What Is Secure Boot? How It Works, Why It Matters, and How to Check or Enable It in Windows 11

Quick Answer

Secure Boot is a security feature built into modern UEFI firmware that helps prevent unauthorized or malicious software from loading before the operating system starts.

When a computer boots, Secure Boot verifies the digital signatures of important boot components. Trusted and properly signed software is allowed to run, while software that is untrusted, modified, revoked, or otherwise fails Secure Boot validation can be blocked.

Secure Boot is especially useful for protecting computers against bootkits, rootkits, tampered bootloaders, and other attacks that attempt to execute before Windows security software is fully running.

On Windows, you can quickly check its status by pressing Windows + R, entering:

msinfo32

and looking for:

Secure Boot State: On

For most modern Windows 11 computers, Secure Boot should normally remain enabled unless there is a specific compatibility or troubleshooting reason to disable it.

Complete Article

What Is Secure Boot?

Secure Boot is a security standard that forms part of the Unified Extensible Firmware Interface (UEFI) architecture used by modern computers.

Unlike security software that starts after Windows has loaded, Secure Boot operates much earlier in the startup process.

When you turn on a Secure Boot-enabled computer, the UEFI firmware checks the authenticity of software involved in starting the computer before allowing it to execute.

This can include:

• UEFI firmware drivers
• Option ROMs
• EFI applications
• Operating-system bootloaders
• Other pre-boot components

The firmware verifies these components using cryptographic signatures and trusted certificates.

If the component is trusted and its signature is valid, the startup process can continue. If it has been modified, revoked, or isn't trusted according to the system's Secure Boot policy, the firmware can prevent it from running.

This creates an important security boundary before Windows itself starts.

Microsoft describes Secure Boot as part of the protection chain that helps prevent malware and corrupted components from loading during Windows startup.

Why Is Secure Boot Important?

Traditional antivirus and endpoint-security software primarily protects a computer once the operating system and its security components begin loading.

Attackers can therefore gain a significant advantage if malicious software executes before the operating system.

One particularly dangerous category is a bootkit or rootkit designed to interfere with the startup process.

Malware operating at this level may potentially:

• Start before Windows security software
• Modify the operating-system boot process
• Hide malicious components
• Interfere with security controls
• Persist across normal Windows restarts
• Make detection and removal more difficult

Secure Boot helps reduce this risk by establishing a chain of trust starting from the computer's UEFI firmware.

Microsoft specifically identifies Secure Boot as protection against sophisticated malware such as rootkits that attempt to load during startup.

How Does Secure Boot Work?

Secure Boot uses digital signatures, certificates, cryptographic hashes, and firmware-maintained trust databases.

A simplified startup process looks like this:

Power On → UEFI Firmware → Secure Boot Verification → Trusted Bootloader → Windows Boot Process → Windows

When the computer starts, UEFI checks software that needs to execute during the pre-boot environment.

1. The computer powers on

UEFI firmware initializes the computer hardware and begins the startup process.

2. Secure Boot checks pre-boot software

The firmware evaluates relevant boot components against the Secure Boot policy and trusted signature databases.

3. Digital signatures are verified

A trusted digital signature helps establish that the component came from an approved source and has not been improperly modified.

4. Revoked software can also be blocked

Secure Boot doesn't simply maintain a list of trusted software.

UEFI Secure Boot includes databases for trusted and revoked signatures. This means software that was previously trusted can later be blocked when a known security vulnerability requires its authorization to be revoked.

5. The trusted bootloader starts

If verification succeeds, UEFI transfers control to the approved operating-system bootloader.

Windows can then continue with additional protections such as Trusted Boot.

Secure Boot Keys and Databases

Secure Boot uses several important keys and signature databases.

Component	Purpose
PK – Platform Key	Establishes control over the Secure Boot configuration
KEK – Key Enrollment Key	Authorizes updates to Secure Boot signature databases
db – Allowed Signature Database	Contains trusted certificates, signatures, or hashes
dbx – Forbidden/Revoked Signature Database	Contains signatures or hashes that must no longer be trusted

In simplified terms:

db = software that may be trusted

dbx = software/signatures that must be rejected

The actual Secure Boot architecture is more sophisticated, but this distinction is useful when understanding how revoked boot components can be blocked.

Microsoft and the UEFI specification document this certificate and signature-database architecture.

Secure Boot vs UEFI vs BIOS

These terms are sometimes incorrectly treated as the same thing.

