How to Enable Secure Boot for Windows 11
What Secure Boot and its keys are, the two BIOS rounds that turn it on for Windows 11 and Valorant on MSI boards, and the settings on ASUS, Gigabyte and ASRock.
Key takeaway
Your drive must be GPT first. Then set UEFI, enroll the factory keys and enable Secure Boot.
In this article8 sections · 7 min read
The video plays from YouTube when you press play.
Secure Boot is required for Windows 11 and for games with anti-cheat, like Valorant's Vanguard. On MSI boards it takes a few restarts, because each setting only unlocks after the previous one is saved. That confuses a lot of people, because the Secure Boot option looks locked the first time.
In this guide I explain what Secure Boot and its keys are, then walk through the exact two rounds I use on MSI boards. Change only what is listed below and nothing else.
What Secure Boot does, in plain words
When your PC starts, a few small programs run before Windows. Secure Boot checks that each one is signed by a trusted maker and has not been changed. If something unknown tries to load, it is blocked. This protects you from malware that hides in the startup process, which is why Windows 11 and anti-cheat systems ask for it.
To check those signatures, the motherboard needs a set of security keys stored in the BIOS. The most important one is called the platform key. On many boards the keys are not loaded until you ask for them, which is why you see a message about a missing platform key. Loading the factory default keys solves it.
At a glance
The order that unlocks Secure Boot
- MSI boards
- Windows 11
- Valorant Vanguard
Check this first: your drive must be GPT
Secure Boot only works when the PC starts in UEFI mode, and UEFI can only start a GPT drive. If your Windows drive is still MBR, Windows will not start once Secure Boot is on.
To check, right-click Start, open Disk Management, right-click your Windows disk, choose Properties and open the Volumes tab. If Partition style says GUID Partition Table (GPT), you are ready. If it says MBR, convert it first with my MBR to GPT guide. It does not delete your files.
If you use BitLocker, find your recovery key in your Microsoft account before you start. Changing Secure Boot can make Windows ask for it once.
Round 1: Switch to UEFI and load the keys
- Restart and press Delete repeatedly to open the BIOS. Click Advanced (F7) if you are in EZ Mode.
- Go to Settings, then Boot, and set Boot mode select to UEFI.
- Go to Settings, then Advanced, then Windows OS Configuration, and set BIOS UEFI/CSM Mode to UEFI.
- Open Secure Boot. If enabling it shows a message about a missing platform key, choose Enroll all Factory Default Keys and confirm Yes.
- Press F10, then Yes.
Round 1 · the MSI path
Three settings before the restart
- Delete at startup
- F7 Advanced
- Settings
- Advanced
- Windows OS Configuration
Press F10 and Yes, then open the BIOS again for Round 2.
Why the restart? The board only accepts some changes after it has saved and restarted in UEFI mode. If you try to enable Secure Boot in the same round, it often stays grayed out or switches back.
Round 2: Turn on Secure Boot
- Open the BIOS again with Delete.
- Go to Settings, Advanced, Windows OS Configuration, Secure Boot.
- Set Secure Boot to Enabled. If it says CSM is still active, press F10 to save and restart once more, then come back to this screen.
- Press F10, then Yes.
Check that it worked
Go back into the BIOS once more and Secure Boot should show Enabled. Let Windows start normally.
To confirm from Windows, press Windows + R, type msinfo32 and press Enter. In the list, look for two lines: BIOS Mode should say UEFI, and Secure Boot State should say On. The PC Health Check app will also stop complaining about Secure Boot.
You are done when
Four signs it worked
Other motherboards
- ASUS: Boot, then CSM, set Launch CSM to Disabled. Then Boot, Secure Boot, set OS Type to Windows UEFI mode, and in Key Management choose Install default Secure Boot keys.
- Gigabyte: Boot, set CSM Support to Disabled, save and restart, then Boot, Secure Boot, set it to Enabled and restore the factory keys if asked.
- ASRock: Boot, CSM, set it to Disabled. Then Security, Secure Boot, set it to Enabled and install the default keys.
The pattern is always the same: turn off CSM so the board runs in pure UEFI, load the default keys, then enable Secure Boot.
If something goes wrong
- The Secure Boot option is grayed out: CSM is still on. Set the board to UEFI only, save, restart and try again.
- Windows will not start and you land in the BIOS: your drive is probably MBR. Read why Secure Boot stops Windows from starting.
- It says Secure Boot is enabled, but msinfo32 says Off: the keys were not loaded. Go back and choose Enroll all Factory Default Keys.
The short version
Make sure your drive is GPT, switch the board to UEFI, load the factory default keys, restart, then enable Secure Boot. Confirm with msinfo32. Two rounds, a few restarts, and Windows 11 and your games are happy.
