System Enable or Disable Secure Boot in Windows 11


Secure_Boot_banner.png

This tutorial will show you how to enable or disable Secure Boot on your Windows 10 and Windows 11 PC.

Windows 11 minimum system requirements include your system to be UEFI (Unified Extensible Firmware Interface) and Secure Boot capable. While the requirement to upgrade a Windows 10 device to Windows 11 is only that the PC be Secure Boot capable by having UEFI enabled, you may also consider enabling Secure Boot for better security.

Secure Boot is an important security feature designed to prevent malicious software from loading when your PC starts up (boots). When the PC starts, the firmware checks the signature of each piece of boot software, including UEFI firmware drivers (also known as Option ROMs), EFI applications, and the operating system. If the signatures are valid, the PC boots, and the firmware gives control to the operating system.

Most modern PCs are capable of Secure Boot, but in some instances, there may be settings that cause the PC to appear to not be capable of Secure Boot. These settings can be changed in the PC UEFI/BIOS firmware.

If you're running certain PC graphics cards, hardware, or operating systems such as Linux or previous version of Windows you may need to disable Secure Boot.

Secure Boot helps to make sure that your PC boots using only firmware that is trusted by the manufacturer. You can usually disable Secure Boot through the PC’s firmware (BIOS) menus, but the way you disable it varies by PC manufacturer. If you are having trouble disabling Secure Boot after following the steps below, contact your manufacturer for help.

References:

If you don't turn off Device Encryption or BitLocker for the Windows OS drive before disabling Secure Boot, you will be prompted to enter the BitLocker Recovery key to unlock your Windows OS drive the next time you restart the computer after disabling Secure Boot.

After disabling Secure Boot and installing other software and hardware, you may need to restore your PC to the factory state to re-activate Secure Boot.

Be careful when changing BIOS settings. The BIOS menu is designed for advanced users, and it's possible to change a setting that could prevent your PC from starting correctly. Be sure to follow the manufacturer's instructions exactly.




Contents





Option One

Enable Secure Boot


1 Boot to UEFI Firmware Settings.

2 Depending on your PC/motherboard manufacturer, open the Security, Boot, or Authentication tab to find the Secure Boot setting. (see screenshot below)

ASUS_secure_boot.png

3 Enable the Secure Boot setting. (see screenshots below)

Depending on your PC/motherboard manufacturer, you may need to Install Default Secure Boot Keys instead to enable Secure Boot.


Secure_Boot_Control.png

4 Open the Exit tab, and click/tap on Save Changes and Exit. (see screenshot below)

Save_Changes_and_Exit.png

5 If prompted, approve changes to UEFI settings.

6 The computer will now reboot.

If the PC isn't able to boot after enabling Secure Boot, then disable Secure Boot in Option Two, and try to boot the PC again.






Option Two

Disable Secure Boot


1 Boot to UEFI Firmware Settings.

2 Depending on your PC/motherboard manufacturer, open the Security, Boot, or Authentication tab to find the Secure Boot setting. (see screenshot below)

ASUS_secure_boot.png

3 Disable the Secure Boot setting. (see screenshots below)

Depending on your PC/motherboard manufacturer, you may need to Clear Secure Boot Keys instead to disable Secure Boot.


Secure_Boot_Control.png
Clear_Secure_Boot_keys.png

4 Open the Exit tab, and click/tap on Save Changes and Exit. (see screenshot below)

Save_Changes_and_Exit.png

5 If prompted, approve changes to UEFI settings.

6 The computer will now reboot.


That's it,
Shawn Brink


 
Last edited:
What is the benefit of doing this?
 

