Solved Turn On Secure Boot

I Upgraded to Win 11 when it was first available. I turned on TPM 2.0 to install it. Everything has been working OK. I just realized that "secure boot" was never turned on after installing Win 11.
Should it be on? If I do turn it on, would I still be able to do a clean install of Win 11 if I need to sometime in the future? Or would I have to turn it off again?
Thanks

XPS 8930
SSD, 2 HDD, GTX 1070, Windows 10 64-bit, i7-8700K, 16GB DDR4 at 2666MHz

Secure Boot needs to be enabled in the BIOS. In order to enable that, you'd also need to disable CSM.

BTW what tells you Secure Boot isn't enabled?

It is recommended that you do have SecureBoot enabled. It can help protect against some of the rootkit and bootkit infections

MSINFO32 will tell you if it's enabled
Windows Security | Device Security will tell you if it's enabled
PowerShell
Confirm-SecureBootUEFI



How to enable or disable Secure Boot

If it runs fine without it could be ok but just to be safe you should probably turn it on. And plus it's good for protecting the system if a rootkit ever infected the boot loader.

Edit: Now that I think of it how exactly did you upgrade? Was it through an in place upgrade? If so where did you see secure boot was turned off? Supposedly from what I understand it should have blocked the upgrade until it's turned on.

I used the MS media tool and did a clean install. When I activated TPM 2.0 (before installing Win 11) I noticed the secure boot was off, then I kind of forgot about it until recently.
I checked the BIOS and saw it was off. I thought I couldn't install Win 11 with it off, but I did.
Did I do something wrong? Or am going to have problems updating Windows with secure boot on?

Run the system information application from the start menu. Does it say UEFI under BIOS Mode? If yes, then you have no issues just turning on secure boot in BIOS settings.

After I upgraded my new computer to Windows 11, I found that Secure Boot was turned off. For the security and peace of mind I turned it on and have no regrets.

Yes. BIOS Mode shows "UEFI" with system information. So I'm ok then? Does this interfere with installing new apps or doing a Windows Update?
Thanks.

winjer said:

I used the MS media tool and did a clean install. When I activated TPM 2.0 (before installing Win 11) I noticed the secure boot was off, then I kind of forgot about it until recently.
I checked the BIOS and saw it was off. I thought I couldn't install Win 11 with it off, but I did.
Did I do something wrong? Or am going to have problems updating Windows with secure boot on?

Click to expand...

I don't think you did anything wrong. As far as with updating I'm really not sure at all but if I were to take a guess, most likely won't cause issues but with feature updates l don't know if it would be worth trying out though most likely the worst that could happen is it would probably simply refuse to install those. It's probably a good idea to still enabled it though.

I know, I've edited this response a lot. I'm just bad at wording and typing things some times.

winjer said:

Yes. BIOS Mode shows "UEFI" with system information. So I'm ok then? Does this interfere with installing new apps or doing a Windows Update?
Thanks.

Click to expand...

No. You'll be fine

UEFI boot is good and more secure but is not the same as Secure Boot
After Windows is installed, the device boots automatically using the same mode it was installed with.

Please run the System Information tool again and it will show you if Secure Boot is enabled or not.

Yes. BIOS Mode is UEFI and Secure Boot State is ON.
Thanks