Technology	Purpose
BIOS	Traditional firmware used to initialize hardware and start an operating system
UEFI	Modern firmware architecture that replaced traditional BIOS on most modern PCs
Secure Boot	Security functionality implemented within UEFI
TPM	Hardware/firmware security technology used for cryptographic operations and key protection
BitLocker	Windows drive-encryption technology

Therefore:

Secure Boot is not the BIOS itself.

It is a security capability provided through UEFI firmware.

Many computer manufacturers still refer to the UEFI configuration screen as "BIOS Setup" because users are familiar with that terminology.

Secure Boot vs TPM 2.0

Secure Boot and TPM are related to computer security, but they perform different functions.

Secure Boot

Secure Boot helps verify the integrity and trustworthiness of software involved in the startup process.

TPM 2.0

A Trusted Platform Module (TPM) provides hardware-backed cryptographic functionality and can securely protect cryptographic keys and measurements.

TPM is used by technologies such as:

• BitLocker
• Windows Hello
• Device encryption
• Measured Boot
• Credential protection

A computer can therefore support both TPM 2.0 and Secure Boot, with each providing a different layer of protection.

Secure Boot vs BitLocker

Secure Boot and BitLocker should also not be confused.

Secure Boot protects the startup trust chain.

BitLocker encrypts data stored on a drive.

They can complement each other.

For example, Secure Boot helps protect the boot environment while BitLocker helps protect stored data against unauthorized offline access.

Is Secure Boot Required for Windows 11?

Windows 11 system requirements include UEFI firmware with Secure Boot capability.

Microsoft also recommends enabling Secure Boot for improved security.

This distinction is important: Secure Boot capability is part of Windows 11's hardware requirements, while Microsoft recommends having Secure Boot actually turned on to receive its protection.

On most modern Windows 11 computers supplied with Windows preinstalled, Secure Boot is normally configured appropriately by the manufacturer.

How to Check Whether Secure Boot Is Enabled

The easiest method is Windows System Information.

Method 1: Check Secure Boot Using System Information

Press:

Windows + R

Type:

msinfo32

Press Enter.

The System Information window will open.

Locate:

BIOS Mode

and:

Secure Boot State

A typical properly configured Windows 11 computer may show:

BIOS Mode: UEFI

Secure Boot State: On

What the Secure Boot States Mean

Secure Boot State	Meaning
On	Secure Boot is enabled
Off	Secure Boot is supported but currently disabled
Unsupported	The current hardware/firmware configuration does not provide Secure Boot to Windows

If BIOS Mode shows:

Legacy

the computer is currently booting using Legacy BIOS/CSM rather than normal UEFI boot mode.

Do not simply change Legacy to UEFI without first checking the Windows installation and disk configuration.

Check Secure Boot Using PowerShell

Administrators and technicians can also check Secure Boot from PowerShell.

Open Windows PowerShell as Administrator and run:

Confirm-SecureBootUEFI

If Secure Boot is enabled, the command normally returns:

True

If Secure Boot is disabled on a supported UEFI computer, it can return:

False

On a system that doesn't support the required UEFI Secure Boot environment, PowerShell can return an error instead.

This command checks the Secure Boot configuration; it does not enable Secure Boot.

Check Secure Boot Through Windows Security

Windows 11 also exposes hardware-security information through Windows Security.

Open:

Settings → Privacy & security → Windows Security → Device security

Depending on the computer and Windows configuration, information related to Secure Boot and other hardware-security capabilities can be displayed here.

How to Enable Secure Boot

Secure Boot is normally enabled through the computer's UEFI firmware settings rather than through a normal Windows toggle.

One supported way to access UEFI settings from Windows 11 is:

Settings → System → Recovery → Advanced startup → Restart now

After restarting, select:

Troubleshoot → Advanced options → UEFI Firmware Settings → Restart

The computer should enter its UEFI configuration interface.

The exact menu varies between manufacturers.

Secure Boot may appear under sections such as:

• Security
• Boot
• Authentication
• System Configuration
• UEFI Configuration

Look for an option named something similar to:

Secure Boot

and configure it as:

Enabled

Save the changes and restart the computer.

Microsoft provides essentially this workflow for accessing UEFI firmware and enabling Secure Boot.

Important Warning Before Enabling Secure Boot

Do not blindly change firmware settings from Legacy/CSM mode to UEFI just because Secure Boot currently shows as unavailable.

