How to See If Secure Boot Is Enabled

Check Secure Boot in Windows Security

The quickest way to see if Secure Boot is enabled is through Windows Security. This works well if you're checking your PC before a Windows 11 upgrade.

1. Open the Start menu.
2. Search for Windows Security, then open it.
3. Select Device security.
4. Find Secure Boot.

You should see a status such as On or Off.

• On means Secure Boot is enabled.
• Off means Secure Boot is not enabled.

This is usually all you need. If Windows Security shows On, Windows can see that Secure Boot is active. If it shows Off, you'll need to check your BIOS or UEFI settings before trying to turn it on.

Don't confuse Secure Boot with other options shown under Device security. The setting you're looking for is specifically named Secure Boot.

Confirm the status with PowerShell

If you want a second check, PowerShell can ask the computer's UEFI firmware directly. UEFI is the newer firmware system used by most modern PCs. It replaced the older BIOS setup on many computers, although people still often call the setup screen “BIOS.”

The Windows command for this check is `Confirm-SecureBootUEFI`.

1. Open the Start menu.
2. Search for PowerShell.
3. Open PowerShell.
4. Enter this command:

```powershell

Confirm-SecureBootUEFI

```

1. Press Enter.

The command checks the Secure Boot setting on a UEFI computer.

A result showing True means Secure Boot is enabled. A result showing False means it is disabled. If the command reports that the setting isn't supported, the computer may not be running with the type of firmware needed for this check, or Secure Boot may not be available in the current setup.

PowerShell is useful when Windows Security doesn't give you a clear answer, or when you're checking several settings while preparing for Windows 11. It also gives you a quick way to confirm that the Windows status matches what you saw in the firmware menu.

If the command returns an error instead of a status, don't assume Secure Boot is simply off. Check the BIOS or UEFI screen next.

Check Secure Boot in BIOS or UEFI

Windows gives you the easiest check, but the BIOS or UEFI menu shows the firmware setting itself. This is the place to look if Windows reports Off, if Secure Boot is missing from Windows Security, or if you want to turn it on.

The exact steps vary by computer maker, so the names and layout may look different. The general path is:

1. Restart your PC.
2. Open the BIOS or UEFI setup screen during startup.
3. Look for a menu such as Security, Boot, or Authentication.
4. Find Secure Boot.
5. