How to Check If Secure Boot Is Enabled in Windows and Uefi Settings

When a Windows PC refuses to boot cleanly, or when setup fails because the machine is not using the right system firmware mode, the first question is often simple: how to check if Secure Boot is enabled. That matters for Windows security and for boot verification, because Secure Boot helps the machine trust what loads before the operating system starts.

You can check it from inside Windows or directly in UEFI firmware. The two methods answer the same question from different angles, and each is useful in a different troubleshooting scenario. If you are preparing hardware changes, validating a Windows requirement, or diagnosing startup problems, the process is straightforward once you know where to look.

What Secure Boot Is and Why It Matters

Secure Boot is a firmware feature in UEFI that checks whether each stage of the boot process is signed and trusted before allowing it to load. In practical terms, it helps stop unauthorized bootloaders, bootkits, and other low-level threats from taking control before Windows starts.

The boot chain matters because malware that loads before the operating system can hide itself, resist removal, and undermine later security tools. Secure Boot helps verify the bootloader and related components against trusted signatures stored in firmware, which is why it is part of modern boot verification and Windows security baselines.

How Secure Boot works

When a UEFI system starts, the firmware checks digital signatures on startup components. If the signature matches a trusted key or certificate, the firmware continues the boot process. If the signature is missing, altered, or untrusted, the machine may block the bootloader or fall back to a recovery path.

• Trusted signatures help confirm the loader has not been tampered with.
• Firmware verification happens before the operating system is fully active.
• Boot chain integrity reduces the risk of rootkits and persistent startup threats.

“If an attacker controls the boot chain, they can often outlast antivirus, reboots, and even OS reinstalls.”

Secure Boot is commonly recommended for modern Windows installations and enterprise hardening. Microsoft documents Secure Boot and UEFI requirements in its official guidance, and NIST discusses platform boot integrity in its security publications, including the broader controls in NIST CSRC. For Windows-specific requirements, use Microsoft Learn as the primary reference.

Prerequisites

Before you check Secure Boot, make sure you have the right access and a clear plan. Most of the time this takes only a few minutes, but the firmware part is easier if you are not guessing at startup keys or changing settings blindly.

• Administrative access to Windows if you want to use System Information or Windows Security.
• Physical access to the device if you need to enter UEFI setup.
• Basic familiarity with reboot timing, startup keys, and BIOS/UEFI menus.
• A backup of important files if you may need to change boot mode or firmware settings.
• Manufacturer documentation for the exact key sequence on your laptop or motherboard.
• Optional admin tools such as PowerShell if you are auditing multiple machines.

How to Check Secure Boot Status in Windows

The fastest way to check Secure Boot in Windows is through System Information, which shows a clear status field. Open the Start menu, type msinfo32, and launch System Information. On the System Summary page, find Secure Boot State and read the value.

If the value is On, Secure Boot is enabled. If it is Off, Secure Boot is available but disabled. If it is Unsupported, the system is usually booted in legacy mode or the firmware does not support Secure Boot in the current configuration.

How to interpret the Windows result

1. On means Windows is running with Secure Boot active.
2. Off means the device supports Secure Boot, but it is not currently enabled.
3. Unsupported usually means the system is not booting in UEFI mode.

You should also check the BIOS Mode field in the same window. If it says UEFI, the machine is using the firmware mode required for Secure Boot. If it says Legacy, the machine is not using the boot path that Secure Boot depends on.

Check Secure Boot Through Windows Settings and Security Tools

Windows Settings does not always present a single, obvious Secure Boot switch, but it can still help you confirm the environment around it. Open Settings, go to System, then review Recovery, device specs, or advanced startup options to infer whether the machine boots in UEFI mode. On some systems, the path to firmware settings is exposed through Recovery options rather than a direct Secure Boot panel.

Windows Security is also useful because it surfaces device protection features that often sit alongside Secure Boot. Open Windows Security and look for Device security, where you may see secure hardware features such as BitLocker, device encryption, or virtualization-based security. These features are related, but they are not the same thing as Secure Boot.