An existing Windows installation may have been installed using Legacy BIOS mode and an MBR-partitioned system disk.

Changing the firmware boot mode without verifying the installation can result in a computer that fails to boot.

Before changing Legacy/CSM to UEFI, check:

1. Whether Windows currently boots in Legacy or UEFI mode
2. Whether the system disk uses MBR or GPT
3. Whether the hardware fully supports UEFI
4. Whether BitLocker/device encryption is enabled
5. Whether a recovery key is available
6. Whether specialized hardware or another operating system depends on the existing configuration

For business or production computers, make sure important data is backed up before changing firmware or disk configuration.

How to Check Whether the Windows Disk Is GPT or MBR

Right-click Start and select:

Disk Management

Locate the disk containing Windows.

Right-click the disk itself — for example:

Disk 0

Select:

Properties → Volumes

Check:

Partition style

It may show:

GUID Partition Table (GPT)

or:

Master Boot Record (MBR)

A standard modern Windows UEFI installation normally uses GPT.

Can MBR Be Converted to GPT?

Microsoft provides the MBR2GPT utility for supported Windows configurations.

However, disk conversion should not be performed casually.

Administrators should first validate that the disk layout meets Microsoft's requirements, ensure backups are available, and understand the necessary firmware changes.

A validation command commonly used before conversion is:

mbr2gpt /validate /allowFullOS

Conversion can then be performed on a supported configuration with:

mbr2gpt /convert /allowFullOS

Warning: Changing a production computer's partitioning and firmware boot configuration can make the system unbootable if performed incorrectly. Back up important data and ensure that you have BitLocker recovery information before making such changes.

Should Secure Boot Be Enabled?

For a normal modern Windows 11 computer:

Yes, Secure Boot should generally remain enabled.

Benefits include:

• Protection against unauthorized bootloaders
• Better resistance to bootkits and rootkits
• Verification of pre-boot software
• Protection against some boot-chain tampering
• Stronger overall Windows startup security
• Compatibility with modern Windows security architecture

Disabling Secure Boot permanently without a specific requirement removes an important security layer.

When Might Secure Boot Need to Be Disabled?

There are legitimate situations where Secure Boot may temporarily need to be disabled.

Examples can include:

• Troubleshooting certain boot problems
• Using an operating system or bootloader that isn't trusted by the configured Secure Boot keys
• Using certain older hardware or Option ROMs
• Running specialized diagnostic or recovery environments
• Testing particular low-level software
• Some custom Linux or development configurations

However, many modern Linux distributions support Secure Boot, so installing Linux does not automatically mean Secure Boot must be disabled.

Microsoft recommends re-enabling Secure Boot after completing troubleshooting when disabling it was necessary.

Can Secure Boot Stop a Computer from Booting?

Yes.

Secure Boot's purpose is to refuse execution of boot components that do not satisfy its trust policy.

Boot problems can therefore occur when:

• A bootloader isn't appropriately signed
• A signature has been revoked
• Secure Boot keys are missing or incorrectly configured
• Firmware configuration has changed
• An old expansion-card Option ROM is incompatible
• A custom operating-system bootloader isn't trusted
• Boot files have been modified

This does not necessarily mean Secure Boot itself is faulty.

It may be correctly blocking software that the firmware cannot authenticate.

Does Secure Boot Protect Against All Malware?

No.

Secure Boot is an important security technology, but it is not a replacement for antivirus, endpoint protection, Windows updates, firewalls, or safe computing practices.

Its primary purpose is protecting the early boot process.

Malware that executes after Windows has started may use completely different attack techniques.

A properly secured Windows computer should use multiple security layers, including:

• Secure Boot
• TPM 2.0
• Microsoft Defender or another reputable endpoint-security product
• Windows security updates
• Firewall protection
• Strong authentication
• BitLocker/device encryption where appropriate
• Secure account permissions
• Regular backups

What Is Trusted Boot?

Secure Boot and Trusted Boot are related but separate stages.

Secure Boot begins protecting the startup process at the UEFI firmware level.

Once the trusted Windows bootloader starts, Trusted Boot continues verifying important Windows startup components.

Microsoft describes the process as Secure Boot establishing the initial trusted startup path and Trusted Boot continuing protection through Windows startup.

