How to Check Secure Boot

If you need to know whether Secure Boot is on before a Windows 11 upgrade, start with the quickest check for your platform. Windows Security gives you a fast visual answer. System Information and PowerShell provide more detail. Linux users can use `mokutil`, while the BIOS or UEFI setup shows the firmware-level setting.

Check Secure Boot from Windows Security

For most Windows users, this is the fastest way to check Secure Boot.

1. Open the Start menu.
2. Type Windows Security.
3. Open the app.
4. Select Device security.
5. Look for Secure Boot.

Windows Security should show whether Secure Boot is enabled. Depending on your Windows version, you may see a status such as On or Off.

This is a good first check because you don't need to restart the computer or enter a command. It also works well if you're checking your PC before an upgrade and only need a simple answer.

If you don't see a Secure Boot section, your computer may be using legacy BIOS mode instead of UEFI mode, or the firmware may not support Secure Boot. The Windows Security screen alone may not explain which one is causing the issue, so use System Information for a clearer result.

Check Secure Boot with System Information using `msinfo32`

System Information gives you a direct Windows report that includes both the boot mode and Secure Boot status.

1. Press Windows key + R.
2. Type `msinfo32`.
3. Press Enter.
4. In the System Information window, find Secure Boot State.

You may also want to check BIOS Mode in the same window. These two entries help explain the result:

• Secure Boot State: On — Secure Boot is enabled.
• Secure Boot State: Off — Secure Boot is available, but it is currently disabled.
• Secure Boot State: Unsupported — Windows cannot use Secure Boot on the current setup.

The BIOS Mode entry may show UEFI or Legacy. Secure Boot is tied to UEFI. If the system is running in Legacy mode, Windows may report Secure Boot as unsupported even if the computer's hardware is fairly modern.

This method is useful when Windows Security gives you a vague result. It also gives you a quick way to check whether the computer is using UEFI before you change anything in firmware.

Be careful if you plan to switch from Legacy mode to UEFI. That change can affect how Windows starts. Check your files and recovery options before changing the boot mode.

Check Secure Boot with PowerShell

PowerShell can check Secure Boot from the command line with the `Confirm-SecureBootUEFI` cmdlet. A cmdlet is a PowerShell command designed for a specific task.

Run the status check

1. Open Start.
2. Search for PowerShell.
3. Open it.
4. Enter:

```powershell

Confirm-SecureBootUEFI

```

The result normally gives you a simple Boolean value:

• `True` means Secure Boot is enabled.
• `False` means Secure Boot is disabled.

The command checks Secure Boot on a computer using UEFI. If the PC is using legacy BIOS mode, or the firmware doesn't support Secure Boot, PowerShell may return an error instead of `True` or `False`.

That error doesn't mean Secure Boot is simply off. It may mean the command can't check it on the current boot setup. Use `msinfo32` to check BIOS Mode, then compare that result with the PowerShell response.

You can also run the command in Windows Terminal if PowerShell is one of its available tabs. The command itself stays the same.

PowerShell is handy when you're troubleshooting several PCs or want a result you can use in a script. For a one-time check, Windows Security or `msinfo32` is usually quicker.

Check Secure Boot certificates in PowerShell

Secure Boot uses firmware keys and certificates to decide which boot software is trusted. You can inspect some of those Secure Boot variables with PowerShell.

Open PowerShell as Administrator before running these checks. To do that, search for PowerShell, right-click it, and choose Run as administrator.

You can request common Secure Boot variables with commands such as:

```powershell

Get-SecureBootUEFI -Name PK

Get-SecureBootUEFI -Name KEK

Get-SecureBootUEFI -Name db

Get-SecureBootUEFI -Name dbx

```

These names refer to different parts of the Secure Boot key setup:

• `PK` refers to the platform key.
• `KEK` refers to key-exchange keys.
• `db` contains allowed signature information.
• `dbx` contains blocked or revoked signature information.

The returned data may not look like a friendly certificate list. It can appear as firmware data or a byte array. This check is mainly useful when you're diagnosing a trust-key problem, reviewing firmware settings, or working with an administrator.

If PowerShell reports that the command is unavailable, the system may not support the required Secure Boot tools. If it reports an access or permission problem, close PowerShell and reopen it with administrator rights.

Certificate data by itself doesn't replace the main status check. Start with `Confirm-SecureBootUEFI` or Windows Security to find out whether Secure Boot is active. Use the certificate commands when you need to investigate why the setup is not working as expected.

