Gigabyte Secure Boot: How to Enable It in BIOS

To turn on Gigabyte Secure Boot, press Delete at startup to open the BIOS, switch to Advanced Mode with F2, set Boot → CSM Support to Disabled, then open Boot → Secure Boot, restore the factory keys and save with F10. Before you start, Windows must already be installed in UEFI mode on a GPT disk, or the PC will not boot.

What Do You Need Before Enabling Gigabyte Secure Boot?

You need Windows installed in UEFI mode on a GPT-partitioned disk. Secure Boot is a UEFI feature that checks each piece of startup software against a list of trusted digital signatures, so it cannot work with the older legacy BIOS boot method.

Check this first in Windows. Press Windows + R, type msinfo32 and press Enter, then look at two lines in System Summary: BIOS Mode and Secure Boot State. Our guide on how to check if Secure Boot is enabled explains every reading in detail.

Microsoft's own Windows 11 and Secure Boot page notes that the Windows 11 upgrade check only needs the PC to be Secure Boot capable, meaning UEFI is turned on. Many games and security features, however, need Secure Boot actually enabled.

How Do You Enable Secure Boot in a Gigabyte BIOS?

You enable Secure Boot on a Gigabyte motherboard by disabling CSM, then installing the factory Secure Boot keys. The steps below follow Gigabyte's own support guidance; exact labels vary a little between boards and BIOS versions.

1. Restart the PC and press Delete repeatedly while the Gigabyte or Aorus logo shows. If Windows is running, you can instead go to Settings → System → Recovery → Advanced startup → Restart now, then Troubleshoot → Advanced options → UEFI Firmware Settings → Restart. Our guide on how to access BIOS in Windows 11 covers both routes.
2. If you see the simplified Easy Mode screen, press F2 to switch to Advanced Mode.
3. Open the Boot tab and set CSM Support to Disabled. The Secure Boot entry now appears or becomes selectable.
4. Select Boot → Secure Boot. If your board shows a Secure Boot switch, set it to Enabled.
5. Set Secure Boot Mode to Custom, as Gigabyte's guide instructs, so the key options become available.
6. Select Restore Factory Keys and confirm with Yes when asked to install the factory defaults. If a second prompt asks about resetting without saving, confirm with Yes again. The PC restarts.
7. Enter the BIOS again and check that the Secure Boot status reads Enabled or Active. Press F10 to save and exit if you changed anything else.
8. Back in Windows, run msinfo32 again and confirm Secure Boot State shows On.

Gigabyte's official Secure Boot and TPM 2.0 FAQ shows these screens for its AM4 boards, and the same Boot-tab layout applies to most current Gigabyte desktop boards.

Why Is Secure Boot Greyed Out or Missing on a Gigabyte Motherboard?

The usual cause is that CSM Support is still enabled. Gigabyte's manuals state that the Secure Boot item can only be configured when CSM Support is set to Disabled, and on many boards CSM ships enabled by default.

The cause and effect is straightforward. CSM (Compatibility Support Module) lets the board boot older operating systems the legacy way, and legacy booting cannot verify signatures, so the BIOS hides or locks Secure Boot while CSM is on. Turning CSM off switches the board to pure UEFI booting, and only then can Secure Boot check the boot loader.

If the option is still missing with CSM disabled, update the BIOS from your board's support page on Gigabyte's website, then load optimised defaults and try again. Older BIOS versions on some boards expose fewer Secure Boot controls.

What If Windows Is Installed in Legacy Mode on an MBR Disk?

Convert the system disk from MBR to GPT before you disable CSM, otherwise Windows will not find a UEFI boot loader and the PC will not start. Microsoft includes a tool for this, MBR2GPT, that converts the disk without deleting your files.

1. Back up important files. The conversion changes the partition layout and cannot be undone.
2. If BitLocker or device encryption is on, suspend it first.
3. Open Command Prompt as administrator.
4. Run mbr2gpt /validate /allowFullOS. If validation fails, the tool stops and nothing changes.
5. If validation succeeds, run mbr2gpt /convert /allowFullOS.
6. Restart, enter the Gigabyte BIOS and set CSM Support to Disabled, then follow the Secure Boot steps above.

MBR2GPT needs a disk with no more than three primary partitions and no extended partitions. If it refuses your layout, a clean install in UEFI mode is the alternative.

Do You Also Need TPM 2.0 for Windows 11 and Anti-Cheat Games?