A simplified chain is:

UEFI → Secure Boot → Windows Bootloader → Trusted Boot → Windows Kernel → Drivers and Security Components

This layered approach makes it harder for malicious software to compromise the operating system before normal security protections become available.

Important 2026 Secure Boot Certificate Update

Secure Boot uses trusted certificates, and an important certificate transition is currently taking place across Windows devices.

Microsoft's Secure Boot certificates originally issued in 2011 began reaching expiration starting in June 2026. Microsoft is transitioning supported Windows devices to newer 2023 Secure Boot certificates.

For most supported consumer and business Windows devices receiving Microsoft-managed updates, the updated certificates are intended to be delivered automatically through Windows servicing.

This does not mean that a PC suddenly stops booting merely because an older certificate expires.

Microsoft states that devices that haven't received the newer certificates can continue to start and receive standard Windows updates. The security concern is that they may become unable to receive newer protections for the early boot environment, including future Windows Boot Manager updates, Secure Boot database/revocation updates, and mitigations for newly discovered boot-level vulnerabilities.

Therefore, administrators should:

• Keep supported Windows systems updated
• Keep manufacturer firmware/BIOS updates current
• Avoid manually deleting or replacing Secure Boot keys without a documented reason
• Follow Microsoft or the computer manufacturer's guidance for systems that cannot receive updated Secure Boot certificates

This is particularly important for organizations managing large numbers of Windows computers.

Secure Boot and Windows Updates

Secure Boot databases can evolve as security threats are discovered.

For example, a previously trusted boot component might later be found vulnerable.

Its signature or hash can be added to the Secure Boot revocation database (dbx) so that vulnerable versions can no longer execute in the Secure Boot environment.

This is one reason Windows, firmware, and Secure Boot servicing should be kept current.

Secure Boot Troubleshooting Checklist

If Secure Boot is unavailable or cannot be enabled, check the following:

Check 1: Verify BIOS Mode

Run:

msinfo32

Look for:

BIOS Mode: UEFI

If it says Legacy, investigate the existing disk and Windows configuration before changing firmware settings.

Check 2: Check Secure Boot State

Look for:

Secure Boot State: On

or:

Secure Boot State: Off

Check 3: Check the Partition Style

Verify whether the Windows system disk uses GPT or MBR.

Check 4: Check CSM

Some firmware requires CSM (Compatibility Support Module) or Legacy Boot to be disabled before Secure Boot becomes available.

Do not disable CSM without first confirming that the operating system can boot in UEFI mode.

Check 5: Check Secure Boot Keys

Some firmware interfaces provide options such as:

• Install default Secure Boot keys
• Restore factory keys
• Key Management
• Standard Mode
• Custom Mode

Do not modify Secure Boot keys unless you understand the consequences or are following the computer manufacturer's documented procedure.

Check 6: Update UEFI/BIOS Firmware

An outdated firmware version can sometimes cause compatibility or Secure Boot servicing problems.

Use firmware only from the computer or motherboard manufacturer's official support source.

Check 7: Install Windows Updates

Keep Windows fully updated, especially because Secure Boot certificates and revocation databases can be serviced through Windows Update.

Common Secure Boot Status Example

For a properly configured modern Windows 11 computer, System Information may show:

BIOS Mode: UEFI

Secure Boot State: On

This indicates that Windows is running in UEFI mode and Secure Boot is currently active.

Secure Boot Security Summary

Feature	Secure Boot
Operates before Windows starts	Yes
Requires UEFI	Yes
Checks digital signatures	Yes
Helps block untrusted bootloaders	Yes
Helps protect against bootkits/rootkits	Yes
Replaces antivirus	No
Same as TPM	No
Same as BitLocker	No
Recommended for Windows 11	Yes
Should normally remain enabled	Yes

Secure Boot is therefore best understood as one layer of a broader hardware-backed Windows security architecture, rather than a complete security solution by itself.

FAQ

What is Secure Boot in simple terms?

Secure Boot is a UEFI security feature that checks whether software used to start your computer is trusted before allowing it to run.

Is Secure Boot part of Windows?

Secure Boot is primarily a UEFI firmware feature, not simply a Windows software feature. Windows integrates with and benefits from it.

Is Secure Boot the same as UEFI?

No. UEFI is the firmware architecture. Secure Boot is a security feature implemented within UEFI.

Is Secure Boot the same as TPM 2.0?

No. Secure Boot verifies the startup trust chain, while TPM provides hardware-backed cryptographic security and key protection.

