How to Enable Secure Boot in Windows 10

Here is how to enable Secure Boot on Windows 10: confirm Windows boots in UEFI mode from a GPT disk, restart into your PC's UEFI firmware settings, switch off Legacy/CSM boot, set Secure Boot to Enabled, then save and restart. If Windows was installed in Legacy BIOS mode, convert the disk to GPT with Microsoft's MBR2GPT tool first, or the PC won't start.

What Is Secure Boot and Why Enable It?

Secure Boot is a UEFI firmware feature that only allows bootloaders and drivers signed with trusted keys to run when the PC starts. Its purpose is to stop bootkits and rootkits, malware that loads before Windows and hides from antivirus software.

The cause and effect is straightforward: if a bootloader has been tampered with, its signature no longer matches, so the firmware refuses to run it and the attack fails before Windows loads. Secure Boot is also a Windows 11 requirement, and some games' anti-cheat systems now check for it. Because UEFI (Unified Extensible Firmware Interface) replaced the old BIOS, Secure Boot only works when the PC boots in UEFI mode, not in Legacy or CSM (Compatibility Support Module) mode.

Is Secure Boot On in Windows 10? How to Check First

You can check in under a minute with System Information, which shows both your BIOS mode and Secure Boot state.

1. Press Windows + R, type msinfo32 and press Enter.
2. Select System Summary.
3. Look at BIOS Mode: it should say UEFI. If it says Legacy, read the MBR2GPT section below before changing anything.
4. Look at Secure Boot State: On means it's already enabled; Off means the PC supports it but it's turned off; Unsupported usually means Legacy boot or very old hardware.

Our guide on how to check if Secure Boot is enabled covers more methods, including PowerShell. Use this table to decide what to do next.

How to Enable Secure Boot in Windows 10 (UEFI Mode)

If BIOS Mode already shows UEFI, enabling Secure Boot is a firmware setting change and takes a few minutes. Menu names vary by manufacturer, but the path is similar on most PCs.

1. If BitLocker or device encryption is on, have your 48-digit recovery key to hand; firmware changes can trigger a recovery prompt.
2. Open Settings → Update & Security → Recovery and, under Advanced startup, select Restart now. (Alternatively, hold Shift while selecting Restart.)
3. Choose Troubleshoot → Advanced options → UEFI Firmware Settings, then select Restart. You can also press the setup key at power-on, commonly F2, F10, F12, F1 or Del.
4. In the firmware menu, find the Boot tab and make sure CSM or Legacy Support is Disabled and boot mode is UEFI.
5. Go to the Security, Boot or Authentication tab and set Secure Boot to Enabled.
6. If the option is greyed out or the state stays in "Setup Mode", choose the option to Restore Factory Keys or Install default Secure Boot keys (on some boards, set OS Type to Windows UEFI mode).
7. Press F10 or choose Save & Exit. The PC restarts into Windows.
8. Run msinfo32 again and confirm Secure Boot State now shows On.

Microsoft's firmware documentation on disabling and re-enabling Secure Boot notes that if Secure Boot won't turn on, resetting the firmware to factory settings often helps, and if the PC then fails to boot you can disable it again and contact the manufacturer.

Can I Enable Secure Boot After Installing Windows?

Yes, you can enable Secure Boot after installing Windows 10, as long as Windows is installed in UEFI mode on a GPT disk. If it was installed in Legacy mode on an MBR disk, you can convert the disk in place with MBR2GPT, Microsoft's built-in conversion tool, without reinstalling or losing files.

MBR (Master Boot Record) and GPT (GUID Partition Table) are two ways of laying out a disk. UEFI boots from GPT; Legacy BIOS boots from MBR. That is why switching off CSM on an MBR system leaves you with a "no bootable device" error: the firmware is now looking for a GPT layout that doesn't exist.

1. Back up important files to an external drive or cloud storage.
2. If BitLocker is on, suspend it in Control Panel → BitLocker Drive Encryption → Suspend protection.
3. Open Command Prompt as administrator.
4. Run mbr2gpt /validate /allowFullOS. If validation fails, the disk doesn't meet the requirements (for example, more than three primary partitions or an extended partition) and nothing is changed.
5. If validation passes, run mbr2gpt /convert /allowFullOS. The tool creates an EFI system partition and converts the disk.
6. Restart into the firmware settings, set boot mode to UEFI, disable CSM/Legacy, then enable Secure Boot as described above.
7. Boot into Windows and check msinfo32. If you suspended BitLocker, Microsoft advises deleting and recreating its protectors before resuming.

