Secure Boot is a critical security feature embedded in modern PCs that protects your Windows 11 system from malware attacks during the earliest stage of startup.
Imagine a scenario where malicious software could infiltrate your computer before the operating system even begins to load. This is exactly what Secure Boot prevents.
It works by allowing only trusted, digitally signed software to run when your PC boots, effectively blocking rootkits and bootkits that try to hijack your system unnoticed.
With Windows 11, Microsoft has made Secure Boot a mandatory requirement, underscoring its importance in the evolving cybersecurity landscape.
This feature, part of the UEFI (Unified Extensible Firmware Interface) firmware, replaces the older BIOS system and acts as a silent guardian that continuously defends your PC against sophisticated pre-boot attacks.
How To Check If Secure Boot Already Enabled
Before attempting to enable Secure Boot on your Windows 11 PC, it’s important to first verify whether it is already active. This saves time and helps avoid unnecessary changes in your BIOS/UEFI settings.
How to check Secure Boot status in Windows 11:
1. Press Windows + S to open the search bar.
2. Type System Information and press Enter.
3. In the System Information window, ensure System Summary is selected on the left.
4. Scroll down the list on the right to find Secure Boot State.
6. The status will be one of the following:
- On — Secure Boot is enabled and active.
- Off — Secure Boot is disabled and needs to be enabled manually.
- Unsupported — Your hardware or firmware does not support Secure Boot.
This method is quick and does not require rebooting or entering the BIOS/UEFI firmware interface, making it the easiest way to confirm your Secure Boot status.
How to Enable Secure Boot via BIOS/UEFI Settings (Step-by-Step)
Enabling Secure Boot typically involves accessing your PC’s UEFI firmware settings, often referred to as BIOS settings. The exact steps and menu names can vary slightly between manufacturers (e.g., Dell, ASUS, HP, Lenovo), but the general process is similar.
Step 1: Access the BIOS/UEFI Settings
There are two primary methods to enter your PC’s UEFI firmware settings:
Method 1: Using Windows 11 Advanced Startup (Recommended for ease)
1. Open the Start Menu.
2. Hold down the Shift key on your keyboard, then click on the Power icon, and select Restart.
3. Your PC will restart to a blue recovery screen. Select Troubleshoot.
4. Choose Advanced options .
5. Click UEFI Firmware Settings, then click Restart. Your PC will now boot directly into the UEFI/BIOS menu.
Step 2: Switch to UEFI Mode (If Needed)
If your system is currently running in Legacy BIOS mode, you must switch to UEFI mode for Secure Boot to function.
1. Once in the BIOS/UEFI menu, look for options like Boot Mode or Boot Configuration.
2. Change the setting from Legacy/CSM to UEFI.
3. You might need to navigate to a Boot tab and find CSM (Compatibility Support Module), then set “Launch CSM” to Disabled.
4. Save and Exit: Save your changes and restart your PC.
Note: Switching to UEFI mode may require reinstalling Windows if your current installation is not UEFI-compatible. Always back up your data before making such changes.
Step 3: Enable Secure Boot
1. Once again, access your BIOS/UEFI settings (if you had to restart after switching to UEFI mode).
2. Navigate the Firmware Menu: Look for a Boot, Security, or Authentication tab. The exact location varies by manufacturer .
- In some interfaces, like ASUS, you might need to press F7 to switch to “Advanced Mode” from “Easy Mode”
- If you are struggling to find the exact location you can search Google your motherboard. For example “Dell motherboard secure boot settings”, and you should find instructions on how to find it
3. Find the Secure Boot option.
4. Set Secure Boot to Enabled or On.
- You might also see an “OS Type” setting; ensure it is set to “Windows UEFI mode” .
- The “Secure Boot mode” should typically be set to “Standard” 5.
- If you have an older Intel system, you might need to go to “Key Management” and choose “Install Default Secure Boot Keys” 5.
5. Save and Exit: Save your changes (often by pressing F10) and exit the BIOS/UEFI. Your PC will restart.
Step 4: Verify Secure Boot is On
After Windows starts again, confirm that Secure Boot is now enabled:
1. Open System Information (by typing “System Information” in the Start Menu search bar).
2. Check the Secure Boot State. It should now display On.
Conclusion
Enabling Secure Boot on your Windows 11 PC is a crucial step toward safeguarding your system against sophisticated malware and unauthorized software that can compromise your device at the earliest stage of startup.
Secure Boot works by verifying the digital signatures of firmware, bootloaders, and operating system components, ensuring that only trusted software is allowed to run during the boot process.
This foundational security measure, combined with Windows 11’s Trusted Boot, creates a robust defense that helps prevent rootkits, bootkits, and other malicious attacks from taking hold before the operating system loads.
While enabling Secure Boot requires your PC to be running in UEFI mode and may involve some BIOS/UEFI configuration, the enhanced protection it provides is well worth the effort.
Most modern Windows 11 PCs come with Secure Boot enabled by default, but verifying and enabling it manually ensures your system benefits fully from this essential security feature.
