Fix Secure Boot Not Enabled for Windows 11 Upgrade

I had a client's desktop last year that refused Windows 11 with a Secure Boot error, and the fix looked simple right up until I flipped the setting in firmware and the machine wouldn't boot at all — stuck bouncing straight back into the UEFI screen. That's the trap with this particular error: sometimes it really is a one-click fix, and sometimes flipping the setting the obvious way breaks your existing Windows install entirely, because the drive underneath it was never set up for Secure Boot to begin with. You need to know which situation you're in before you touch anything.

Two completely different problems wearing the same error message

"Secure Boot not enabled" during a Windows 11 upgrade check means one of two things, and they need opposite handling:

Secure Boot is simply switched off, but your firmware and drive are already set up correctly to support it. This is the easy case — a firmware toggle fixes it.
Your Windows installation is running in Legacy/CSM mode on an MBR-partitioned drive, which cannot support Secure Boot at all until the drive is converted to GPT and the firmware is switched to UEFI-only. Flip Secure Boot on without doing this first, and the machine loses its boot path — which is exactly what happened on that desktop.

You find out which one you have with two built-in tools, in about ninety seconds, before you go anywhere near a BIOS menu.

Step 1: check BIOS Mode and Secure Boot state from inside Windows

Press Windows + R, type msinfo32, press Enter. On the System Information summary page, look at two fields:

BIOS Mode — will read either UEFI or Legacy
Secure Boot State — will read On, Off, or Unsupported

If BIOS Mode already says UEFI and Secure Boot State says Off, you're in the easy case — skip to Step 3. If BIOS Mode says Legacy, you're in the harder case and need Step 2 first. If Secure Boot State says Unsupported and your motherboard is genuinely older hardware without UEFI capability at all, no amount of firmware tweaking will produce it — that's a hardware ceiling, not a setting.

Step 2: confirm the drive's partition style before changing anything in firmware

Open Disk Management (right-click Start, choose Disk Management) or run Get-Disk in PowerShell. Check the partition style of your Windows drive. If it says MBR and BIOS Mode was Legacy in Step 1, this confirms the harder case: the drive needs converting to GPT before Secure Boot can work, because Secure Boot depends on a GPT-partitioned, UEFI-bootable disk.

Windows includes a tool for this that doesn't require reinstalling anything. Back up your data first — conversions are generally reliable but this is still boot-critical surgery, and if BitLocker is on, suspend it first with manage-bde -protectors -disable C: from an elevated prompt. Then, still in Windows, open an administrative command prompt and validate before converting:

mbr2gpt /validate /allowFullOS

You want to see Validation completed successfully. If it fails, the tool tells you why — commonly not enough unallocated space for the new EFI system partition, which usually means shrinking an existing partition slightly to free room. Don't proceed past a failed validation; fix what it flags first. Once validation passes, run the actual conversion:

mbr2gpt /convert /allowFullOS

Only after this conversion succeeds should you go into firmware and disable CSM/Legacy mode. Doing it in the other order — disabling CSM while the drive is still MBR — is what leaves you stuck bouncing back to the BIOS screen with no bootable OS found. If you've already done this and you're stuck, re-enable CSM/Legacy first to get back into Windows, then follow the steps above in the correct order.

Step 3: enable UEFI-only mode and Secure Boot in firmware

Restart into firmware settings. From Windows: Settings > System > Recovery > Advanced startup > Restart now, then Troubleshoot > Advanced options > UEFI Firmware Settings > Restart. On most boards you can also tap Del, F2, F10, or Esc during POST — check your vendor's documentation if none of those work, since this varies by manufacturer.

Inside firmware:

Find the boot mode setting — usually under Boot or Advanced — labeled CSM, CSM Support, or Launch CSM. Set it to Disabled. If there's a combined UEFI/Legacy option instead, choose UEFI as the only or first boot option.
Move to the Security or Boot tab and find Secure Boot. Set it to Enabled.
If Secure Boot won't switch on, or Secure Boot Mode shows something other than Standard, look for Key Management or a similar submenu and select Restore Factory Keys / Install Default Keys. Secure Boot needs its certificate database populated to function, and on a board that's had CSM enabled for years, those factory keys are sometimes cleared or never loaded.
Confirm OS Type or Secure Boot Mode is set to Windows UEFI Mode, not "Other OS," which some boards use to intentionally relax certificate checks for non-Windows systems.
Save and exit. The board should reboot automatically.

Back in Windows, re-run msinfo32 to confirm Secure Boot State now reads On, then re-run PC Health Check.

Symptom, check, and fix — mapped together

Symptom	Confirming check	Fix
"Secure Boot not enabled," PC otherwise modern	`msinfo32`: BIOS Mode = UEFI, Secure Boot State = Off	Enable Secure Boot directly in firmware — no conversion needed
Same error, older custom-built PC or one migrated from Windows 7/8	`msinfo32`: BIOS Mode = Legacy; Disk Management shows MBR	Convert to GPT with `mbr2gpt`, then disable CSM, then enable Secure Boot
Disabling CSM causes "no bootable device" or drops straight back into firmware	You disabled CSM before converting the drive	Re-enable CSM to get back into Windows, then convert to GPT first this time
Secure Boot State reads "Unsupported" even in UEFI mode	Checked Security/Boot/Authentication tabs, updated firmware, still no option	Hardware genuinely can't do it — this is a ceiling, not a setting
Secure Boot enabled, but Windows won't boot afterward with a certificate or signature error	Event Viewer shows a boot signature/policy violation	Restore factory Secure Boot keys in firmware, or check for pending Windows Secure Boot certificate updates

What I would not do

Disable CSM before checking the drive's partition style. This is the single most common way people turn a Windows 11 upgrade errand into an unplanned reinstall.
Clear Secure Boot keys and leave them empty, thinking that "resets" the feature. An empty key database means Secure Boot has nothing to trust against — restore factory keys, don't just clear and stop.
Assume "Unsupported" always means old hardware. Some boards hide Secure Boot until CSM is disabled first; check that before writing the machine off as incapable.
Update firmware from a third-party download site because the manufacturer's own updater seems slow. A bad or mismatched firmware image on a board without reliable BIOS recovery is a far bigger problem than a delayed Windows 11 upgrade.

One thing worth knowing even after this works

Secure Boot depends on certificates in firmware, and Microsoft has been rolling out updates to the original 2011 certificates ahead of their expiration, which the company's own documentation says begins in June 2026 for devices still relying on them. On a supported, updated version of Windows this update installs automatically through Windows Update, so it's generally not something you need to act on directly — but if you've just fought your way through a Secure Boot fix on older firmware, it's a reasonable moment to also confirm Windows Update is actually current on that machine, rather than assuming a working boot means everything else is caught up too.