My Computers

System One System Two

  • OS
    Win 11 Pro 26100.3037
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Alienware Aurora R16
    CPU
    Intel Core i9 14900F (24 -Core, 68 MB Total Cache)
    Motherboard
    Dell Alienware
    Memory
    32GB DDR5
    Graphics Card(s)
    RTX 4080 Super
    Sound Card
    Intel but not working
    Monitor(s) Displays
    Corsair XENEON 32QHD165
    Screen Resolution
    2560 X 1440
    Hard Drives
    1-2TB Samsung 990 Pro PCIe NVMe M2 SSD
    1-4TB Samsung 990 Pro PCIe NVMe M2 SSD
    PSU
    1000 Watt Platinum Dell
    Case
    Alienware
    Cooling
    Liquid Closed Loop
    Keyboard
    Corsair Strafe RGB MK.2
    Mouse
    Corsair M65 Pro
    Internet Speed
    1000Gb's Down-20 Up
    Browser
    Firefox 134.0.2
    Antivirus
    Defender
    Other Info
    Very Quiet And Fast
    CyberPower UPS CP1500PFCLCD
  • Operating System
    Optimum 11 24H2 Build 26100.2454
    Computer type
    PC/Desktop
    Manufacturer/Model
    IBuypower
    CPU
    Intel Core i3 1315u
    Motherboard
    ASRock
    Memory
    32GB DDR5
    Graphics card(s)
    PNY RTX 4017
    Sound Card
    onboard
    Monitor(s) Displays
    Dell 2419HGCF
    Screen Resolution
    1920 X 1080
    Hard Drives
    Kingston 2TB SNV2S20006 PCIe 4.0 M.2.2280
    SAMSUNG 980 PRO SSD 2TB, PCIe 4.0 M.2 2280
    PSU
    850Watt
    Case
    Small
    Cooling
    Closed loop Liquid
    Mouse
    IBP
    Keyboard
    IBP
    Internet Speed
    1GB
    Browser
    Firefox 133.0
    Antivirus
    Windows Defender
    Other Info
    Noisy but fast
What is the benefit of doing this?
Usually, you'd want to leave Secure Boot enabled for better security unless it's causing an issue.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro for Workstations
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom self build
    CPU
    Intel i7-8700K 5 GHz
    Motherboard
    ASUS ROG Maximus XI Formula Z390
    Memory
    64 GB (4x16GB) G.SKILL TridentZ RGB DDR4 3600 MHz (F4-3600C18D-32GTZR)
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING (11GB GDDR5X)
    Sound Card
    Integrated Digital Audio (S/PDIF)
    Monitor(s) Displays
    2 x Samsung Odyssey G75 27"
    Screen Resolution
    2560x1440
    Hard Drives
    1TB Samsung 990 PRO M.2,
    4TB Samsung 990 PRO M.2,
    8TB WD MyCloudEX2Ultra NAS
    PSU
    Seasonic Prime Titanium 850W
    Case
    Thermaltake Core P3 wall mounted
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master 3
    Internet Speed
    1 Gbps Download and 35 Mbps Upload
    Browser
    Google Chrome
    Antivirus
    Microsoft Defender and Malwarebytes Premium
    Other Info
    Logitech Z625 speaker system,
    Logitech BRIO 4K Pro webcam,
    HP Color LaserJet Pro MFP M477fdn,
    CyberPower CP1500PFCLCD
    Galaxy S23 Plus phone
  • Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Surface Laptop 7 Copilot+ PC
    CPU
    Snapdragon X Elite (12 core) 3.42 GHz
    Memory
    16 GB LPDDR5x-7467 MHz
    Monitor(s) Displays
    15" HDR
    Screen Resolution
    2496 x 1664
    Hard Drives
    1 TB SSD
    Internet Speed
    Wi-Fi 7 and Bluetooth 5.4
    Browser
    Chrome and Edge
    Antivirus
    Windows Defender
Usually, you'd want to leave Secure Boot enabled for better security unless it's causing an issue.
Can I install software or do I need to disable it first?
 

