How to Enable Secure Boot in Windows 11? [Complete Steps]
Secure Boot is a firmware-level security feature that operates through the UEFI system firmware rather than the Windows operating system itself. Because of this, you cannot simply enable it inside normal Windows settings. Instead, you must access your computer’s firmware configuration panel, commonly known as BIOS or UEFI settings.
Before enabling Secure Boot, there are a few requirements that your system must meet. Your computer must use UEFI firmware instead of Legacy BIOS mode. The system disk must typically be formatted using the GPT partition style instead of MBR. Most modern computers already meet these requirements, especially those designed for Windows 11.
Once you confirm these conditions, the process of enabling Secure Boot involves entering the Advanced Startup environment, navigating to the UEFI firmware settings, and activating Secure Boot within the firmware interface.
In this guide, you will learn what Secure Boot is, why it matters, and how to enable Secure Boot in Windows 11 step by step.
How to Enable Secure Boot in Windows 11?
To enable Secure Boot in Windows 11, open the UEFI firmware settings from the Windows recovery menu, access the BIOS or UEFI setup, locate the Secure Boot option, switch it to Enabled, and save the changes before restarting the computer.
Below is a complete explanation to help you enable Secure Boot safely.
Step 1: Check If Your System Supports Secure Boot
Before enabling Secure Boot, you should verify whether your computer supports it. Most modern computers manufactured after 2015 include this feature, but it is always good to confirm.
Press Windows + R on your keyboard to open the Run dialog box. Type msinfo32 and press Enter. This will open the System Information window.
Inside this window, look for the entry called Secure Boot State. If it says Off, it means Secure Boot is supported but currently disabled. If it says On, Secure Boot is already enabled, and you do not need to change anything.
You should also check the BIOS Mode entry. If it displays UEFI, your system is ready for Secure Boot. If it shows Legacy, Secure Boot cannot be enabled until the system is converted to UEFI mode.
Confirming these details first prevents configuration errors later in the process.
Step 2: Open Windows Recovery Settings
To access firmware settings, you must restart your computer into the Windows Recovery Environment.
Click the Start menu and open Settings. Inside the Settings window, select System and then navigate to Recovery.
Under the Recovery section, you will find the option called Advanced Startup. Click the Restart Now button next to it. Windows will notify you that the device will restart into a special troubleshooting mode.
Once you confirm, the computer will restart and display the Advanced Startup menu. This menu provides several recovery and troubleshooting tools, including access to firmware configuration settings.
This step is necessary because firmware options cannot be changed while Windows is running normally.
Step 3: Access UEFI Firmware Settings
After the computer restarts, you will see the Choose an Option screen.
Select Troubleshoot from the available options. On the next screen, choose Advanced Options.
Inside the Advanced Options menu, locate and select UEFI Firmware Settings. This option allows you to enter the motherboard firmware configuration panel.
Click Restart, and your computer will reboot again. This time, instead of loading Windows, it will open the UEFI or BIOS setup interface.
The appearance of this interface depends on your computer manufacturer. However, most systems organize settings into categories such as Boot, Security, or Advanced.
Step 4: Locate the Secure Boot Setting
Once you enter the UEFI setup interface, you must locate the Secure Boot configuration.
Navigate through the firmware tabs until you find a section related to Boot, Security, or Authentication. In many systems, the Secure Boot option is placed under the Boot menu.
Look for the setting labeled Secure Boot or Secure Boot Control. The current status will usually show Disabled if it is not active.
Firmware interfaces can vary significantly depending on the motherboard brand, but the Secure Boot option is usually easy to identify once you open the appropriate section.
Take a moment to carefully review the setting before making changes to avoid accidental configuration issues.
Step 5: Enable Secure Boot
After locating the Secure Boot option, select it using your keyboard or mouse.
Change the setting from Disabled to Enabled. Some systems may require you to select Standard Mode or Install Default Secure Boot Keys before the feature becomes active.
These default keys allow the firmware to verify trusted bootloaders such as Windows. Installing the default keys ensures the system recognizes legitimate operating system components.
Once Secure Boot is enabled, the firmware will restrict startup programs that are not digitally verified by trusted authorities. This significantly reduces the risk of boot-level malware.
Make sure the configuration displays Secure Boot Enabled before moving to the next step.
Step 6: Save Changes and Exit Firmware
After enabling Secure Boot, you must save the configuration before exiting the firmware interface.
Locate the option labeled Save and Exit, which is usually available at the bottom of the screen or under the Exit menu. Select this option and confirm the changes.
The system will restart automatically and load Windows 11 normally.
Once Windows starts again, the Secure Boot configuration will remain active, and the firmware will begin verifying trusted boot components during every startup.
Step 7: Verify That Secure Boot Is Enabled
After returning to Windows, it is a good idea to verify that the feature is working properly.
Open the Run dialog box again by pressing Windows + R. Type msinfo32 and press Enter to open System Information.
Look again for the entry called Secure Boot State. It should now display On. This confirms that Secure Boot has been successfully enabled on your system.
If the status still shows Off, it may indicate that the firmware settings were not saved correctly or that the system is still operating in Legacy mode.
Verifying the status ensures that your system security configuration is functioning as intended.
FAQs
What is Secure Boot in Windows 11?
Secure Boot is a firmware-based security feature that ensures only trusted and digitally signed software is allowed to load during the computer startup process. It protects the system from boot-level malware and unauthorized modifications.
Why does Windows 11 require Secure Boot?
Windows 11 uses Secure Boot as part of its modern security architecture. It helps protect the operating system from rootkits and low-level attacks that occur before Windows fully loads.
Can I enable Secure Boot on older computers?
Some older systems may not support Secure Boot because they use Legacy BIOS instead of UEFI firmware. In such cases, enabling Secure Boot may not be possible without upgrading the hardware.
Does Secure Boot affect performance?
No, Secure Boot does not significantly impact system performance. Its verification process occurs during startup and typically adds only a small amount of time to the boot sequence.
Can Secure Boot be disabled later?
Yes, Secure Boot can be disabled from the UEFI firmware settings if necessary. However, disabling it may reduce system security and could prevent certain Windows 11 features from functioning properly.
Summary
Secure Boot is an essential security feature designed to protect modern computers from malicious software that attempts to load during the startup process. Verifying trusted digital signatures for boot components, it ensures that only legitimate operating systems and drivers are allowed to run.
Enabling Secure Boot in Windows 11 requires accessing the UEFI firmware settings rather than changing options within the operating system itself. The process involves checking system compatibility, opening the Advanced Startup environment, entering the UEFI setup, activating the Secure Boot setting, and saving the configuration.
Once enabled, Secure Boot becomes an important layer of protection that strengthens the overall security of your computer. It helps defend against rootkits, boot sector viruses, and other low-level threats that could compromise your system before Windows even loads.