"The PC Must Support Secure Boot"? How to Enable It for Windows 11

Q: Do I actually need Secure Boot for Windows 11, or just "capable"?

To upgrade, the PC needs to be Secure Boot *capable* (UEFI-based). Microsoft recommends actually turning it on for the security benefit, and PC Health Check flags it when it's off.

Published ✓ Verified ⏱️ 3 min read January 28, 2025 · by Ryan Bennett

PC Health Check or Windows 11 Setup says “The PC must support Secure Boot” or shows Secure Boot State: Off — even on a fairly modern machine.

Why: Most PCs from the last several years are fully Secure Boot capable; the feature is just disabled in UEFI firmware, or the disk is still booting in Legacy BIOS / CSM mode, where Secure Boot can’t be turned on at all. The fix is to confirm the state, switch to UEFI boot, and enable Secure Boot — no new hardware required.

Fix 1: Check the current Secure Boot state

Press Win + R, type msinfo32, press Enter to open System Information.
On the System Summary page, read these two lines:
- BIOS Mode — must say UEFI. If it says Legacy, that’s your blocker (see Fix 3).
- Secure Boot State — On means you’re done (your Windows 11 block is something else, like TPM or CPU). Off means it’s disabled in firmware — continue to Fix 2. Unsupported usually means Legacy/MBR.

Fix 2: Turn on Secure Boot in UEFI

Go to Settings → System → Recovery, then under Advanced startup click Restart now.
After reboot, choose Troubleshoot → Advanced options → UEFI Firmware Settings → Restart.
In the firmware, open the Boot or Security section and set Secure Boot to Enabled. (Wording varies by maker — Asus, Dell, HP, Lenovo, etc. all label it slightly differently; check your manufacturer’s support page if you can’t find it.)
Save and exit (usually F10). Back in Windows, re-check msinfo32 — Secure Boot State should now read On.

If the Secure Boot option is greyed out, the PC is still in Legacy mode — do Fix 3 first.

Fix 3: Switch from Legacy/CSM to UEFI boot

Secure Boot only works under UEFI, and UEFI requires a GPT disk. If BIOS Mode shows Legacy, convert the disk, then disable CSM.

With Windows running, press Win + R, type cmd, and run as admin.
Check the disk is convertible: run mbr2gpt /validate /allowFullOS. If it validates, run mbr2gpt /convert /allowFullOS to convert the system disk from MBR to GPT (this preserves your data, but back up first).
Reboot into UEFI firmware (as in Fix 2). Set the boot mode to UEFI only — disable Legacy/CSM. If both are offered, make UEFI first or the only option.
Now enable Secure Boot, save, and exit. Re-run PC Health Check.

FAQ

Do I actually need Secure Boot for Windows 11, or just “capable”? To upgrade, the PC needs to be Secure Boot capable (UEFI-based). Microsoft recommends actually turning it on for the security benefit, and PC Health Check flags it when it’s off.

Will enabling Secure Boot stop my PC from booting? A standard Windows install boots fine with Secure Boot on. The risk is dual-boot Linux or unsigned bootloaders — and on a BitLocker-encrypted drive, firmware changes can prompt for your recovery key, so have it ready.

Is mbr2gpt safe? It’s Microsoft’s supported in-place converter and keeps your data, but any disk operation carries risk — back up before running it, and only convert the system disk.

Sources: Microsoft Support — Windows 11 and Secure Boot, Microsoft Support — Windows 11 system requirements