What to look for in Windows Security

• Device security can show whether the device supports modern protections.
• Core isolation may indicate that virtualization-based security is active.
• Device encryption can be enabled even when Secure Boot needs separate verification.
• BitLocker uses TPM and boot measurements, but it is not a substitute for Secure Boot.

Microsoft has improved how these features appear across Windows releases, but the details vary by device manufacturer and edition. If you are troubleshooting ms 700-style admin workflows or general ms365 administration tasks in a managed environment, treat Windows Security as a secondary confirmation layer, not the final authority.

How to Verify Secure Boot in UEFI or BIOS Setup

To verify Secure Boot directly, restart the computer and enter the firmware setup screen during startup. Common keys are F2, Delete, Esc, and sometimes F12, but the exact key depends on the manufacturer. This is where you confirm the actual system firmware setting rather than relying on Windows reports alone.

Once inside UEFI setup, look under tabs such as Boot, Security, Authentication, or Advanced. The Secure Boot option may be listed as Enabled, Disabled, or Custom. On some devices, you must open a submenu before you can see its status.

What the firmware setting means

• Enabled means the firmware will enforce signature checks.
• Disabled means the firmware will skip Secure Boot checks.
• Custom often means the machine is using non-default keys or a custom trust database.

Some motherboards hide Secure Boot until you disable Legacy Boot or Compatibility Support Module settings. That is normal. If the option is greyed out, the firmware may require UEFI-only mode, factory keys, or a password before you can change it.

On many business laptops, the real answer to “how to check if Secure Boot is enabled” is found in UEFI, not in Windows, because the firmware is the authority that enforces the boot policy.

What to Do If Secure Boot Appears Disabled

If Secure Boot appears disabled, the most common reason is that the machine is booting in legacy mode or has Compatibility Support Module enabled. Another common cause is an older Windows installation that was installed on an MBR disk instead of a GPT disk, which often points to a legacy boot path. In that case, enabling Secure Boot is not just a toggle; it may require a boot-mode conversion.

Start by confirming that Windows is installed in UEFI mode. If it is not, you may need to plan a migration that preserves data while converting the boot configuration. On some systems, the built-in mbr2gpt tool can convert the disk layout, but you should only use it after checking documentation and backing up important data.

1. Confirm UEFI mode in System Information before changing firmware.
2. Back up data in case the boot configuration must change.
3. Disable legacy options such as CSM if the firmware requires it.
4. Enable Secure Boot and save the firmware changes.
5. Reboot and verify that Windows still starts normally.

For dual-boot systems, custom partitions, or lab computers, be especially careful. A careless switch between legacy and UEFI can prevent one operating system from booting, which is why server administration and administration of servers always includes change control, even for “simple” firmware edits.

Troubleshooting Common Secure Boot Problems

Secure Boot can fail to appear in Windows, show as unsupported, or remain hidden in firmware for a few predictable reasons. The first thing to check is whether the firmware is out of date. Older firmware versions may not expose Secure Boot cleanly or may have bugs that prevent the setting from being reported correctly.

Another common issue is a mismatch between the operating system install method and the current firmware mode. If Windows was installed in legacy mode, Secure Boot may not be available until the system is converted to UEFI. Hardware compatibility matters too, especially on older boards that support UEFI but do not support Secure Boot fully.

Common fixes that actually help

• Update firmware from the motherboard or laptop manufacturer’s support page.
• Restore factory keys if Secure Boot is in a custom state and not validating properly.
• Disable CSM when the platform supports UEFI-only boot.
• Review vendor documentation for exact menu names and required passwords.
• Check boot disk layout if Windows still reports unsupported status.

Manufacturer-specific documentation matters here because menu names vary widely. A Dell system might place Secure Boot under Boot Sequence, while an HP system may put it under Security or System Configuration. That is why a generic tutorial can only go so far when you are dealing with real hardware.

For broader baseline guidance, organizations often align platform settings with CIS Benchmarks and NIST guidance for platform integrity. That is especially relevant in environments that also use Windows security baselines, BitLocker, and endpoint management tools.

How to Audit Secure Boot on Multiple Machines

For power users and IT administrators, Secure Boot is not just a single-device check. It is a compliance item that may need to be audited across dozens or thousands of endpoints. In that case, PowerShell and management tools become the practical route, because they let you inventory UEFI and Secure Boot status without touching every keyboard.

