How to Enable Secure Boot for Windows 11 in UEFI Firmware

Windows 11 will not install on a supported footing unless Secure Boot is switched on in your motherboard firmware, and Secure Boot itself only works when the system already boots in UEFI mode rather than legacy BIOS. So the real job is two settings, not one: get the machine booting in UEFI mode, then flip Secure Boot to enabled. Here is how to do both cleanly and confirm the change actually took.

Quick Answer

Reboot into your UEFI firmware setup, change the boot mode from Legacy or CSM to UEFI, save and reboot, then enable Secure Boot in the same firmware menu. If your disk is still formatted as MBR, convert it to GPT first with the built-in mbr2gpt tool, otherwise the system will not boot after the switch.

Check Your Current State Before Touching Anything

Two quick checks save you from a machine that will not boot. In Windows, open System Information by searching for msinfo32. Look at two lines: BIOS Mode and Secure Boot State. If BIOS Mode reads UEFI and Secure Boot State reads Off, you are one firmware toggle away from done. If BIOS Mode reads Legacy, your disk is almost certainly MBR and needs converting before UEFI mode will boot Windows.

To confirm the disk layout, open Disk Management, right-click the disk (not a partition) on the left, choose Properties, and check the Volumes tab for either Master Boot Record (MBR) or GUID Partition Table (GPT).

Step 1: Convert MBR to GPT If Needed

Skip this entirely if your disk already reports GPT. If it reports MBR, convert it without wiping data using the mbr2gpt tool that ships with Windows.

1. Back up anything important first. The conversion is generally safe, but firmware changes always carry some risk.
2. Open an elevated Command Prompt or boot into the Windows Recovery Environment by holding Shift while clicking Restart, then choosing Troubleshoot, Advanced options, Command Prompt.
3. Run mbr2gpt /validate to confirm the disk is eligible.
4. If validation passes, run mbr2gpt /convert.

Once the conversion succeeds, the disk is GPT and ready for UEFI booting.

Step 2: Switch Firmware From Legacy to UEFI

Now change the boot mode in firmware.

1. Reboot and enter firmware setup. The key is usually Delete, F2, F10 or F12, shown briefly at startup. From within Windows you can also hold Shift, click Restart, then choose Troubleshoot, Advanced options, UEFI Firmware Settings.
2. Find the Boot section. Look for a setting named Boot Mode, CSM, or Legacy Support.
3. Change it from Legacy or CSM to UEFI.
4. Save and exit. The machine reboots in UEFI mode.

If Windows fails to boot here, the disk was still MBR. Return to Step 1.

Step 3: Enable Secure Boot and Verify

With UEFI mode active, Secure Boot becomes available.

1. Re-enter firmware setup.
2. Find the Secure Boot setting, usually under a Security or Boot tab.
3. Set it to Enabled. While you are there, confirm TPM (sometimes labelled PTT on Intel or fTPM on AMD) is also enabled, since Windows 11 needs both.
4. Save and exit.

If Secure Boot Is Greyed Out

This is common and has a tidy fix. Secure Boot often cannot be toggled until the system has been saved and rebooted in UEFI mode at least once. Save your UEFI change, reboot back into firmware, and the Secure Boot option should now be selectable. If it still resists, look for an option to reset or restore Secure Boot keys to factory defaults, which clears a stale Platform Key left from a previous setup, then enable Secure Boot.

To confirm everything worked, boot into Windows and reopen msinfo32. BIOS Mode should now read UEFI and Secure Boot State should read On.

This whole process applies to desktops, laptops and small-form-factor machines alike. If you are setting up a compact system, the mini PC range at Evetech ships Windows 11 ready, and the PC best sellers give a quick read on machines that meet the requirement out of the box.

Frequently Asked Questions

Why does Windows 11 require Secure Boot?

Secure Boot verifies that only trusted, signed software loads during startup, which blocks a class of low-level malware. Microsoft made it a baseline requirement so every supported Windows 11 machine starts from a verified state.

Will converting MBR to GPT erase my data?

The mbr2gpt tool is designed to convert in place without deleting your files. It is still wise to back up first, because any firmware-level change carries some risk.

Why is the Secure Boot option greyed out?

Usually because the system has not yet booted in UEFI mode. Save the UEFI boot-mode change, reboot back into firmware, and the option becomes selectable. A factory reset of Secure Boot keys clears it if a stale key is the cause.

How do I check if Secure Boot is already on?

Run msinfo32 in Windows and read the Secure Boot State line. On reports it is active, Off means available but disabled, and Unsupported usually means the machine is still in legacy BIOS mode.

Do I need to enable TPM as well?

Yes. Windows 11 requires both Secure Boot and TPM 2.0. Enable the TPM setting, labelled PTT on Intel or fTPM on AMD, in the same firmware menu.