You need to set Platform in "User Mode", Secure Boot in "Standard Mode" and Load Setup Defaults.
You could do it by Restoring Factory Keys:
- BIOS - Security - Secure Boot - Restore Factory Keys - Enter
- BIOS - Restart - OS Optimized Defaults - Enabled
- BIOS - Restart - Load Setup Defaults - Enter
- Go to BIOS - Main and check if UEFI Secure Boot is ON.
I updated my PC to windows recently. No matter what I do I can't seem to be able to enable "secure boot state". I have tried looking everywhere for answers but to no avail.
Secure Boot State - how do I turn on?
I'm not sure how to enable Secure Boot :: Hardware and Operating Systems
secure boot State: user
Secure boot state user : r/ASUS
Videos
You need to set Platform in "User Mode", Secure Boot in "Standard Mode" and Load Setup Defaults.
You could do it by Restoring Factory Keys:
- BIOS - Security - Secure Boot - Restore Factory Keys - Enter
- BIOS - Restart - OS Optimized Defaults - Enabled
- BIOS - Restart - Load Setup Defaults - Enter
- Go to BIOS - Main and check if UEFI Secure Boot is ON.
You might be in Setup Mode because you have deleted the Platform Key in your BIOS. Enabling Secure Boot in this state enables your OS to write a new Platform Key (possibly useful for securing a Linux installation). But if you don't do that, you remain in Setup Mode and the Secure Boot State, indicating the Platform Key has been used to secure the system, will remain off.
Your BIOS might have an option to restore the default Platform Key, possibly called "Restore Default Secure Boot Keys", which restores the Microsoft Key. After doing that, your Secure Boot State will be On when booting Windows.
Hi Dr. James Parker,
Regarding your concern about the "red flag," you can generally rest easy. While it is true that pre-built systems from major manufacturers (like Dell, HP, or Lenovo) are required by Microsoft to ship with Secure Boot enabled, custom-built PCs behave differently. Motherboard manufacturers often ship boards with Secure Boot disabled or in "Setup Mode" by default to maximize compatibility with a wide range of hardware, older graphics cards, and operating systems during the initial build process. It is likely your builder simply installed Windows and verified stability without taking the final step to lock down the boot process. It is less a sign of malice and more a sign of a standard, compatibility-first assembly process.
However, before you attempt to enable it, we must verify a critical prerequisite to prevent your system from becoming unbootable. Secure Boot strictly requires the UEFI boot mode and a GPT partition style hard drive. If your builder installed Windows in "Legacy" or "CSM" mode, enabling Secure Boot now will stop Windows from loading. To check this, press Windows + R, type msinfo32, and press Enter. Look for the line BIOS Mode. If it says UEFI, you are safe to proceed. If it says Legacy, do not enable Secure Boot yet; you would first need to convert your drive using the MBR2GPT tool, or Windows will fail to start.
Assuming your BIOS Mode confirms "UEFI," you can enable Secure Boot by restarting your computer and pressing the setup key (usually Del or F2) to enter the BIOS menu. Navigate to the Boot, Security, or Windows OS Configuration tab (this varies by motherboard brand like ASUS, MSI, or Gigabyte). You first need to find a setting called CSM (Compatibility Support Module) and ensure it is set to Disabled. Secure Boot cannot be active while CSM is enabled.
Once CSM is disabled, locate the Secure Boot option. If you toggle it to "Enabled" but it immediately reverts to "Disabled," or if the system reports it is in "Setup Mode," you need to load the factory encryption keys. Look for an option explicitly named Restore Factory Keys, Install Default Secure Boot Keys, or Change to User Mode. After installing these keys, the Secure Boot status should successfully switch to "Enabled." Save your changes (usually F10) and reboot.
I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!
VP
To turn on Secure Boot, follow these steps:
- Uninstall any incompatible hardware or operating systems: Ensure that any graphics cards, hardware, or operating systems that aren't compatible with Secure Boot are removed.
- Access the PC BIOS menu: You can usually access this menu by pressing a key during boot, such as F1, F2, F12, or Esc. Alternatively, from Windows, hold the Shift key while selecting Restart, then go to Troubleshoot > Advanced Options: UEFI Firmware Settings.
- Locate the Secure Boot setting: Find the Secure Boot option, which is typically in the Security, Boot, or Authentication tab. If available, set it to Enabled. On some PCs, you may need to select Custom and load the Secure Boot keys that are built into the PC.
- Save changes and exit: After enabling Secure Boot, save your changes and exit the BIOS. Your PC will reboot.
- Troubleshoot if necessary: If your PC fails to boot after enabling Secure Boot, you may need to go back into the BIOS and disable Secure Boot.
Regarding your concern about the computer being delivered with Secure Boot turned off, it is not uncommon for custom-built PCs to have Secure Boot disabled, especially if they were configured to run non-certified operating systems or hardware. The default state can vary based on the manufacturer and specific configurations.
References:
- Disabling Secure Boot
- Secure the Windows boot process