How to Enable Secure Boot in BIOS (Every Brand, Step by Step)

Enable Secure Boot by disabling CSM in BIOS, then setting Secure Boot Mode to Custom or Standard and restoring the default Secure Boot keys, on a GPT-formatted drive.

Last updated: September 2026

Secure Boot shows up in three very different contexts: a Windows 11 install that refuses to continue, an anti-cheat error before a match in Valorant or Call of Duty, or a security audit that flags it as off. All three have the same fix. The setting itself is simple once CSM is out of the way, but CSM is exactly what trips people up, since most boards will not let Secure Boot turn on while CSM is active. This guide covers the brand-by-brand steps, the GPT requirement underneath all of it, and what to do when the toggle is greyed out.

What Secure Boot Actually Does

Microsoft describes Secure Boot as “a security feature that helps prevent malicious software from loading when a Windows PC starts up,” working by allowing only software with a trusted digital signature to run during the boot process. It is a UEFI firmware feature, which is why it requires UEFI mode rather than legacy BIOS/CSM emulation to function at all.

It shows up in two very different places for most PC builders. First, Windows 11’s official hardware requirements list “UEFI, Secure Boot capable” firmware alongside TPM 2.0 and a supported 64-bit CPU, and setup checks both at the same time. Second, and increasingly common, several major anti-cheat systems check for it directly. Riot Games’ own support documentation for Vanguard states plainly that “some games and applications require Secure Boot to be enabled in order to run properly,” and points to the VAN: STATUS_SB_POLICY error as the specific symptom when it is not.

Before You Touch Anything

Press Win+R, type msinfo32, and press Enter. Check two fields: BIOS Mode should say UEFI, and Secure Boot State will already tell you whether it is currently On, Off, or Unsupported. If BIOS Mode says Legacy, converting your existing Windows install to GPT is a separate step (Microsoft’s built-in mbr2gpt tool handles this without a reinstall in most cases) that has to happen before Secure Boot will work on that drive.

If BitLocker protects the drive, be careful. Riot’s Secure Boot guide warns that resetting Secure Boot keys changes your TPM measurements and triggers BitLocker recovery on the next boot. Microsoft’s troubleshooting documentation for firmware changes recommends suspending BitLocker first with Suspend-BitLocker -MountPoint "C:" -RebootCount 0 in PowerShell, making the change, then running Resume-BitLocker -MountPoint "C:". Save your 48-digit recovery key somewhere outside that PC before you start, not after something goes wrong.

How to Enable Secure Boot, Brand by Brand

Enter BIOS by tapping Delete or F2 right after the power button. If you miss it, Windows also offers Settings > System > Recovery > Advanced startup > Restart now, then Troubleshoot > Advanced options > UEFI Firmware Settings.

ASUS

Press F7 for Advanced Mode, then go to Boot > Secure Boot. Change OS Type from “Other OS” to “Windows UEFI Mode.” ASUS’s own documentation notes this single change both switches the platform to UEFI mode and turns Secure Boot on at the same time; Secure Boot State will then show as synced with Secure Boot Keys and grey out, which is expected. Press F10 to save.

MSI

Press F7 for Advanced Mode, then go to Settings > Security > Secure Boot, the path FACEIT’s anti-cheat support guide uses for MSI boards. Set Secure Boot to Enabled, save with F10 and reboot. If the option is missing or won’t stay enabled, the board is still in legacy (CSM) mode: switch the BIOS mode to UEFI first, then come back to this menu.

Gigabyte

Under Boot, set CSM Support to Disabled first. Then go to Secure Boot > Secure Boot Mode and select Custom. When prompted to “Restore Factory Keys,” choose Yes, then accept the confirmation to reset without saving. The system will reboot; go back into the Secure Boot menu afterward and confirm it now shows Active. Gigabyte’s FAQ for AM4 and TRX40 boards documents this exact sequence, and covers TPM 2.0 in the same walkthrough since Windows 11 setup wants both.

ASRock

Go to Boot > CSM and set it to Disabled. Then go to Security > Secure Boot, set Secure Boot Mode to Custom, and select “Install default Secure Boot keys,” confirming Yes. Set Secure Boot itself to Enabled and save. ASRock’s documentation notes a quirk on AM5 boards specifically: if a “Discard Changes and Exit” prompt appears right after installing the default keys, select No and continue to the final Enabled step rather than exiting.

How to Verify Secure Boot Is Actually On

Back in Windows, run msinfo32 again and check Secure Boot State. It should read On. If it reads Unsupported, the drive is still MBR, CSM is still active somewhere, or the motherboard genuinely predates UEFI Secure Boot support, which is rare on anything built in the last decade.