My Computer

System One

  • OS
    Win 11 Pro 64 version 23H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Homebuilt
    CPU
    Ryzen 5 7600
    Motherboard
    Aorus ProX X670e
    Memory
    32 gig GSkill F5-6000
    Graphics Card(s)
    Power Color RX6650XT
    Sound Card
    RealTek
    Monitor(s) Displays
    Asus VX248
    Screen Resolution
    1080x1280
    Hard Drives
    Crucial M2 1T
    PSU
    Corsair RM750x
    Case
    Corsair RAID
    Cooling
    Corsair AIO 240
    Keyboard
    NPET
    Mouse
    Logitech wired
    Internet Speed
    Fiber
    Browser
    Edge
    Antivirus
    MS

My Computers

System One System Two

  • OS
    Win 11 Pro 24H2 26100.3037
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self Built
    CPU
    Intel® Core™ i7-14700F
    Motherboard
    ASUS TUF GAMING Z690-PLUS WIFI
    Memory
    G.SKILL Ripjaws S5 Series 64GB (2 x 32GB) DDR5
    Graphics Card(s)
    MSI GeForce RTX 3060 Ventus 2X 12GB OC
    Sound Card
    Sound Blaster AE-5 Plus
    Monitor(s) Displays
    ASUS TUF Gaming 27" 2K HDR Gaming
    Screen Resolution
    2560 x 1440
    Hard Drives
    Samsung 990 Pro 1TB NVMe (Win 11 24H2)
    SK hynix P41 500GB NVMe (Win 11 23H2)
    SK hynix P41 2TB NVMe (x3)
    Crucial P3 Plus 4TB
    PSU
    Corsair RM850x Shift
    Case
    Antec Dark Phantom DP502 FLUX
    Cooling
    Noctua NH-U12A chromax.black + 7 Phantek T-30's
    Keyboard
    Logitech MK 320
    Mouse
    Razer Basilisk V3
    Internet Speed
    350Mbs
    Browser
    Firefox
    Antivirus
    Winows Security
    Other Info
    Windows 11 23H2 22631.4830
    On System One (Dual Boot)
  • Operating System
    Win 11 Pro 24H2 26100.3037
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self Built
    CPU
    Intel Core i7-11700F
    Motherboard
    Asus TUF Gaming Z590 Plus WiFi
    Memory
    64 GB DDR4
    Graphics card(s)
    EVGA GeForce RTX 3050 XC Black Gaming
    Sound Card
    SoundBlaster X-Fi Titanium
    Monitor(s) Displays
    Samsung F27T350
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 980 Pro 1TB
    Samsung 970 EVO Plus 2TB
    Samsung 870 EVO 500GB SSD
    PSU
    Corsair HX750
    Case
    Cougar MX330-G Window
    Cooling
    Hyper 212 EVO
    Internet Speed
    350Mbps
    Browser
    Firefox
    Antivirus
    Windows Security
Hi Brink. Thanks for this tut. I have need of some advice. I have a friend who purchased a Windows 11 S and wants to upgrade it to Pro. We have purchased a key through a third party site, but I can't find a way to input it, to upgrade. I turned secure boot off, and it still boots as W11S. The other option you have here is to sign in to MS Store and purchase another one? I've got this thing setup with a local account (no MS account). It's an HP 15-FD0023DX.
Thanks for any assistance!
 

My Computer

System One

  • OS
    W10
Hi Brink. Thanks for this tut. I have need of some advice. I have a friend who purchased a Windows 11 S and wants to upgrade it to Pro. We have purchased a key through a third party site, but I can't find a way to input it, to upgrade. I turned secure boot off, and it still boots as W11S. The other option you have here is to sign in to MS Store and purchase another one? I've got this thing setup with a local account (no MS account). It's an HP 15-FD0023DX.
Thanks for any assistance!
switch out of S mode first

then upgrade your Home to Pro via Settings > System > Activation > Change Product Key
 

My Computer

System One

  • OS
    Windows 11 Pro
switch out of S mode first

then upgrade your Home to Pro via Settings > System > Activation > Change Product

Hi and thanks for your reply.
The problem is, can't recover the MS account to use MS STORE. We finally just made a new MS account.
 