Is Secure Boot the same as BitLocker?

No. Secure Boot protects the boot process. BitLocker encrypts data stored on drives.

How do I know if Secure Boot is enabled?

Press Windows + R, type msinfo32, and press Enter. Check Secure Boot State in System Information.

What does "Secure Boot State: On" mean?

It means Secure Boot is currently enabled and Windows is receiving its boot-verification protection.

What does "Secure Boot State: Off" mean?

It normally means Secure Boot is available but currently disabled in the firmware configuration.

Why can't I enable Secure Boot?

Possible causes include Legacy/CSM boot mode, incompatible disk configuration, missing Secure Boot keys, old firmware, unsupported hardware, or incompatible boot components.

Does Windows 11 need Secure Boot?

Windows 11 requires firmware that is UEFI and Secure Boot capable. Microsoft recommends enabling Secure Boot for stronger protection.

Should I disable Secure Boot?

Normally, no. Disable it only when there is a specific compatibility, operating-system, hardware, development, or troubleshooting requirement.

Can I enable Secure Boot from Windows?

The Secure Boot setting itself is generally changed in UEFI firmware. Windows can provide a route to restart into UEFI Firmware Settings.

Will enabling Secure Boot delete my files?

Enabling Secure Boot itself does not normally erase files. However, changing Legacy/UEFI boot modes, partition configurations, Secure Boot keys, or encryption-related settings incorrectly can prevent Windows from starting. Backups are recommended before significant firmware changes.

Does Secure Boot make Windows faster?

Secure Boot is designed for security, not primarily for improving system performance.

Does Secure Boot prevent viruses?

It can help block certain attacks targeting the pre-boot environment, particularly unauthorized or compromised boot components. It does not protect against every type of malware.

Can Secure Boot work with Linux?

Yes. Many modern Linux distributions support UEFI Secure Boot. Compatibility depends on the distribution, bootloader, drivers, and system configuration.

Why would Secure Boot block software?

The software may have an invalid or untrusted signature, may have been modified, or its signature may have been revoked because of a security vulnerability.

What are db and dbx in Secure Boot?

The db contains allowed/trusted Secure Boot signatures or certificates, while dbx contains revoked or forbidden signatures and hashes.

What happened to Secure Boot certificates in 2026?

Microsoft's older Secure Boot certificates issued in 2011 began expiring starting in June 2026. Microsoft is transitioning supported Windows devices to newer 2023 certificates so they can continue receiving future Secure Boot protections.

Will a PC stop working when an old Secure Boot certificate expires?

Not necessarily. Microsoft states that affected Windows devices can continue booting and receiving standard Windows updates. However, devices without the newer certificates can lose the ability to receive future early-boot security protections, making updating important.

Final Recommendation / Conclusion

Secure Boot should normally be enabled on modern Windows computers, particularly Windows 11 systems.

It provides an important security layer before Windows starts by verifying trusted boot software and helping prevent unauthorized or compromised components from taking control of the startup process.

For most users, the recommended configuration is:

UEFI Mode: Enabled

Secure Boot: Enabled

TPM 2.0: Enabled

Windows Update: Current

UEFI/BIOS Firmware: Current

However, administrators should never switch a production computer blindly from Legacy/CSM to UEFI simply to enable Secure Boot. First verify the disk partition style, Windows installation mode, BitLocker status, recovery-key availability, hardware compatibility, and backup status.

Also pay particular attention to the 2026 Secure Boot certificate transition. Supported Windows devices should be kept fully updated so that newer Secure Boot certificates and future boot-security protections can be deployed correctly.

For normal users and business computers, there is rarely a good reason to permanently disable Secure Boot.

 

#SecureBoot #Windows11 #WindowsSecurity #UEFI #BIOS #TPM #TPM2 #BitLocker #TrustedBoot #SecureBootWindows11 #WindowsTips #WindowsHelp #WindowsTroubleshooting #CyberSecurity #ComputerSecurity #PCSecurity #BootSecurity #UEFISecureBoot #Bootkit #Rootkit #MalwareProtection #WindowsAdmin #SystemAdministrator #ITSupport #TechSupport #PowerShell #MSInfo32 #GPT #MBR #MBR2GPT #LegacyBIOS #CSM #Firmware #SecureBootKeys #SecureBootCertificates #WindowsUpdate #DeviceSecurity #WindowsConfiguration #ComputerTips #ITKnowledgebase