Common Errors and Fixes

Secure Boot Is Greyed Out

This is almost always CSM. Most boards physically hide or lock the Secure Boot option while CSM is active, since the two are mutually exclusive by design; CSM emulates legacy BIOS for MBR drives, and Secure Boot depends on UEFI’s own boot signing chain. Turn CSM off first, then Secure Boot becomes selectable. Our full CSM setting guide covers every brand’s exact menu wording for that step, since it varies more than Secure Boot’s own labeling does. It is also worth checking SVM mode and Fast Boot while you are in the same BIOS section, since a Windows 11 setup failure is often more than one setting away from passing.

“Secure Boot Requires CSM Disabled” or Similar Warning

Take it literally. Go disable CSM in the Boot menu, then come back to Secure Boot. On several boards this message appears even after you think CSM is off, because CSM has separate per-device sub-toggles (storage, network, video) that all need to be off, not just a master switch.

Key Restoration Fails or the Option Disappears After a Reset

If “Restore Factory Keys” or “Install default Secure Boot keys” fails silently, a BIOS update is the most common fix, since older BIOS versions on some boards shipped with incomplete or corrupted default key databases. Check your motherboard manufacturer’s support page for a newer BIOS version before troubleshooting further. Clearing CMOS and starting over sometimes resolves it too, though that also resets XMP, fan curves, and any other customized settings alongside it.

Game Still Won’t Launch After Enabling Secure Boot

Modern anti-cheat systems like Riot Vanguard, Easy Anti-Cheat, and BattlEye increasingly check Secure Boot and TPM 2.0 together, not separately. If Secure Boot is confirmed On in msinfo32 and the game still blocks launch, check TPM state next using the steps in our TPM 2.0 guide, since both are usually required by the same anti-cheat check. A pending Windows update or an outdated anti-cheat driver is the other common cause once both firmware settings check out.

PC Won’t Boot at All After Enabling Secure Boot

Usually Windows was installed in legacy mode on an MBR drive, or something in the boot path isn’t signed for Secure Boot, such as some Linux bootloaders or older RAID or storage drivers. If you dual-boot Linux, that OS needs a Secure Boot-compatible bootloader (shim, in most modern distributions) or Secure Boot needs to stay off. For a Windows-only system that suddenly won’t boot, switch Secure Boot back off in the BIOS, or use our PC won’t turn on checklist to clear CMOS if you can’t reach the BIOS.

Frequently Asked Questions

How do I know if Secure Boot is already enabled?

Press Win+R, type msinfo32, and press Enter. Secure Boot State appears near the top of the System Summary and reads On, Off, or Unsupported directly, without needing to enter BIOS.

Do I need to disable CSM to enable Secure Boot?

In practice, yes. Secure Boot needs UEFI boot, and CSM is the legacy mode. Gigabyte, for example, only shows the Secure Boot option once CSM Support is disabled, and ASRock recommends disabling CSM for a Windows 11 install.

Will enabling Secure Boot delete my files?

No, not directly. The real risk is indirect: if your drive is still MBR, Windows will not boot at all under Secure Boot until it is converted to GPT, and if BitLocker is active, the setting change alone can trigger a recovery key prompt. Back up first regardless, as with any firmware or partition change, and have your BitLocker recovery key saved outside the PC before you start.

Is Secure Boot required for Windows 11?

Windows 11’s official requirement is “UEFI, Secure Boot capable” firmware, meaning the capability needs to exist. Microsoft recommends actively turning it on for the security benefit, and most anti-cheat systems now require it to actually be on, not just supported, so leaving it off is not a good long-term option even where setup technically allows it.

Why does Secure Boot need CSM disabled specifically?

CSM (Compatibility Support Module) emulates legacy BIOS so older, MBR-formatted drives and operating systems can boot on modern UEFI motherboards. Secure Boot only validates signed UEFI bootloaders, a mechanism that legacy boot mode does not use at all, which is why the two settings cannot both be active.

Can I use Secure Boot with a Linux dual-boot setup?

Usually yes. Most current Linux distributions ship a signed shim bootloader that works alongside Windows under Secure Boot. Older or more obscure distributions, and custom kernels you compile yourself, may need Secure Boot turned off for that specific boot entry, or their own key enrolled manually.

My Secure Boot Mode only shows “Standard,” not “Custom.” Is that a problem?

No. Standard mode uses the manufacturer’s default key set automatically and is what most people should use. Custom mode exists for enrolling your own keys, which is only necessary for specific enterprise or developer scenarios, not a typical gaming or home build.

Do I need Secure Boot for anti-cheat games like Valorant or Call of Duty?

Yes, for any title using Riot Vanguard, and increasingly for others using similar kernel-level anti-cheat. Riot’s own support documentation lists Secure Boot alongside a GPT disk and TPM 2.0 as the three prerequisites checked before Vanguard allows the game to launch.

If Secure Boot still will not stick after working through CSM, the drive format, and a BIOS update, the last practical step is contacting your motherboard manufacturer’s support directly with your exact model, current BIOS version, and the precise error text from Windows or the game launcher. That combination is what lets their support team point to the right known issue instead of guessing alongside you.