly change a working PC from Legacy/CSM to UEFI. Older installations may use an MBR system disk, while modern UEFI Windows installations normally use GPT. An unplanned firmware-mode change can make Windows unbootable. Some manufacturers also require restoring factory Secure Boot keys or changing another firmware option first, so check the documentation for the exact PC or motherboard.
BitLocker Precaution
Firmware and boot-security changes can cause Windows to request the BitLocker recovery key. Confirm that the key is backed up somewhere you can reach from another device before making changes.
Should Secure Boot Stay Enabled?
Usually, yes. Secure Boot protects the startup process by allowing trusted, digitally signed boot software. Specialized operating systems or hardware can occasionally require a different configuration, but disabling a security feature should be a deliberate exception.
Summary
Check the current state in System Information, enter UEFI through Windows Recovery, enable Secure Boot, and verify the result after restarting. If the PC uses Legacy/CSM boot, investigate the Windows installation and disk configuration before changing modes, and keep the BitLocker recovery key available.