Check Secure Boot with `mokutil` on Linux

Linux users can check Secure Boot from a terminal with `mokutil`. This tool can validate whether Secure Boot is enabled or disabled.

Open a terminal and run:

```bash

sudo mokutil --sb-state

```

Because the command uses `sudo`, Linux will ask for your account password. The result should identify whether Secure Boot is enabled or disabled.

You may see output similar in meaning to:

```text

SecureBoot enabled

```

or:

```text

SecureBoot disabled

```

The exact wording can vary between Linux distributions.

If the command isn't installed, your distribution may provide it through a package with a name such as `mokutil`. The exact installation command depends on the Linux distribution, so don't use a package command meant for a different system.

`mokutil` checks the state exposed by the UEFI firmware. That makes it a useful Linux-side check, but it doesn't replace the firmware setup screen. If the result seems wrong, restart the PC and check the Secure Boot setting directly in UEFI.

You may also see references to MOK keys. MOK means Machine Owner Key. Linux systems can use these keys to trust signed boot components. A MOK key list is different from the basic question of whether Secure Boot is enabled, so check the `--sb-state` result first.

Check Secure Boot directly in the BIOS or UEFI

The firmware setup is the most direct place to inspect Secure Boot. It shows the setting before Windows or Linux loads.

To check it:

1. Save your work and restart the computer.
2. As the PC starts, use the key shown on screen to enter setup.
3. Look for a section related to Boot, Security, Authentication, or UEFI.
4. Find Secure Boot.
5. Read its current status.

The key and menu names differ by motherboard and computer maker. There is no single menu path that works on every PC. Some systems use a function key, the Delete key, or another key during startup, while others offer a recovery menu that leads to UEFI settings.

You may find settings such as:

• Secure Boot: Enabled
• Secure Boot: Disabled
• Secure Boot Control
• OS Type
• Windows UEFI Mode

Don't change a setting just because you found it. First record the current values. Firmware screens may also show whether the system is using UEFI mode, whether keys are loaded, and whether the Secure Boot mode is standard or custom.

If Windows reports Unsupported but the firmware shows a Secure Boot option, check whether the PC is booting in Legacy mode. The setting may exist in firmware but still be unavailable to the current operating system setup.

What enabled, disabled, and unsupported status means

The three common results are easy to mix up.

Enabled

Secure Boot is active. The firmware checks the signatures of boot components before allowing them to run.

If Windows Security, `msinfo32`, PowerShell, and Linux tools all report an enabled state, the result is consistent across the operating system and firmware.

Disabled

Secure Boot is supported, but the setting is turned off. This is different from unsupported.

You may be able to enable it in the BIOS or UEFI setup. Before doing that, check the current boot mode and make sure you understand any instructions from your PC maker or Windows upgrade process.

Unsupported

The current computer setup cannot use Secure Boot through the active boot path. Common reasons include:

• The PC is using Legacy BIOS mode.
• The firmware does not support Secure Boot.
• The system is running in a mode that prevents Windows or Linux from accessing the feature.

The word unsupported doesn't tell you which reason applies. Check BIOS Mode in `msinfo32` and look for Secure Boot in the firmware setup.

Also, don't treat a PowerShell error as the same thing as a confirmed disabled result. `False` means the command checked a UEFI system and found Secure Boot off. An error may mean the command couldn't perform the check.

Should you enable Secure Boot for Windows 11?

The available guidance connects Secure Boot with some Windows 11 upgrade or setup checks, but it doesn't establish a universal rule that every Windows 11 computer must have Secure Boot enabled in every situation.

Start by checking your own PC's status:

1. Use Windows Security for the quickest visual result.
2. Open `msinfo32` to check both Secure Boot State and BIOS Mode.
3. Use `Confirm-SecureBootUEFI` if you want a command-line result.
4. Check the BIOS or UEFI screen if the Windows results conflict.

If your upgrade instructions specifically say Secure Boot must be enabled, the change is made in the PC's BIOS or UEFI firmware, not through an ordinary Windows setting. The exact option and menu location depend on the motherboard or computer maker.

Don't switch firmware settings blindly. Write down the current Secure Boot and boot-mode values first, and make sure you know how to return to the original setup if Windows fails to start.

Before changing anything, verify the status with the quickest method for your operating system: Windows Security on Windows, `mokutil` on Linux, or the firmware screen when you need a hardware-level check.