How to Turn On Secure Boot in Windows 11

To turn on Secure Boot in Windows 11, restart into your PC’s UEFI (BIOS) settings, find Secure Boot on the Boot or Security tab, set it to Enabled, and save with F10. Before you do, press Windows key + R, type msinfo32, and check that BIOS Mode says UEFI. If it says Legacy, the disk must be converted to GPT first or Windows won’t start with Secure Boot on. Steps for both, plus Valorant and Gigabyte-specific notes, are below.

Step 1: Check the current status

1. Press Windows key + R, type msinfo32 and press Enter.
2. With System Summary selected, look at BIOS Mode and Secure Boot State.

BIOS Mode	Secure Boot State	What to do
UEFI	On	Nothing. Secure Boot is already on
UEFI	Off	Go to Step 2
Legacy	Unsupported	Convert the disk to GPT first (see below), then Step 2

Step 2: Open the UEFI settings

1. Save your work.
2. Go to Settings > System > Recovery and click Restart now next to Advanced startup.
3. Choose Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.

Or press the setup key while the PC starts: often F2 or Delete (Dell, Acer, ASUS, MSI, Gigabyte), F10 (HP) or F1/F2 (Lenovo). More in how to enter BIOS (UEFI) in Windows 11.

Step 3: Enable Secure Boot

Menus differ by manufacturer, but the steps are similar:

1. Switch to Advanced Mode if your BIOS opens in an easy mode (often F7).
2. Open the Boot tab (or Security or Authentication).
3. If you see CSM (Compatibility Support Module) or Legacy support, set it to Disabled. Secure Boot is greyed out until CSM is off.
4. Set Secure Boot to Enabled. If there’s a Secure Boot Mode, choose Standard.
5. If Secure Boot won’t turn on, look for Restore Factory Keys or Install default Secure Boot keys and confirm.
6. Press F10 to save and exit.

Windows starts normally. Run msinfo32 again to confirm Secure Boot State is On.

If BIOS Mode says Legacy: convert to GPT

Secure Boot needs UEFI boot, which needs a GPT disk. Windows includes a tool to convert without losing data, but back up first:

1. Open Terminal or Command Prompt as administrator.
2. Run mbr2gpt /validate /allowFullOS. If it reports success, continue.
3. Run mbr2gpt /convert /allowFullOS.
4. Restart into the BIOS, change boot mode from Legacy/CSM to UEFI, enable Secure Boot as in Step 3, and save.

If you change the boot mode without converting the disk, Windows won’t start. Switch the setting back to Legacy to recover.

Gigabyte motherboards

Press Delete at startup, then F2 for Advanced Mode. On the Boot tab, set CSM Support to Disabled, then open Secure Boot and set it to Enabled. On some boards you’ll need to choose Restore Factory Keys first. Older Gigabyte boards may show a Windows 8/10 Features option: set it to Windows 8/10 (WHQL) to reveal Secure Boot. Press F10 to save.

Secure Boot for Valorant

Riot’s Vanguard anti-cheat requires Secure Boot and TPM 2.0 on Windows 11. If Valorant shows a VAN error mentioning Secure Boot or TPM (such as VAN 9001 or VAN 9003), enable Secure Boot as above, then check TPM with tpm.msc: it should say “The TPM is ready for use” with Specification Version 2.0. Restart the PC afterwards so Vanguard can start. See how to check and enable TPM.

Keep Secure Boot certificates up to date

Microsoft’s original Secure Boot certificates from 2011 begin expiring in 2026, and Windows Update is installing newer replacements. Keep Windows Update and your PC’s BIOS current so Secure Boot keeps working. Your PC maker’s support site lists BIOS updates.

Troubleshooting

Secure Boot is greyed out

CSM or Legacy boot is still on, or the BIOS needs a supervisor password set first on some laptops. Disable CSM, or set a BIOS password, enable Secure Boot, then remove the password.

“Secure Boot State: Off” after enabling it

The keys aren’t installed. In the BIOS, choose Restore Factory Keys or Install default keys, then save.

The PC won’t boot after enabling it

An unsigned driver or old graphics card firmware may be blocking startup. Disable Secure Boot again to get back in, update the BIOS and graphics card firmware, and retry.

Frequently asked questions

Is it safe to turn on Secure Boot?

Yes, on a UEFI/GPT system. It blocks unsigned bootloaders and some rootkits. Linux dual-boot setups usually still work with signed distributions.

How do I turn it off?

Set Secure Boot to Disabled in the same menu. See how to turn off Secure Boot in Windows 11. For Windows 10, see how to turn on Secure Boot in Windows 10.

Summary

1. Run msinfo32 and check BIOS Mode is UEFI.
2. Restart into UEFI Firmware Settings.
3. Disable CSM and set Secure Boot to Enabled.
4. Save with F10 and confirm Secure Boot State is On.