guide · static export
Security · security

Check Secure Boot and Enroll the Keys When It Fails

Secure Boot is a firmware feature with a Windows-side check and its own failure modes. Learn to read the state, restore the factory keys and fix a machine that refuses to boot after a change.

by@guidox updated:10/31/26 time:25 min level:Intermediate tested on:Windows 11 24H2 works on:Windows 10, Windows 11 tools:UEFI firmware setup, PowerShell as administrator
TL;DR

Verify with **Confirm-SecureBootUEFI** and **msinfo32**, restore the factory keys in the firmware setup, and disable CSM so the machine boots in pure UEFI mode.

Before you start

Requirements

  • UEFI firmware with Secure Boot support
  • Admin rights
  • 25 minutes
Step by step

Instructions

01

Read the state from Windows

**Confirm-SecureBootUEFI** answers only on a UEFI boot. An error is information: it means legacy BIOS, a failed cmdlet or firmware without the feature.

Confirm-SecureBootUEFI
Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer,Model
msinfo32
02

Confirm the boot path is UEFI on GPT

Secure Boot cannot work from an MBR disk. The partition style and the boot loader extension tell you whether you are in the right world before you touch firmware settings.

Get-Disk | Select-Object Number,FriendlyName,PartitionStyle
bcdedit /enum {current} | Select-String -Pattern 'path|device'
tip**winload.efi** in the bcdedit output means UEFI. A **winload.exe** path is a legacy boot and needs a GPT conversion first.
03

Set the firmware into the right mode

In the firmware setup, Secure Boot needs UEFI-only mode. With CSM or legacy support enabled the machine silently ignores the setting or lists no keys.

:: firmware setup, typical labels
:: Boot > CSM / Legacy Support > Disabled
:: Security > Secure Boot > Enabled
:: Security > Key Management > Restore Factory Keys / Install default keys
04

Check the key state instead of guessing

Setup Mode means no platform key is enrolled. User Mode with a PK means Secure Boot is armed; a missing PK explains a toggle that will not stay on.

Get-SecureBootUEFI -Name SetupMode -ErrorAction SilentlyContinue
Get-SecureBootUEFI -Name PK -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Bytes | Select-Object -First 8
Get-SecureBootPolicy -ErrorAction SilentlyContinue | Format-List
05

Recover a machine that will not boot after the change

A **Secure Boot Violation** means the bootloader is not signed by an enrolled key. Turn Secure Boot off to get in, repair the boot entry, then turn it back on.

:: firmware setup > Secure Boot > Disabled > save and exit
bcdboot C:\Windows /s S: /f UEFI
bootrec /fixboot
Confirm-SecureBootUEFI
⚠ warningDo not re-enable Secure Boot with a modified bootloader or an unsigned shim. Enroll the key or fix the loader first, otherwise the machine boots into the same error.
06

Verify end to end after a reboot

Check the state, the boot mode and the disk layout in one pass. A green Secure Boot with an MBR disk is a firmware quirk, not a working configuration.

Confirm-SecureBootUEFI
(Get-CimInstance Win32_ComputerSystem).BootupState
Get-Disk | Where-Object IsBoot -eq $true | Select-Object PartitionStyle
Troubleshooting

Common issues

The cmdlet says the system is not UEFI

The PC boots in legacy mode or in a VM without UEFI firmware. Check the firmware boot mode, and for VMs switch the generation to UEFI.

Secure Boot is on but the toggle in firmware is greyed

A supervisor password or a management tool owns the setting. Clear the supervisor password or change it from the management console.

Windows boots but the vendor logo appears twice

CSM is still partially enabled. Disable legacy support completely and keep only the UEFI boot entry.

A driver or dual-boot loader stopped working

Its loader is not signed for the enrolled keys. Either disable Secure Boot for that setup or enroll the key it needs.

FAQ

Frequently asked

Does Secure Boot slow down booting?

Only by the signature check at load time, which is milliseconds. The measurable difference comes from UEFI versus legacy boot, not from Secure Boot.

Can I enable it on an installed Windows?

Yes, if the disk is GPT and the bootloader is signed. On MBR the conversion comes first.

How to undo this

Disable Secure Boot in the firmware, or restore the previous key state there. Changing it inside Windows has no effect on the enrolled keys — the firmware owns them.

Changelog · 1 entry
  1. 2026-10-31
    First version
Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress