Secure Boot Enabled but Not Active? How to Diagnose It in Windows 11

If your motherboard setup says Secure Boot is enabled but not active, or Windows reports that Secure Boot is off, the switch alone may not tell the whole story. Secure Boot depends on the way the PC boots, the platform's enrolled keys, and firmware-specific settings. The exact cause varies by motherboard and Windows installation, so check the current status before changing anything.

Start here: Press Windows + R, enter msinfo32, and press Enter. In System Information, note BIOS Mode and Secure Boot State. Microsoft's Secure Boot guidance (opens in new tab) uses this screen to check whether Secure Boot is on. Keep the results handy before entering firmware setup.

What does "enabled but not active" mean?

Secure Boot is a UEFI firmware feature that checks whether boot software is trusted before allowing it to run. A firmware menu can expose an enable option even when another condition prevents the feature from becoming active. Labels and menu logic differ between manufacturers, so one brand's instructions should not be assumed to apply to another.

One common reason is that the firmware has not enrolled a Platform Key (PK). In UEFI, the Platform Key is part of the trust arrangement that controls updates to Secure Boot's key databases. Microsoft's Secure Boot key-management guidance (opens in new tab) explains that enrolling the public Platform Key moves the platform from Setup Mode to User Mode. Some firmware also requires compatible boot settings, such as disabling the Compatibility Support Module (CSM), before Secure Boot can become active. The exact requirements depend on the device and its firmware.

Step 1: Check the status Windows actually sees

1. Press Windows + R.
2. Type msinfo32 and press Enter.
3. In System Summary, find BIOS Mode.
4. Find Secure Boot State and record the displayed value.

Use the result to choose the next check:

• BIOS Mode: UEFI; Secure Boot State: On. Windows reports Secure Boot as active. If a firmware menu still says otherwise, restart and recheck the exact menu, then consult the PC manufacturer's documentation for its state labels.
• BIOS Mode: UEFI; Secure Boot State: Off. Windows is booted in UEFI mode, but Secure Boot is not active for the current configuration. Check the vendor-specific Secure Boot and key-management settings.
• BIOS Mode: Legacy. Windows started using legacy BIOS compatibility mode. Do not simply turn off CSM or force UEFI mode; that can make an existing installation unbootable. Read the UEFI/MBR section below first.
• Secure Boot State: Unsupported. Windows cannot report Secure Boot as supported in the current boot configuration. This can occur on non-UEFI systems or when the machine is running in a legacy configuration. Check the device manual before assuming that the hardware lacks support.

The available values and wording can vary by system. Microsoft also documents the use of System Information in its Secure Boot servicing guidance (opens in new tab).

Step 2: Confirm with PowerShell if needed

On a supported UEFI PC, you can cross-check the reported state with Microsoft's Confirm-SecureBootUEFI cmdlet.

1. Open Windows Terminal (Admin) or PowerShell (Admin).
2. Run:

Confirm-SecureBootUEFI

A result of True means Secure Boot is enabled; False means it is disabled. On a PC that does not support Secure Boot or is not booted in a supported UEFI environment, the command can return an unsupported-platform error instead. See the official Confirm-SecureBootUEFI documentation (opens in new tab).

This command checks the current state. It does not repair a firmware configuration or enroll keys for you.

Step 3: Prepare before changing firmware settings

Firmware changes can affect how Windows starts. Before changing Secure Boot, CSM, boot mode, or key settings:

• Back up important files.
• If BitLocker or Device Encryption is enabled, confirm that you can access your recovery key from another device. Firmware and boot-configuration changes can sometimes trigger a recovery prompt.
• Write down or photograph the existing settings so you can identify what changed.
• Find the support page and manual for your exact computer or motherboard model.
• If the PC dual-boots Linux or another operating system, review that system's Secure Boot and bootloader requirements first.

Do not clear Secure Boot keys as a generic troubleshooting step. Do not restore firmware defaults or change several settings at once just to make a status label disappear. Follow the computer manufacturer's instructions for the exact model.

Step 4: Check the relevant UEFI settings

To enter firmware setup from Windows, open Settings > System > Recovery and use Advanced startup > Restart now if your Windows version offers the option. Then select Troubleshoot > Advanced options > UEFI Firmware Settings. If the option is missing, use the manufacturer's documented startup key or recovery procedure.

Firmware menus differ. Depending on the model, Secure Boot options may appear under Boot, Security, Authentication, or a similarly named menu. Check the following items without making assumptions based on another brand's screenshots.