Microsoft's MBR2GPT documentation lists every validation check. If the conversion isn't possible, a clean install in UEFI mode is the alternative; our guide to reinstalling Windows with a USB drive covers it.

Why Is Secure Boot Enabled but Not Active in Windows 10?

When the firmware shows Secure Boot as Enabled but Windows reports it as Off, the usual cause is that no Secure Boot keys are installed, so the firmware is in "Setup Mode" and can't enforce signatures.

Other common causes are CSM still being on, the drive being in MBR format, or Secure Boot set to a "Custom" or "Other OS" mode. Fix it by loading the factory default keys, disabling CSM and checking BIOS Mode shows UEFI. If those settings look correct and it is still inactive, a firmware update from your PC or motherboard manufacturer is the next step.

What Is the Windows 10 Secure Boot Certificate Update?

Microsoft is replacing the Secure Boot certificates issued in 2011, which began expiring in June 2026, with new 2023 certificates delivered through Windows Update. Microsoft says devices that don't receive them will stop getting future security fixes for the Windows boot manager and Secure Boot, weakening startup protection.

For Windows 10, which reached end of support on 14 October 2025, these updates come through the Extended Security Updates (ESU) programme; consumer ESU now runs until 12 October 2027. Microsoft's Secure Boot guidance for home users says most people need to do nothing if updates aren't paused and Secure Boot is on. Our Windows 10 ESU guide explains enrolment.

A Common Mistake We See

A common mistake is disabling CSM and enabling Secure Boot on a PC that was installed in Legacy mode, then panicking when it shows "no bootable device". Nothing is lost: re-enable CSM, boot into Windows, run MBR2GPT and try again. The other frequent issue is a BitLocker recovery prompt after a firmware change, which is why keeping the recovery key from your Microsoft account handy matters.

Many people enable Secure Boot as a step towards Windows 11, so it's worth also checking TPM at the same time; see our guide to enabling TPM 2.0. Our support team can help with activation if Windows asks after a firmware change.

Frequently Asked Questions

Is Secure Boot on by default in Windows 10?

On most PCs sold with Windows 10 or later, yes, Secure Boot is enabled at the factory. It is commonly off on self-built PCs, older machines upgraded from Windows 7, or systems installed in Legacy BIOS mode. Check Secure Boot State in msinfo32 to see your current setting.

Will enabling Secure Boot delete my files?

No. Enabling Secure Boot only changes a firmware setting and does not touch your data. Converting an MBR disk with MBR2GPT also preserves files, although Microsoft recommends a backup first. The main risk is a temporary boot failure if the disk isn't GPT, which you can reverse in firmware.

How do I disable Secure Boot in Windows 10?

Restart into UEFI Firmware Settings from Settings → Update & Security → Recovery → Advanced startup, open the Security or Boot tab, set Secure Boot to Disabled, then save and exit. Only disable it when needed, for example for unsigned hardware or another operating system, and turn it back on afterwards.

Why can't I enable Secure Boot in my BIOS?

The option is usually greyed out because CSM/Legacy boot is still on, no Secure Boot keys are loaded, or a supervisor password is required. Disable CSM, restore the factory default keys and set an administrator password if your firmware asks. Very old firmware may need an update from the manufacturer.

Do I need Secure Boot for Windows 11?

Windows 11 requires a PC that is Secure Boot capable with UEFI firmware, alongside TPM 2.0. Enabling it also satisfies anti-cheat checks in some games. See our Windows 11 requirements checklist for the full list before you upgrade.

Conclusion

Knowing how to enable Secure Boot on Windows 10 comes down to two things: boot in UEFI mode from a GPT disk, then switch Secure Boot on in the firmware. With Windows 10 on extended updates only, keeping Secure Boot on protects the startup process on the PCs you still run. If you need to reinstall or license a Windows 10 PC, browse our Windows 10 licences.

Useful Links