guide · static export
Security

Set Up Secure Boot on a New Windows 11 25H2 Desktop PC

Check UEFI compatibility, enable Secure Boot, and verify its status in Windows.

by@guidox updated:10/29/26 time:20 min level:Advanced works on:Windows 11 25H2 x64, UEFI Secure Boot capable motherboards
⚠ Safety notice

Incorrect firmware configuration can prevent Windows from booting or trigger drive-encryption recovery. Back up data and recovery keys first.

TL;DR

Configure **Secure Boot** using your motherboard's UEFI firmware and confirm it is enabled.

Before you start

Requirements

  • Windows 11 25H2 x64
  • UEFI motherboard supporting Secure Boot
  • Administrator rights
  • Motherboard firmware manual
  • Recovery key for any encrypted system drive
Step by step

Instructions

01

Check current firmware mode

Open **System Information** and inspect the **BIOS Mode** and **Secure Boot State** entries.

msinfo32
02

Confirm UEFI compatibility

Verify that Windows boots in UEFI mode. Review your motherboard documentation before changing firmware settings.

⚠ warningChanging firmware boot mode on an existing installation can prevent Windows from starting.
03

Prepare recovery information

Back up important data and save any drive-encryption recovery key. Check whether firmware changes require temporarily suspending encryption protection.

04

Enter UEFI firmware

Restart into the motherboard's firmware setup using its documented key or Windows advanced startup options.

05

Enable Secure Boot

Find **Secure Boot** in the firmware security or boot menu. Enable it and configure manufacturer-recommended default keys if appropriate for the current installation.

06

Verify in Windows

Save the firmware configuration, restart Windows, and reopen **System Information**. Confirm that **Secure Boot State** reports On.

msinfo32
Troubleshooting

Common issues

Secure Boot is grayed out.

Check firmware mode, manufacturer key-management requirements, and boot configuration.

Windows requests a recovery key.

Use the recovery key saved before changing firmware security settings.

FAQ

Frequently asked

Does Secure Boot require UEFI?

Yes. It is a UEFI firmware security feature.

Is Secure Boot the same as TPM?

No. They are separate security mechanisms that can work together.

How to undo this

If necessary for a documented compatibility reason, restore the previous Secure Boot state in UEFI firmware. Do not change unrelated boot modes or erase firmware keys without a recovery plan.

Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress