How to Check If Secure Boot Is Enabled

Here is how to check Secure Boot in under a minute: press Windows + R, type msinfo32, press Enter, and read the Secure Boot State line in System Information. If it says On, Secure Boot is enabled. If it says Off, your PC supports it but it is switched off in the firmware. If it says Unsupported, the PC is usually booting in legacy BIOS mode instead of UEFI.

What Is Secure Boot and Why Does It Matter?

Secure Boot is a firmware security feature that lets only trusted, digitally signed software load while your PC starts. It runs in UEFI, the modern firmware that replaced the old BIOS, before Windows itself loads.

The cause and effect is straightforward. Some of the most stubborn malware, known as bootkits and rootkits, hides in the startup process so it loads before your antivirus can see it. Secure Boot checks the signature of each startup component against a list of trusted certificates stored in the firmware, and refuses to run anything unsigned or tampered with. That closes the door before Windows even opens.

Secure Boot now matters for three practical reasons:

• Windows 11. The Windows 11 requirements include a UEFI PC that is Secure Boot capable.
• Games. Some anti-cheat systems need it. EA states that Secure Boot is a requirement to play Battlefield 6 on PC.
• Security features. BitLocker, Windows Hello and other protections work best on a PC with Secure Boot and TPM 2.0 both active.

How to Check Secure Boot in System Information (msinfo32)

System Information is the quickest and most reliable way to check Secure Boot, and it works on both Windows 10 and Windows 11. It is also the method Microsoft itself recommends.

1. Press Windows + R to open the Run box.
2. Type msinfo32 and press Enter.
3. Make sure System Summary is selected in the left pane.
4. In the right pane, find Secure Boot State.
5. On the same page, check BIOS Mode. It should say UEFI.

Use this table to read the result:

How to Check Secure Boot with PowerShell

PowerShell gives a simple True or False answer, which is handy for IT staff checking several PCs. Microsoft documents the Confirm-SecureBootUEFI cmdlet for this purpose.

1. Right-click the Start button and select Terminal (Admin) or Windows PowerShell (Admin). The command needs administrator rights.
2. Type Confirm-SecureBootUEFI and press Enter.
3. Read the result. True means Secure Boot is on. False means it is supported but off. The message "Cmdlet not supported on this platform" means the PC is in legacy BIOS mode or does not support Secure Boot.

How to Turn On Secure Boot in Windows 11 and Windows 10

If your Secure Boot State says Off and BIOS Mode says UEFI, you can turn Secure Boot on from the firmware settings in a few minutes. The steps to reach the firmware are the same for Windows 11 and Windows 10.

1. Save your work and close all apps.
2. Open Settings → System → Recovery (on Windows 10: Settings → Update & Security → Recovery).
3. Next to Advanced startup, select Restart now.
4. On the blue screen, choose Troubleshoot → Advanced options → UEFI Firmware Settings, then select Restart.
5. In the firmware menu, look for Secure Boot. It is usually under the Boot, Security or Authentication tab.
6. Set Secure Boot to Enabled. If the option is greyed out, look for a CSM or Legacy setting and disable it first, so the PC boots in UEFI-only mode.
7. Save changes and exit (often F10). Windows restarts.
8. Run msinfo32 again to confirm the state now says On.

Menu names differ by manufacturer. On many desktop motherboards, including Gigabyte, ASUS and MSI boards, the legacy option is labelled CSM Support, and Secure Boot may only appear once CSM is disabled. Check your motherboard or PC maker's manual if your menus look different. If BitLocker is on, have your recovery key ready before changing firmware settings, because firmware changes can trigger a BitLocker recovery prompt.

Why Does Secure Boot Say Unsupported?

"Unsupported" usually means Windows was installed and is booting in legacy BIOS mode, not that your hardware lacks Secure Boot. Secure Boot only works in UEFI mode, and UEFI mode needs the system disk to use the GPT partition style rather than the older MBR style.

That is the cause and effect behind most "unsupported" results on PCs built or upgraded in the 2010s. Windows was installed on an MBR disk in legacy mode, so switching the firmware straight to UEFI would leave the PC unable to boot. Microsoft provides the MBR2GPT tool, which converts the system disk to GPT without deleting data; afterwards you switch the firmware to UEFI and enable Secure Boot. Back up first, because the conversion cannot be undone.

If you are preparing an older PC for Windows 11, check TPM at the same time. Our guide on how to enable TPM 2.0 for Windows 11 uses the same firmware menus.

What Does "Secure Boot CA Keys Need to Be Updated" Mean?

It refers to Microsoft replacing the Secure Boot certificates that were first issued in 2011, which Microsoft says begin to expire in June 2026. These certificates are what the firmware uses to decide which startup software to trust.

For most home and small-business PCs on a supported version of Windows 10 or Windows 11 with automatic updates turned on, the new 2023 certificates arrive through Windows Update and no action is needed. Microsoft's guidance for home users says to keep Windows updates running and to confirm Secure Boot is on. A PC that no longer receives updates, such as Windows 10 without Extended Security Updates, will not get the new certificates, which is one more reason to move to a supported version.

A Common Mistake We See

A common mistake is enabling Secure Boot in the firmware, seeing the PC fail to start, and assuming the hardware is faulty. In most cases the PC was installed in legacy mode on an MBR disk, so turning on UEFI-only boot leaves Windows with nothing it can start from.

Undo the firmware change, check BIOS Mode in msinfo32 first, and convert the disk before trying again. Another frequent slip is changing firmware settings on a BitLocker-encrypted laptop without the recovery key to hand. Save the key to your Microsoft account or print it before you start.

Frequently Asked Questions

How do I check Secure Boot without restarting?

Press Windows + R, type msinfo32 and press Enter, then read the Secure Boot State line in System Information. No restart is needed. You can also run Confirm-SecureBootUEFI in an administrator PowerShell window, which returns True when Secure Boot is on and False when it is off.

How do I enable Secure Boot on Windows 10?

Open Settings → Update & Security → Recovery, select Restart now under Advanced startup, then choose Troubleshoot → Advanced options → UEFI Firmware Settings. In the firmware menu, set Secure Boot to Enabled, disable CSM or legacy boot if needed, save and restart. Confirm the change in msinfo32.

Do I need Secure Boot for Battlefield 6?

Yes. EA states that Secure Boot is a requirement to play Battlefield 6 on PC, because its anti-cheat system relies on it to block cheats that load during startup. Check msinfo32 before launching the game; if Secure Boot State says Off or Unsupported, enable it first.

Does Windows 11 require Secure Boot to be turned on?

Microsoft's requirement is that the PC is Secure Boot capable, meaning it uses UEFI firmware. Secure Boot does not strictly have to be switched on to upgrade, but Microsoft recommends turning it on for better security, and some apps and games now insist on it.

Will enabling Secure Boot delete my files?

No. Turning on Secure Boot only changes a firmware setting and does not touch your files. Problems arise only if Windows was installed in legacy mode, in which case the PC may not boot until you revert the setting or convert the disk to GPT. Back up important data before any firmware change.

Conclusion

Knowing how to check Secure Boot takes one command: run msinfo32 and read Secure Boot State. If it is On, you are set; if it is Off or Unsupported, the firmware steps above will fix it in most cases. Once your PC meets the requirements, a genuine Windows 11 Pro product key or any licence from our Windows 11 collection is delivered instantly by email.

Useful Links