What’s Secure Boot in Windows? How (and why) to enable it?

What’s Secure Boot in Windows? How (and why) to enable it?

The idea behind Secure Boot is clear: allow only the trusted apps, those developed and published by verified developers with a flawless track record, to load when the computer is switched on or restarted. Essentially, this is a safeguard, a protective measure designed to prevent malicious software — rootkits and such — from loading ahead of everything else, including the antivirus software that may put up a fight. Thus, Secure Boot in Windows ensures the integrity of the system and blocks another path some malware might have otherwise taken.

Most modern PCs that are powered by Windows 11 come with Secure Boot pre-enabled. Most, but not all; and as for Windows 10, which is still not out of the picture, Secure Boot is more of an option there, not a mandatory requirement.

Security reasons aside, why else would you need to switch on Secure Boot? To play games! Many titles, Battlefield 6 through Call of Duty: Black Ops 6 and Black Ops 7 to Valorant and Fortnite won’t let you have some fun unless you have that protection up. It’s not about keeping you safe, though: the publishers don’t want you to cheat in their games, and Secure Boot helps in this matter.

How to check if Secure Boot is enabled or not

This laptop has got Secure Boot ON

First things first: you have to check if Secure Boot is already enabled on your computer or not. To do that:

• hit the Windows button, start typing “System Information”;
• click the System Information app in the results;
• find the “Secure Boot State” in the table. If it’s ON, you’re fine, if not (OFF or “Unsupported”), and you want to enable Secure Boot, keep on reading.

How to convert legacy BIOS/MBR to UEFI/GPT

Older machines often have BIOS firmware instead of the currently used UEFI, and their partition style is MBR and not GPT. The process is described in greater detail on the dedicated page of Microsoft’s vast knowledge base; generally, it looks as follows:

First, check if you really have BIOS and MBR. For the former look up BIOS in the System Information table, if it says “Legacy,” you need to convert. For the latter, right-click your system disk in File Explorer, select Properties, then Hardware – Properties, and the Volumes tab; look for “Master Boot Record (MBR)” there.

Next, hit the Windows button, type “cmd,” and click “Run as administrator” in the menu. Paste this command to the Terminal window:

mbr2gpt /validate /disk:0 /allowFullOS

Hit Enter. It checks if conversion is possible at all. After that, paste this one:

mbr2gpt /convert /disk:0 /allowFullOS

And hit Enter again. The conversion doesn’t take long.

Next, change the firmware from Legacy BIOS to UEFI: restart the computer, press F2 or Del or other key prescribed by the maker of the machine to enter BIOS; once in, locate the boot mode setting and change it from “Legacy” or “CSM” to “UEFI.” Save changes and exit BIOS.

How to enable Secure Boot manually

So, you’ve checked and found that you currently don’t have Secure Boot enabled by default, and did the conversion to UEFI/GPT if it was required. Now is the time to manually switch Secure Boot on:

• Enter UEFI. Restart the computer, when you see the logo on the screen, repeatedly press F1, Del or other button that gets you into the firmware, as instructed by the manufacturer.
• Find the tab labeled Boot, Security, or Authentication. Step in, and find Secure Boot there; set it to Enabled.
• Install Secure Boot Keys. Only if prompted, just agree to install default Secure Boot Keys.

That’s it! Save and exit UEFI. Now you have Secure Boot enabled; check it following the instructions from the first paragraph of this piece. May all your games be good!