My Computer

System One

  • OS
    W10
Hi and thanks for your reply.
The problem is, can't recover the MS account to use MS STORE. We finally just made a new MS account.
this works. i've done it before (about 2 months ago)

EDIT - @ 8:20 btw

 

My Computer

System One

  • OS
    Windows 11 Pro
Hi Brink. Thanks for this tut. I have need of some advice. I have a friend who purchased a Windows 11 S and wants to upgrade it to Pro. We have purchased a key through a third party site, but I can't find a way to input it, to upgrade. I turned secure boot off, and it still boots as W11S. The other option you have here is to sign in to MS Store and purchase another one?
Why can't you just input the key?

How to input Key - Change Product Key in Windows 11 (Option One)

That said, not sure if there are also "other" requirements to switch out of "S", but still try the above and see if that changes the OS to Pro.

I've got this thing setup with a local account (no MS account).
Just saw this ^^^, the above assumes you're using a Microsoft Account to log in. Sorry.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 (Build 22631.4391)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom built
    CPU
    Intel i9-9900K
    Motherboard
    Gigabyte Aorus Z390 Xtreme
    Memory
    32G (4x8) DDR4 Corsair RGB Dominator Platinum (3600Mhz)
    Graphics Card(s)
    Radeon (XFX MERC 310) RX 7900XT
    Sound Card
    Onboard (ESS Sabre HiFi using Realtek drivers)
    Monitor(s) Displays
    27-inch Eizo Color Edge - CG2700X
    Screen Resolution
    3840 x 2160
    Hard Drives
    5 Samsung SSD drives: 2X 970 NVME (512 & 1TB), 3X EVO SATA (2X 2TB, 1X 1TB)
    PSU
    EVGA Super Nova I000 G2 (1000 watt)
    Case
    Cooler Master H500M
    Cooling
    Corsair H115i Elite Capellix XT
    Keyboard
    Logitech Craft
    Mouse
    Logitech MX Master 3
    Internet Speed
    500mb Download. 11mb Upload
    Browser
    Microsoft Edge Chromium
    Antivirus
    Windows Security
    Other Info
    System used for gaming, photography, music, school.
  • Operating System
    Windows 11 Pro 23H2 (Build 22631.4391)
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo ThinkPad X1 Carbon (Gen 12)
    CPU
    Intel Core Ultra 7 165U vPro® Processor
    Motherboard
    Vendor
    Memory
    32 GB LPDDR5X-6400MHz (Soldered)
    Graphics card(s)
    Intel Graphics
    Sound Card
    Onboard
    Monitor(s) Displays
    14" 2.8K OLED, Anti Reflection, Touch, HDR 500, 400 nits, 120Hz
    Screen Resolution
    2880 x 1800
    Hard Drives
    1 TB SSD M.2 2280 PCIe Gen4 Performance TLC Opal
    PSU
    Vendor
    Case
    Lenovo
    Cooling
    Vapor Chamber Cooling
    Mouse
    Touchpad: Haptic Touchpad
    Keyboard
    Backlit, Black with Fingerprint Reader and WWAN
    Internet Speed
    100MB
    Browser
    Edge Chromium
    Antivirus
    Windows Security
    Other Info
    202. Build Your Own laptop.
    vPro Certified Model: vPro Enterprise
Here.. summed up the video. @Brink, not sure if you have a tutorial for this method.

1) Reboot into Advanced Startup
2) Troubleshoot > Advanced Options > Command Prompt
3) type Regedit
4) Regedit > Highlight HKEY_LOCAL_MACHINE Hive > File > Load Hive > C:\Windows\System32\config\SYSTEM > Open
5) Name it: OFFLINE SYSTEM
6) Regedit > HKEY_LOCAL_MACHINE > OFFLINE SYSTEM > ControlSet001 > Control > CI > Policy
7) SkuPolicyRequired
0 = S Mode Disabled
1 = S Mode Enabled
8) Highlight OFFLINE SYSTEM key > File > Unload Hive
9) Close Command Prompt
10) Reboot PC
 

My Computer

System One

  • OS
    Windows 11 Pro
Back
Top Bottom