Secure Boot remains disabled in Windows despite being enabled in the BIOS because the operating system is likely installed in Legacy (CSM) mode rather than UEFI mode, or because the Platform Key (PK) has not been properly established. To resolve this, you must verify that your disk uses a GPT partition scheme and that the firmware is running in pure UEFI mode without Compatibility Support Module (CSM) interference.
Distinguishing Between Firmware State and OS State
It is critical to understand that the BIOS setting for Secure Boot and the Windows feature for Secure Boot are two different things. The BIOS controls whether the firmware *allows* Secure Boot to function, while Windows checks if it is currently active and enforcing policies. If Windows reports that Secure Boot is off, it usually means one of three conditions: the boot mode is Legacy/CSM, the disk is MBR-formatted, or the cryptographic keys are missing. Many users toggle the switch in the UEFI interface but fail to save the changes correctly or encounter a "Password Required" prompt they ignored. However, the most common culprit is the boot mode itself. If your system boots using CSM (Compatibility Support Module), Windows will always report Secure Boot as disabled, regardless of the BIOS toggle. You need to confirm that your system is actually booting via the UEFI path. Is there a command line way to boot into UEFI firmware? provides a reliable method to access these settings directly from Windows, ensuring you are modifying the correct firmware state rather than guessing.Verifying Disk Partition Style: GPT vs MBR
Secure Boot is strictly an UEFI feature. It cannot operate on disks formatted with the Master Boot Record (MBR) scheme. If your Windows installation resides on an MBR drive, the operating system will ignore any Secure Boot settings in the BIOS. You must convert your disk to GUID Partition Table (GPT) format. To check your current partition style, open Command Prompt as Administrator and rundiskpart. Inside the tool, type list disk. Look at the output for your system disk. If the column labeled "GPT" says "No," your disk is MBR. Converting this disk is a complex process that involves wiping data or using third-party tools, so ensure you have backups before proceeding. If the column says "Yes," then the partition style is correct, and the issue lies elsewhere.
For users who recently upgraded their hardware or operating system, refer to Troubleshooting SecureBoot/UEFI Enablement on Windows 10/11 Upgrades, which details specific pitfalls during migration that can leave systems in a hybrid state where Secure Boot appears broken.
Disabling CSM and Enabling Pure UEFI
The Compatibility Support Module (CSM) is a legacy bootloader embedded within modern UEFI firmware to support older operating systems and peripherals. For Secure Boot to work, CSM must be disabled. This forces the firmware to use only native UEFI drivers and bootloaders. Navigate to your BIOS/UEFI settings. Look for a section named Boot, Boot Option Priorities, or Advanced Mode. Find the option labeled CSM Support, Launch CSM, or Legacy Support. Set this to Disabled. Once disabled, you may need to set the Boot Mode to UEFI Only or Native. Save the changes and reboot. If your system fails to boot after disabling CSM, it indicates that your Windows installation was not configured for UEFI. You will need to reinstall Windows or repair the boot configuration using a Windows Installation Media USB drive in UEFI mode. Do not attempt to force boot into Legacy mode; this will permanently prevent Secure Boot from activating.Managing Platform Keys and TPM
Even with GPT and UEFI Enabled, Secure Boot requires valid cryptographic keys. These keys include the Platform Key (PK), Key Exchange Keys (KEK), and Signature Database (db). In many consumer motherboards, these keys are pre-installed by the manufacturer. However, clearing CMOS or updating the BIOS can sometimes reset these keys to a default state that does not match the current Windows installation. Check the status of the Trusted Platform Module (TPM) in your BIOS. While TPM 2.0 is required for Windows 11, it is also closely linked to Secure Boot functionality on modern systems. Ensure TPM is set to Enabled or Discrete. If you see options for Clear PK or Reset Keys, avoid clicking them unless you intend to reinstall Windows, as this will break the chain of trust. Some manufacturers require you to set a Supervisor Password in the BIOS to change security-related settings like Secure Boot. If you cannot save the Secure Boot setting, set a temporary password, apply the changes, and then clear the password afterward. Note that some Dell and HP systems have specific menus for "Key Management" where you must explicitly choose "Install Default Keys" to restore the manufacturer's signature database.Confirming Activation in Windows
After ensuring the BIOS is in UEFI-only mode with CSM disabled and the disk is GPT, reboot into Windows. Open the Start menu and search for "About your PC" or navigate to Settings > Update & Security > Activation. Alternatively, runmsinfo32 (System Information) and look for "BIOS Mode." It must say "UEFI." Then, look for "Secure Boot State." It should now read "On."
If it still reads "Off," check the Event Viewer for errors related to winlogon.exe or smss.exe during startup. These logs often reveal if a driver is blocking the secure boot chain. Finally, test with your anti-cheat software, such as Valorant, which requires both Secure Boot and TPM 2.0 to be active. If the game still refuses to launch, ensure that no other security software is interfering with the kernel-level protections that Secure Boot enforces.