Disable Secure Boot in Windows 11/10
Secure Boot is a security feature that helps protect your computer from malicious software that tries to load before Windows starts. You may need to turn it off to install certain operating systems, use specific hardware, or troubleshoot compatibility problems.
Before disabling Secure Boot, make sure you understand why you need to turn it off. It provides an important layer of protection, and turning it off can make your computer less secure.
The steps below explain how to check your current Secure Boot status, enter your computer’s UEFI firmware settings, disable Secure Boot, and turn it back on when you’re finished.
Let’s learn all of this in detail!
Disable Secure Boot in Windows 11/10
To disable Secure Boot in Windows 11 or Windows 10, open Settings > System > Recovery > Advanced startup, then select Restart now. Choose Troubleshoot > Advanced options > UEFI Firmware Settings > Restart. In your computer’s UEFI settings, find Secure Boot, change it to Disabled, and save your changes.
The exact menu names vary by manufacturer.
1: Check Whether Secure Boot Is Enabled
Before making any changes, check whether Secure Boot is currently enabled on your computer.
Press Windows + R to open the Run dialog box. Type msinfo32 and press Enter.
The System Information window will open. Select System Summary on the left, then look for Secure Boot State on the right.
If the status says On, Secure Boot is enabled. If it says Off, it’s already disabled.
You can also check the BIOS Mode entry. If it says UEFI, your computer is using the firmware mode required for Secure Boot.
If BIOS Mode says Legacy, Secure Boot may not be available in your current configuration. Don’t change your boot mode just to disable Secure Boot, because doing so can prevent Windows from starting.
2: Prepare Your Computer Before Disabling Secure Boot
Before changing firmware settings, save your work and close any open applications. Your computer will restart, and you may lose unsaved changes.
If your computer uses BitLocker or Device Encryption, make sure you have your recovery key available. Changing Secure Boot settings can trigger a BitLocker recovery prompt during startup.
To check your encryption status, open Settings and look for Device encryption or BitLocker drive encryption.
If BitLocker is enabled, save your recovery key somewhere you can access it even if Windows won’t start. You may be able to find it in your Microsoft account or through your organization’s IT department.
For additional protection, you can temporarily suspend BitLocker before making the firmware change. Resume protection after Windows starts normally again.
Step 3: Open UEFI Firmware Settings From Windows
The easiest way to access Secure Boot is through Windows Advanced Startup.
In Windows 11, open Settings > System > Recovery. Under Advanced startup, select Restart now.
In Windows 10, open Settings > Update & Security > Recovery. Under Advanced startup, click Restart now.
Your computer will restart and display the Windows Recovery Environment.
Select Troubleshoot > Advanced options > UEFI Firmware Settings.
Click Restart to enter your computer’s firmware setup.
If you don’t see UEFI Firmware Settings, your computer may be using Legacy BIOS mode, or the manufacturer may provide a different way to access firmware settings.
4: Find the Secure Boot Option
Once your computer opens the firmware setup screen, you’ll see a menu that looks different from the regular Windows desktop.
Use the keyboard arrow keys or your mouse, if supported, to navigate the menus.
Look for a tab or section named Security, Boot, Authentication, or Secure Boot. The exact location depends on your computer’s manufacturer and firmware version.
For example, some computers place Secure Boot under the Security tab, while others list it directly under Boot.
If you cannot find the option, check your computer manufacturer’s documentation. Avoid changing unrelated settings while you’re in the firmware menu.
5: Disable Secure Boot
Once you locate the Secure Boot setting, select it and look for an option to change its status.
If Secure Boot is currently enabled, change the setting to Disabled.
Some firmware menus may require you to select a Secure Boot Mode or confirm a warning before the change can be applied. Follow the instructions displayed on your screen.
Do not clear Secure Boot keys or reset firmware security settings unless your manufacturer specifically instructs you to do so. Disabling Secure Boot does not normally require deleting the trusted keys stored in firmware.
If the option is grayed out, your computer may require an administrator password, a different firmware mode, or a manufacturer-specific procedure.
6: Save Your Changes and Restart
After disabling Secure Boot, save your changes and exit the firmware setup.
Look for an option such as Save Changes and Exit, Save & Exit, or a similar command. Some computers use the F10 key to save and exit, but this varies by manufacturer.
Confirm the change if a warning appears.
Your computer will restart and attempt to load Windows. If everything is configured correctly, you should return to the Windows desktop.
If Windows asks for your BitLocker recovery key, enter the correct key to continue.
7: Verify That Secure Boot Is Disabled
After Windows starts, check whether the change was successful.
Press Windows + R, type msinfo32, and press Enter.
In System Information, look for Secure Boot State. It should now say Off.
If it still says On, the change may not have been saved, or your computer may have a firmware setting that overrides the option you selected.
Return to the firmware settings and review the Secure Boot configuration. If the option is missing or unavailable, consult your manufacturer’s support documentation.
Re-Enable Secure Boot After You’re Finished
Once you’ve completed the task that required Secure Boot to be disabled, it’s a good idea to turn it back on.
Return to your computer’s UEFI firmware settings using the same Advanced Startup procedure described earlier.
Find the Secure Boot option and change it to Enabled.
Save your changes and restart the computer. After Windows loads, open System Information and confirm that Secure Boot State says On.
If Windows fails to start after re-enabling Secure Boot, return to the firmware settings and temporarily disable it again. Check your manufacturer’s support instructions before making further changes.
FAQs
1. Is it safe to disable Secure Boot?
Disabling Secure Boot removes an important layer of startup protection. It may be necessary for certain hardware or operating systems, but you should turn it back on when you’re finished.
2. Can I disable Secure Boot without entering BIOS?
No. Secure Boot is controlled by your computer’s UEFI firmware. Windows lets you restart directly into the firmware settings, but you still need to change the option there.
3. Why is Secure Boot grayed out?
Your computer may require an administrator password, a different firmware configuration, or a manufacturer-specific procedure. Check your PC manufacturer’s documentation before changing other firmware settings.
4. Will disabling Secure Boot delete my files?
Disabling Secure Boot doesn’t normally delete your personal files. However, changing firmware settings can trigger BitLocker recovery or cause startup problems if other settings are changed incorrectly.
5. Does Windows 11 require Secure Boot to be enabled?
Windows 11 requires a PC that is Secure Boot capable, but it does not always require Secure Boot to be enabled. Keeping it enabled is recommended for better startup security.
Summary
Disabling Secure Boot in Windows 11 or Windows 10 requires you to enter your computer’s UEFI firmware settings and change the Secure Boot option to Disabled.
Start by checking your current Secure Boot status, preparing your BitLocker recovery key, and opening Advanced Startup. Then locate the Secure Boot setting, disable it, and save your changes.
After completing your task, re-enable Secure Boot to restore the additional protection it provides during startup.