Secure Boot Guide

Secure Boot is a security feature built into modern PCs that helps protect your system from unauthorized software during startup. Some games and applications require Secure Boot to be enabled in order to run properly. Most PCs already support Secure Boot, but depending on your BIOS settings, it may be turned off by default.

This guide will walk you through how to check your Secure Boot status, what the results mean, and where to find the steps needed to enable it on your device.

Before making any changes, keep in mind that BIOS and UEFI menus vary depending on your hardware manufacturer. Adjusting these settings incorrectly can cause system issues, so always follow the official instructions from your PC or motherboard manufacturer.

Ensure Secure Boot is Enabled

  1. Press Windows Key + R to open the Run window.
  2. Type msinfo32 and press Enter.
  3. In the System Information window, look for the following fields (you can use the search bar at the bottom):
    • BIOS Mode: Should say UEFI
    • Secure Boot State: Should say On

What Your Results Mean

Secure Boot State: Off
Your system supports Secure Boot, but it is currently disabled. You will need to enable it in your BIOS settings.

Secure Boot State: Unsupported
Your system may not support Secure Boot. Check your motherboard or PC manufacturer documentation to confirm.

BIOS Mode: UEFI
Your PC is using UEFI, which supports Secure Boot. You can enable Secure Boot through your BIOS.

BIOS Mode: Legacy
Your PC is not using UEFI. To enable Secure Boot, you must switch your Boot Mode to UEFI. This may require converting your drive from MBR to GPT before UEFI and Secure Boot can be used.

Check Your Disk Partition Style

Secure Boot requires your system to use the GPT (GUID Partition Table) partition style. If your drive is using MBR (Master Boot Record), you will not be able to switch your BIOS Mode to UEFI until it is converted.

Follow these steps to check your partition style:

  1. Type Disk Management in the Windows search bar and press Enter.
  2. Right click the drive that contains your Windows installation.
  3. Select Properties.
  4. Open the Volumes tab.
  5. Look for Partition Style.

If the Partition Style shows GPT as a result, you are good to proceed. If your Partition Style shows MBR, you will need to convert it to GPT before you can switch your BIOS Mode to UEFI and enable Secure Boot.

Requirements to convert MBR to GPT

Make sure the following conditions are met before converting:

  • Windows 10 version 1703 or later
  • MBR disk has no more than three partitions
  • Operating system is 64-bit
  • BitLocker or any other encryption is turned off
  • No dual boot setup
  • BIOS supports UEFI mode
  • Secure Boot is disabled

Check out Microsoft's official step-by-step guide for this process.

How to convert MBR to GPT

  • Open Command Prompt as Administrator
    1. Press Windows Key, type cmd
    2. Right click Command Prompt and select Run as administrator
  • Validate the disk
    1. Type: mbr2gpt /validate /allowFullOS
    2. Press Enter
    3. If validation succeeds, you can continue
  • Convert the disk (This will shrink the system partition slightly and convert the disk to GPT)
    1. Type: mbr2gpt /convert /allowFullOS
    2. Press Enter
  • Reboot into UEFI mode
    1. Restart your PC
    2. Enter BIOS (using Advanced Restart or by pressing Del, F2, or F10 during boot)
    3. Change Boot Mode from Legacy to UEFI

Once Windows boots successfully, you can enable Secure Boot again.

Enabling Secure Boot

Before you begin, keep in mind that BIOS and UEFI settings vary depending on your hardware manufacturer. Adjusting these settings incorrectly can cause system issues. Always follow the official instructions provided by your PC or motherboard manufacturer when making changes. Riot is not responsible for any issues that may result from modifying your BIOS or UEFI settings.

Microsoft also has a general page on how to enable Secure Boot: https://support.microsoft.com/en-us/windows/windows-11-and-secure-boot-a8ff1202-c0d9-42f5-940f-843abef64fad

Step 1: Requirements before enabling Secure Boot

Make sure the following conditions are met:

  • BIOS Boot Mode is set to UEFI (not Legacy or CSM)
  • Disk Partition Style is GPT, not MBR
  • Secure Boot is enabled in your BIOS

The steps below outline what you may encounter during the process, but they are not a full set of instructions. Always refer to your PC or motherboard manufacturer’s official documentation for exact guidance.

Step 2: Access your BIOS or UEFI settings

  • Windows 11:
    Start > Settings > System > Recovery > Advanced startup > Restart Now
  • Windows 10:
    Start > Settings > Update and Security > Recovery > Advanced startup > Restart Now

After your PC restarts:

  1. Select Troubleshoot
  2. Go to Advanced options
  3. Select UEFI Firmware Settings

This will reboot your system into the BIOS interface.

Step 3: Locate Secure Boot Settings

  1. Navigate to the Boot tab inside BIOS
  2. If you cannot find Secure Boot, many BIOS interfaces have a built in search (often accessed with F9)
  3. Refer to your PC or motherboard documentation for model specific instructions
  4. Set Secure Boot (or Secure Boot State) to Enabled

Step 4: Save and Reboot

  1. Save your changes and exit BIOS (usually F10)
  2. Restart your PC normally

Step 5: Confirm Secure Boot is Enabled

Once you are back in Windows:

  1. Press Windows Key + R
  2. Type msinfo32
  3. Check Secure Boot State in the System Information window

Potential Issues

Secure Boot doesn't enable. You may need to update your BIOS.

If your BIOS Firmware requires updating, check out our How to Troubleshoot VAN: RESTRICTION article and follow the steps under Update BIOS Firmware (AMD/Intel)

Convert BIOS Boot Mode from Legacy to UEFI 

Step 1: Access the BIOS or UEFI firmware

You can enter BIOS in a few ways:

  • Use Advanced Restart
  • Or press Del, F2, or F10 during boot (this varies by motherboard)

If Windows launches normally, restart your PC and try again.

Step 2: Locate the Boot Mode setting

Once you're inside BIOS or UEFI:

  1. Open the Boot tab or section
    • This may also be under Advanced or Startup, depending on your manufacturer
  2. Look for a setting named Boot Mode, Boot Option, or UEFI/Legacy Boot

Step 3: Change Boot Mode to UEFI

If the setting shows Legacy, Legacy Only, or CSM, change it to:

  • UEFI
  • Or UEFI Only / UEFI First, depending on your options

If your system has a CSM setting, disable it.

Step 4: Enable Secure Boot

To turn it on:

  1. Go to the Security or Boot tab
  2. Find Secure Boot and set it to Enabled

If Secure Boot is greyed out, make sure:

  1. Boot Mode is set to UEFI
  2. Then save, reboot into BIOS again, and check the setting once more

Step 5: Save Changes and Exit

  1. Use the Save and Exit tab or press the save hotkey (usually F10)
  2. Choose Save Changes and Exit > Yes
  3. Your system will reboot in UEFI mode

Step 6: Confirm your settings in Windows

Once your PC boots back into Windows:

  1. Press Windows Key + R
  2. Type msinfo32 and press Enter
  3. Check the following:
  4. BIOS Boot Mode > should say UEFI
  5. Secure Boot State > should say On
Was this article helpful?