How to Check If Your Windows 11 PC Is Using Secure Boot

Secure Boot is a UEFI/firmware feature that helps ensure your PC boots using trusted bootloaders. If you’re troubleshooting security settings—or just want to confirm your PC is configured correctly—you can check Secure Boot status in Windows 11.

What “Secure Boot” actually means (in plain English)

Secure Boot is designed to prevent unauthorized or tampered boot components from running during startup. In practice, it’s one layer of protection that works alongside other Windows security features.

If Secure Boot is off, your PC may still work normally, but you’re missing a security control that many modern Windows 11 systems are expected to have.

Method 1: Check Secure Boot status in Windows Security

On many Windows 11 PCs, you can see Secure Boot status in the Windows Security app. This is the easiest method when it’s available on your device.

• Open Start and search for “Windows Security”.
• Go to Device security.
• Look for a section that mentions Secure Boot (or “Secure Boot state”).
• If it says “On”, Secure Boot is enabled. If it says “Off”, you’ll need to enable it in your PC’s firmware (UEFI/BIOS).

If you don’t see Secure Boot anywhere in Windows Security, don’t worry—use Method 2 instead.

Method 2: Use System Information (works even when Windows Security doesn’t show it)

System Information can report Secure Boot status. This method is useful when your Windows Security screen doesn’t show the Secure Boot state.

• Press Windows key + R.
• Type: msinfo32
• Press Enter.
• In the System Information window, look for an entry named “Secure Boot State”.
• Read the value: “On” means Secure Boot is enabled; “Off” means it isn’t.

If you see “Unsupported” or a similar message, it usually means your firmware/boot setup doesn’t support Secure Boot in the way Windows expects. In that case, you’ll need to check your UEFI/BIOS settings (or confirm your PC model supports it).

If Secure Boot is off: enable it in UEFI/BIOS (the safe way)

To turn Secure Boot on, you typically change a setting in your PC’s UEFI/BIOS. The exact menu names vary by manufacturer, but the general process is consistent.

Before you change anything, keep these points in mind:

• Use the manufacturer’s instructions if you can (Dell/HP/Lenovo/ASUS all label menus differently).
• If you use dual-boot (Windows + Linux) or boot from removable media often, enabling Secure Boot may require additional steps for your other OS/bootloader.
• If you’re using BitLocker, don’t assume it will “just work” after firmware changes—make sure you understand your current encryption setup before proceeding.

General steps to enable Secure Boot:

• Save your work and restart the PC.
• As it restarts, enter UEFI/BIOS setup (commonly by pressing a key like F2, F10, F12, or Delete—your PC will usually show the key briefly during startup).
• Find a setting related to Secure Boot. It may be under Security, Boot, or Authentication.
• Set Secure Boot to Enabled.
• If your firmware offers a choice between “UEFI” and “Legacy/CSM”, choose UEFI (Secure Boot generally requires UEFI).
• Save changes and exit, then boot back into Windows.

After enabling it, re-check Secure Boot status using Method 1 or Method 2.

Common reasons Secure Boot won’t turn on (and what to try)

If you can’t enable Secure Boot, it’s usually due to one of these situations. Treat these as tests, not guaranteed fixes—your PC’s firmware determines what’s possible.

• Your PC is booting in Legacy/CSM mode instead of UEFI. Try switching to UEFI mode in firmware (if available), then re-check Secure Boot.
• You’re using a bootloader/OS that isn’t signed for Secure Boot. Dual-boot setups or custom bootloaders may need configuration changes.
• Your firmware may require you to set a “Platform Key” or clear/reload keys before Secure Boot can be enabled. Don’t do this unless you’re comfortable with firmware key management.

If you’re making security-related changes and want a quick sanity check on your overall readiness for repairs, it can help to review your recovery/backup plan. For example, see The Recovery Folder Every Computer Should Have (/articles/recovery-folder-every-computer-should-have/) before you start changing boot-related settings.

Quick checklist: confirm Secure Boot and avoid surprises

Use this checklist to keep the process straightforward:

• Check Secure Boot state in Windows Security (if shown) or System Information (msinfo32).
• If it’s off, enable it in UEFI/BIOS and save changes.
• Reboot and re-check the Secure Boot state in Windows.
• If you use dual-boot or special boot media, expect you may need extra steps after enabling Secure Boot.

If you tell me your PC brand/model and what you see for “Secure Boot State” in msinfo32, I can suggest the most likely firmware setting names to look for.