Secure Boot mode and Platform Key

Some firmware displays a mode such as Setup or User, or shows whether the Platform Key is enrolled. On certain systems, Secure Boot cannot become active until the appropriate platform keys are enrolled. Other systems may show choices such as Install Default Secure Boot Keys or Restore Factory Keys.

Only use a key-enrollment option if the manufacturer's instructions for your exact model recommend it and you understand the effect on custom keys or alternate operating systems. The specific option names and consequences are not universal. For background, read Microsoft's Secure Boot overview (opens in new tab) and your manufacturer's manual.

UEFI boot mode and CSM

Some systems require native UEFI boot mode and the Compatibility Support Module (CSM) to be disabled for Secure Boot to activate. However, changing a legacy installation to UEFI-only without preparing the Windows boot disk can prevent Windows from starting.

If msinfo32 reports BIOS Mode: Legacy, do not switch the firmware to UEFI-only as an experiment. Windows may be installed on a disk using the MBR partition style. Microsoft's MBR2GPT documentation (opens in new tab) explains the supported conversion process and prerequisites. Back up your data and follow Microsoft's and your device manufacturer's instructions before attempting a conversion. BitLocker-encrypted systems have additional requirements.

Step 5: Save one change at a time and recheck

If the manufacturer documents a specific setting for your device, change only that setting, save the configuration, and let the PC restart. Then open msinfo32 again and check Secure Boot State. If the result has not changed, avoid cycling through unrelated firmware options. Recheck the documented requirements or contact the manufacturer's support team.

If a firmware or boot change prevents Windows from starting, use the recovery procedure provided by your computer manufacturer. Do not clear keys, reset all firmware settings, or disable security features unless the official recovery instructions for that device call for it.

Common symptoms and the next safe check

How this differs from the Secure Boot certificate update

A Secure Boot state problem and a Secure Boot certificate update are related but different issues. The first concerns whether Secure Boot is active in the current boot configuration. The second concerns replacing older trust certificates with newer ones. If Windows Security reports a certificate-update status, use our Secure Boot certificate update guide rather than changing firmware keys to troubleshoot a generic inactive-state message.

For the related firmware message about enabling Secure Boot while the system is in User Mode, see our Secure Boot User Mode troubleshooting guide. That article covers the specific message and its Platform Key implications. If your computer refuses to boot entirely with a firmware signature warning, read our walkthrough on troubleshooting a Secure Boot Violation.

Frequently asked questions

Why does BIOS say Secure Boot is enabled but not active?

The meaning depends on the firmware. Common things to check include whether a Platform Key is enrolled, whether the machine is booting in native UEFI mode, and whether a compatibility setting such as CSM is enabled. Check the exact model's manual rather than applying a generic fix.

How do I know if Secure Boot is active in Windows?

Press Windows + R, type msinfo32, and check Secure Boot State. On a supported UEFI configuration, On indicates Secure Boot is enabled. You can also use Confirm-SecureBootUEFI in an elevated PowerShell session.

Should I clear Secure Boot keys to make it active?

No, not as a general fix. Clearing keys can change the system's trust configuration and may prevent the installed operating system or other bootloaders from starting. Use only the key-management procedure documented by your device manufacturer for your specific situation.

Can I enable Secure Boot if BIOS Mode says Legacy?

Do not just switch the firmware to UEFI-only. First determine how Windows is installed and whether the system disk uses MBR or GPT. Microsoft documents MBR2GPT for eligible systems, but conversion has prerequisites and should be approached with a backup and device-specific instructions.

Will changing Secure Boot trigger BitLocker recovery?

It can, depending on the computer and encryption configuration. Confirm that you can retrieve the BitLocker recovery key before changing firmware or boot settings. Follow the manufacturer's guidance and do not assume every device behaves the same way.

Sources and further reading

• Microsoft Support: Secure Boot troubleshooting guide (opens in new tab)
• Microsoft Learn: Secure Boot (opens in new tab)
• Microsoft Support: Windows devices and Secure Boot status (opens in new tab)
• Microsoft Learn: Confirm-SecureBootUEFI (opens in new tab)
• Microsoft Learn: MBR2GPT (opens in new tab)
• ASUS Support: How to enable or disable Secure Boot (opens in new tab)
• Microsoft Learn: Secure Boot key creation and management (opens in new tab)