For Windows 11, yes: TPM 2.0 is a separate requirement from Secure Boot, and both live in the same BIOS. TPM (Trusted Platform Module) is a security chip, or a firmware version built into the CPU, that stores encryption keys and records whether the startup process was tampered with.

On Gigabyte AMD boards, Gigabyte's FAQ places the setting at Settings → AMD CPU fTPM, which you set to Enabled. On Intel boards the equivalent is Intel Platform Trust Technology (PTT), usually found under the Settings tab. Our step-by-step guide to enabling TPM 2.0 for Windows 11 covers both platforms.

Some online games check Secure Boot directly. Riot's support site explains that the Valorant error VAN 9003 means Secure Boot is not enabled, which its Vanguard anti-cheat requires. EA states that Secure Boot is a requirement to play Battlefield 6 on PC. Our article on Call of Duty's TPM 2.0 and Secure Boot requirements explains why anti-cheat systems rely on these features.

Do Secure Boot CA Keys Need to Be Updated?

Yes, but on most PCs this happens automatically through Windows Update. Microsoft's original Secure Boot certificates from 2011 began expiring in June 2026, and Microsoft is replacing them with a newer set issued in 2023.

According to Microsoft's page on what happens when Secure Boot certificates expire, devices keep starting normally, but a device without the new certificates can no longer receive new boot-level protections. Some PCs also need a firmware update from the manufacturer before the new certificates apply correctly. On a Gigabyte board, that means installing the latest BIOS for your exact model. Microsoft also advises against turning Secure Boot off to work around expiry.

A Common Mistake We See

The mistake we see most is disabling CSM and enabling Secure Boot on a PC whose Windows was installed in legacy mode. The board then finds no UEFI boot loader and shows a "no bootable device" style message, which looks alarming but is easy to reverse.

Go back into the BIOS, set CSM Support to Enabled and save; Windows will boot as before. Then check msinfo32, convert the disk with MBR2GPT if needed, and try again. Also have your BitLocker recovery key to hand before changing firmware security settings, because Windows can ask for it after Secure Boot changes. If you are reinstalling to fix a legacy setup, a Windows 11 Pro licence from us is a genuine product key with instant email delivery, a 30-day money-back guarantee and support team help with activation.

Frequently Asked Questions

Where is Secure Boot in a Gigabyte BIOS?

Secure Boot is under the Boot tab in Advanced Mode. Press Delete at startup, press F2 if you see Easy Mode, then open Boot. If you don't see the Secure Boot entry, set CSM Support to Disabled first; Gigabyte only lets you configure Secure Boot once CSM is off.

How do I turn on UEFI Secure Boot for Windows 11?

Confirm Windows runs in UEFI mode by checking BIOS Mode in msinfo32. Then enter your motherboard's firmware settings, disable CSM or legacy boot, enable Secure Boot and install the default or factory keys. Save, restart and confirm Secure Boot State shows On. Most boards follow this order.

How do I enable Secure Boot on Windows 10?

The BIOS steps are the same as for Windows 11, because Secure Boot is a firmware setting rather than a Windows one. Windows 10 must be installed in UEFI mode on a GPT disk. Our guide on how to enable Secure Boot in Windows 10 covers the full process.

How do I fix the Valorant Secure Boot error on a Gigabyte PC?

Error VAN 9003 means Secure Boot is off. Check msinfo32: if BIOS Mode is UEFI, enter the Gigabyte BIOS, disable CSM Support, restore factory keys under Boot → Secure Boot and save. If BIOS Mode is Legacy, convert the disk with MBR2GPT first, then enable Secure Boot.

Why does Battlefield 6 say Secure Boot is required?

EA requires Secure Boot to play Battlefield 6 on PC because its anti-cheat relies on the PC starting only trusted, signed software. If you see the prompt, enable Secure Boot in your BIOS using the steps above, then restart Windows and check that Secure Boot State shows On.

Will enabling Secure Boot delete my files?

No. Enabling Secure Boot changes a firmware setting and does not touch your files. The risk is a PC that won't boot if Windows was installed in legacy mode, which you fix by re-enabling CSM. Converting the disk with MBR2GPT also keeps files, but back up first.

Conclusion

Gigabyte Secure Boot takes a few minutes to enable once Windows runs in UEFI mode: disable CSM, restore the factory keys under Boot → Secure Boot, save and confirm in msinfo32. Keep your BIOS updated so the newer Secure Boot certificates apply cleanly. If you are building or rebuilding a PC, browse our Windows 11 product keys for a genuine licence.

Useful Links