Videos
If you need to turn on Secure Boot, but it says "Not Active" and doesn't let you change that, try this:
Secure Boot Key management => Set to Enabled;
If all/most the keys show zero, try to: Click => Update => Yes;
With every key.
In my case, it was recently fresh install and there just weren't any keys, so setting them back to factory settings seems to have let me enter Secure Boot.
Image Link: https://imgur.com/a/OB7PxLk
It turns out that "setup" does in fact equate to "disabled".
The steps above are functional, and one can verify this with:
- In a unix system, either of
mokutil --sb-state- or
dmesg | grep -E 'secure|nvidia'
- In windows:
- https://docs.microsoft.com/en-us/mem/intune/user-help/you-need-to-enable-secure-boot-windows
No. Here is the correct answer: Change OS Type to Other OS
See: https://www.asus.com/us/support/faq/1049829/
Note: Some newer Asus Bioses allow you to just toggle Secure Boot On and Off. Note: You can also try enabling CSM "Compatibility Support Module"
I am trying to enable secure boot but in BIOS it seems to already be enabled but in system information, it shows it as 'Off'. Any ideas of things that may be causing this issue and/or how to fix it?
I would like to continue playing this game but not at the cost of my motherboard (and sanity). Seems like some people ended up bricking their PC and I really don't want that so wondering if anyone has a ASUS TUF motherboard and safely enabled secure boot? I am on Windows 11. TPM is enabled and HDD is GPT.
Hi,
Do the following: download PC Check Health, take a screenshot, and post a picture of your PC here:
https://support.microsoft.com/en-us/windows/como-usar-o-aplicativo-verifica%C3%A7%C3%A3o-de-integridade-do-pc-9c8abd9b-03ba-4e67-81ef-36f37caa7844
Thanks
Windows 11 requires that the device be UEFI- and Secure Boot–capable, have TPM 2.0, and meet the other minimum hardware requirements (CPU, RAM, storage, graphics, display, and Windows version) before Windows Update or the Installation Assistant will allow the upgrade.
From the described configuration:
- Firmware TPM 2.0 is enabled and visible in
tpm.msc. - Secure Boot is enabled in UEFI and reported as active in Windows.
In this situation, the remaining checks to focus on are:
- Confirm UEFI (no Legacy/CSM) and Secure Boot mode
- In UEFI firmware, ensure the system is not booting in Legacy/CSM mode. The firmware must be set to UEFI mode, with Secure Boot capability enabled. Some systems allow both Legacy and UEFI; in that case, UEFI must be the first or only option.
- If needed, use the Windows path to UEFI settings:
- Open Settings > System > Recovery.
- Under Advanced startup, select Restart now.
- On the blue screen, select Troubleshoot > Advanced options > UEFI Firmware Settings and then Restart.
- In the firmware menus, verify that Secure Boot is enabled and that the system is booting in UEFI mode, not Legacy/CSM.
- Verify all Windows 11 minimum requirements
- Storage: At least a 64 GB or larger storage device must be present.
- System firmware: UEFI and Secure Boot capable (already configured, but must be recognized as such by Windows).
- TPM: TPM 2.0 (already confirmed via
tpm.msc). - Graphics: DirectX 12–compatible with WDDM 2.0 driver.
- Display: 720p or higher, >9" diagonal, 8 bits per color channel.
- Windows version: The current OS must be Windows 10, version 2004 or later, to upgrade via Windows Update.
- Use firmware menus to confirm boot mode
- If there is still doubt about the boot mode, use the firmware boot menu to see how the OS drive is listed. For example, entries like UEFI: indicate UEFI mode. If only BIOS/Legacy entries appear, the system may still be in Legacy mode, which will block Windows 11.
If any of these checks fail (for example, the system is actually booting in Legacy/CSM mode or the current Windows 10 version is older than 2004), Windows Update and the Installation Assistant will continue to report that the device does not meet requirements even if TPM 2.0 and Secure Boot appear active.
References:
- Windows 11 System Requirements
- Windows 11 and Secure Boot
- Boot to UEFI Mode or legacy BIOS mode
You cannot install Windows 11 with Legacy BIOS. Installing in Legacy or CSM mode on a modern UEFI BIOS is like buying a new car and disabling all of the safety and performance features.
So you'd either need to reinstall Windows 10 exactly as I wrote out with illustrated tutorials, install Windows 11 in UEFI mode which I again gave you illustrated tutorials showing how to do this, or if you want to try to convert your present install to UEFI you can try this method:
https://www.windowscentral.com/how-convert-mbr-...
Once you convert the install and enable UEFI mode in BIOS, hopefully Secure boot will be apparent in the BIOS settings.
If not, then again I told you every single step you should make, even provided your BIOS Manual, the latest BIOS Update, how to contact Asus Support or a dozen different Asus forums that can help you with the specific settings in your Asus BIOS, since they are all different.
There is no one else on the web who would have taken the time and effort to do all of this research for you, posted back step by step instructions, each step illustrated by a tutorial explaining how to do it.
Hi Alireza. I'm Greg, 10 years awarded Windows MVP, specializing in Installation, Performance, Troubleshooting and Activation, here to help you.
There's a November 2021 BIOS Update here if yours is not updated:
https://www.asus.com/Motherboards-Components/Mo...
Then you can read the Manual here to find out how to enable Secure Boot:
https://www.asus.com/Motherboards-Components/Mo...
If it's still not clear then contact Asus Support to find out how to enable Secure Boot on your BIOS:
https://www.asus.com/support/
You can also ask in Asus forums:
https://blog.feedspot.com/asus_forums/
Is Windows presently installed in UEFI mode, as this can make a big difference in Secure Boot showing up? If you're unsure type System Information in Search, open and look for BIOS mode.
If not installed to UEFI I'd consider reinstalling to UEFI either with WIndows 10 doing this gold standard Clean Install which includes everything that works best in Windows 10: http://answers.microsoft.com/en-us/windows/wiki...
or do a Windows 11 Clean Install:
https://www.groovypost.com/howto/clean-install-...
https://pureinfotech.com/clean-install-windows-11/
Make sure to create the bootable media using Media Creation Tool only, boot the media as a UEFI device, delete all partitions down to Unallocated Space to clear formatting, then select the Unallocated Space and click Next to let the installer create and format the needed partitions - which makes it foolproof.
Feel free to ask back any questions. If you'll report back results for each step it can help determine what else needs to be tried. I will stick with you until it is fixed.
______________________________________________
Standard Disclaimer: There are links to non-Microsoft websites. The pages appear to be providing accurate, safe information. Watch out for ads on the sites that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the sites before you decide to download and install it.
Hey all.
As a guy who works in IT and knows most of the BIOS fairly well, I'm surprised we are locked down from disabling secure boot without tampering with Key Management. Pretty sure messing with Key Management bricks the laptop from what I heard.
Is there a way to disable secure boot as it does not play well with Ventoy and keep getting s Secure Boot Violation error no matter the distro, or bootloader I use?
I buy a laptop, and if I want to go on BIOS to change a setting I should have the facility to do that, especially if an ASUS product has an "Advanced Mode" setting.
Many thanks,