On Windows 8 and later, PowerShell can query Secure Boot status on supported systems with commands such as Confirm-SecureBootUEFI. If the system is not running UEFI, the command will fail or return an unsupported condition, which is itself useful evidence. Pair that with inventory tools, endpoint management, or scripting to build a compliance report.

1. Run a remote inventory to identify UEFI-capable endpoints.
2. Query Secure Boot with PowerShell where administrative access is allowed.
3. Record exceptions for legacy systems, lab machines, or unsupported hardware.
4. Cross-check with BitLocker and TPM policies for full boot-chain protection.
5. Validate before imaging so a deployment does not fail after rollout.

This is where Secure Boot intersects with enterprise deployment, hardware lifecycle work, and even the responsibilities of a net admin. If you are preparing a Windows image or rolling out new hardware, verify firmware settings before you start large-scale deployment.

For role context, U.S. labor data from the Bureau of Labor Statistics shows steady demand across computer support and network administration roles, and compliance-heavy environments continue to expect familiarity with boot security and endpoint hardening. For salary research, current market data is often cross-checked against sources such as Robert Half Salary Guide and Glassdoor Salaries, though compensation varies by region and experience.

Best Practices After Confirming Secure Boot

Once you confirm Secure Boot is enabled, keep the firmware current. Vendor updates often improve compatibility with new hardware, fix security bugs, and repair issues where Secure Boot options were hidden or unstable. Updating firmware is not glamorous work, but it is part of keeping the system trustworthy.

Secure Boot should also be used alongside other protections, not instead of them. TPM, BitLocker, antivirus, Windows Defender features, and strong patch management all contribute to the same security goal from different angles. Secure Boot protects the boot chain; it does not replace disk encryption or endpoint protection.

Practical habits that reduce future problems

• Check Secure Boot again after BIOS or UEFI updates.
• Document firmware changes so you can restore the previous state quickly.
• Keep recovery media ready before changing boot settings.
• Review security posture after hardware swaps or fresh OS installs.

This is also a useful habit for anyone preparing for CompTIA A+ Certification 220-1201 & 220-1202 Training, because firmware configuration, boot troubleshooting, and Windows security basics are part of the job. The same skills help when supporting users, handling hardware refreshes, or diagnosing startup failures in the field.

How to Verify It Worked

Verification is simple: Windows and firmware should agree. After you enable Secure Boot, reboot into Windows and open System Information again. The Secure Boot State field should show On, and the BIOS Mode field should still show UEFI.

If Secure Boot is active, the system should boot normally without reporting a firmware mismatch. If the status still says Off or Unsupported, the problem is usually one of three things: the firmware setting was not saved, the system is still using legacy boot, or the firmware keys were not restored properly.

What success looks like

• System Information shows Secure Boot State: On.
• BIOS Mode shows UEFI, not Legacy.
• UEFI setup shows Secure Boot as Enabled.
• Windows boots normally without recovery prompts or boot errors.

Common failure symptoms include a missing Secure Boot field, a greyed-out firmware option, or a status that refuses to change after a reboot. In that case, go back and confirm the boot mode, firmware keys, and legacy settings one by one. That methodical approach is faster than random toggling and safer for the machine.

Conclusion

There are two reliable ways to check Secure Boot: from inside Windows with System Information, and directly in UEFI firmware. If Windows shows Secure Boot State as On and the machine is booting in UEFI mode, you have a clear signal that the boot chain is being verified at startup.

That small check matters more than most users realize. It supports Windows security, helps with troubleshooting, and confirms that the device is configured for modern boot integrity. If Secure Boot is disabled and your hardware supports it, enable it carefully, back up your data first, and verify the result after reboot.

If you are building practical admin skills, this is exactly the kind of task that belongs in day-to-day server administration, workstation support, and endpoint security work. For structured practice on core Windows and hardware topics, ITU Online IT Training can help you build that foundation with the same kind of hands-on thinking used on the job.

Microsoft® is a trademark of Microsoft Corporation. CompTIA® and A+™ are trademarks of CompTIA, Inc.