Secure Boot state: how to check it and what On, Off and Unsupported mean

Secure Boot is a UEFI firmware feature that only lets trusted, digitally signed code load while the PC starts. Microsoft’s Windows Security app describes it as protection against rootkits, a kind of malware that loads before Windows does.

Three ways to check Secure Boot state

Method	How	What you’ll see
System Information	Win + R, msinfo32, System Summary	Secure Boot State: On, Off or Unsupported. Check BIOS Mode on the same page (UEFI or Legacy)
PowerShell (as administrator)	Confirm-SecureBootUEFI	True, False or Cmdlet not supported on this platform
Windows Security	Device security > Secure Boot	A status message and, since 2026, a coloured badge for certificate updates

Two traps catch people with the PowerShell check. It must run in an elevated window: otherwise Microsoft says you get Unable to set proper privileges. Access was denied., which isn’t the same as unsupported. And it returns only a true or false value, so False means supported but disabled, not missing.

What On, Off and Unsupported mean

• On / True: Secure Boot is supported and enabled. Nothing to do.
• Off / False: the firmware supports Secure Boot but it’s disabled. Microsoft’s PowerShell reference defines False this way. It’s often switched off to install Linux, an older Windows version, or some graphics cards, as Microsoft’s Windows Security help notes.
• Unsupported / “Cmdlet not supported on this platform”: Microsoft’s cmdlet page says this appears on hardware that doesn’t support Secure Boot or on a computer that isn’t UEFI. In practice, if msinfo32 also shows BIOS Mode: Legacy, Windows was installed in Legacy/CSM mode on an MBR disk and the hardware itself is probably fine.

Microsoft only spells out the meaning of On for msinfo32; the Off and Unsupported meanings above line up with its PowerShell documentation, which reports the same underlying state.

Do you need Secure Boot on for Windows 11?

Not strictly. Microsoft’s Windows 11 requirement is firmware that is “UEFI … and Secure Boot capable”, and it adds that Secure Boot can only be enabled with UEFI. So an Off state still meets the requirement, while Unsupported on a Legacy install usually doesn’t until you move to UEFI. Microsoft does recommend turning Secure Boot on, and some games with kernel-level anti-cheat require it.

Turn Secure Boot on when it says Off

1. Open Settings > System > Recovery and, next to Advanced startup, select Restart now. (You can also hold Shift while choosing Restart.)
2. Choose Troubleshoot > Advanced options > UEFI Firmware Settings and click Restart. See how to open WinRE if the menu doesn’t appear.
3. In the firmware, look for Secure Boot on the Security, Boot or Authentication tab and set it to Enabled.
4. Save and exit, then check msinfo32 again.

If the option is greyed out, Microsoft’s OEM guidance suggests selecting Custom and loading the PC’s built-in Secure Boot keys, or resetting the firmware to factory settings. If Windows won’t start after you enable it, go back in and turn it off again. On a PC with BitLocker, have your recovery key ready before changing firmware settings, because a change can trigger the recovery prompt.

Fix Unsupported: convert to GPT and switch to UEFI

If msinfo32 shows BIOS Mode: Legacy, the order matters. Convert the disk first, then change the firmware, then turn on Secure Boot. Switching to UEFI first leaves the PC unable to boot from an MBR disk.

1. Back up your files and suspend BitLocker if it’s on. Microsoft’s MBR2GPT tool refuses to convert an encrypted volume.
2. Open Command Prompt as administrator and check the disk can be converted:

mbr2gpt /validate /disk:0 /allowFullOS

3. If validation passes, convert it:

mbr2gpt /convert /disk:0 /allowFullOS

Microsoft says MBR2GPT converts the disk without modifying or deleting data, but it has limits: no more than three primary partitions and no extended partition. When it finishes, it tells you to switch the firmware to UEFI mode before the PC will boot properly.

4. Restart into the firmware, set boot mode to UEFI (turn off CSM or Legacy support), save, and let Windows start.

5. Go back into the firmware, enable Secure Boot, and confirm with msinfo32.

If the PC is too old to offer UEFI at all, Unsupported is permanent on that hardware.

The Secure Boot certificate warning in Windows Security

Microsoft’s original 2011 Secure Boot certificates expired between June and October 2026, and Windows has been replacing them with 2023 certificates through Windows Update. Since early 2026, Windows Security > Device security > Secure Boot shows a status badge. A green badge with Secure Boot is on and all required certificate updates have been applied needs no action.

A yellow or red message, such as one saying the device uses an older boot trust configuration or can’t receive the automated update, usually means waiting for Windows Update or a firmware update. Microsoft’s advice is to stay on a supported Windows version, not pause updates, keep Secure Boot on, and contact the PC maker if the message says the hardware or firmware doesn’t support the update. Microsoft also says devices without the new certificates keep starting normally; they just miss future boot-level security fixes. If you see Secure boot is off, your device may be vulnerable, follow the steps above.

For boot errors related to signatures, see operating system loader failed signature verification. If a firmware prompt appeared after a CPU swap, this fTPM guide explains what to press.

Related guides

• Operating system loader failed signature verification: how to fix it
• New CPU Installed: fTPM/PSP NV Corrupted – Should You Press Y or N?
• WinRE: what the Windows Recovery Environment is and how to open it
• How to open Command Prompt as administrator in Windows 11 and 10

Official sources:

• Microsoft Support: Windows 11 and Secure Boot
• Microsoft Learn: Confirm-SecureBootUEFI
• Microsoft Learn: MBR2GPT.EXE
• Microsoft Support: Secure Boot certificate update status in the Windows Security app