How to Turn Off Secure Boot in the BIOS
What Secure Boot does, how to turn it off on MSI with CSM mode and on ASUS, Gigabyte and ASRock boards, and what to check before and after.
Key takeaway
On MSI, set BIOS UEFI/CSM Mode to CSM. On other boards, set Secure Boot to Disabled. Check your BitLocker key first and turn it back on when you are done.
In this article8 sections · 6 min read
The video plays from YouTube when you press play.
Sometimes you need Secure Boot off. Maybe you want to start an older Windows installer, boot a Linux tool from a USB stick, use an older graphics card, or start a drive that still uses MBR. On MSI motherboards, switching the BIOS from UEFI to CSM mode turns Secure Boot off in one step.
In this guide I explain what Secure Boot actually does, how to turn it off on MSI boards, where the setting is on other brands, and what to keep in mind before you change it.
What Secure Boot does, in plain words
When your PC starts, a few small programs run before Windows: the firmware, the boot loader and some drivers. Secure Boot checks that each of these is signed, which means it comes from a trusted maker and has not been changed. If something unsigned tries to load, Secure Boot blocks it.
That protects you from a type of malware that hides in the startup process. It also blocks some legitimate older tools and operating systems that were never signed. That is why you sometimes need to switch it off for a while.
What changes
Secure Boot on versus off
Before you turn it off
- Windows 11 and some games need it. Games with anti-cheat, such as Valorant, may refuse to start while Secure Boot is off.
- BitLocker may ask for your recovery key. If your drive is encrypted with BitLocker, changing Secure Boot can make Windows ask for the recovery key at the next start. Find your key first in your Microsoft account, or suspend BitLocker before the change.
- Take a photo of the screen before you change anything, so you can set it back exactly as it was.
Steps on an MSI motherboard
- Restart and keep pressing Delete to open the BIOS. Click Advanced, or press F7, if you are in EZ Mode.
- Go to Settings, then Advanced, then Windows OS Configuration.
- Change BIOS UEFI/CSM Mode from UEFI to CSM.
- Press F10 and choose Yes to save and restart.
The MSI path
Where the setting lives
- Delete at startup
- F7 Advanced
- Settings
- Advanced
- Windows OS Configuration
Press F10, then Yes, to save and restart.
CSM stands for Compatibility Support Module. It lets the board start older, non-UEFI systems. Secure Boot only works in pure UEFI mode, so switching to CSM turns it off automatically.
Other motherboards
On most other boards you can switch Secure Boot off directly, without changing to CSM. The menu names vary a little:
- ASUS: Boot, then Secure Boot. Set OS Type to Other OS.
- Gigabyte: Boot, then Secure Boot, and set it to Disabled.
- ASRock: Security, then Secure Boot, and set it to Disabled.
- Laptops and prebuilt PCs: usually under a Security or Boot tab in the BIOS, named Secure Boot.
Other motherboards
Same switch, different menus
If the option is grayed out, you may need to set a BIOS administrator password first on some laptops, or switch the boot mode to allow legacy devices.
Check that it is off
Go back into the same BIOS menu. If it shows CSM and the boot mode reads Legacy + UEFI, Secure Boot is disabled.
In Windows you can confirm it too. Press Windows + R, type msinfo32 and press Enter. In the list, Secure Boot State should read Off.
Turn it back on when you are done
Once you have finished with the older tool or installer, switch Secure Boot back on, especially if you use Windows 11 or play games with anti-cheat. My Secure Boot guide walks through it step by step on MSI boards. If Windows does not start after you turn it back on, read why Secure Boot can stop Windows from starting.
Common questions
Is it safe to turn off Secure Boot?
For a short time, yes. Your PC works normally without it. You simply lose one layer of protection during startup, so turn it back on when you no longer need it off.
Will turning off Secure Boot delete anything?
No. It is a startup setting. Your files, apps and Windows install are not touched.
Windows will not start after switching to CSM. What now?
Go back into the BIOS and set BIOS UEFI/CSM Mode back to UEFI. Your Windows drive is probably GPT and prefers pure UEFI mode. Everything will start as before.
The short version
On MSI boards, open the BIOS, go to Settings, Advanced, Windows OS Configuration and set BIOS UEFI/CSM Mode to CSM. On other boards, set Secure Boot to Disabled. Check your BitLocker key first, and turn Secure Boot back on when you are done.
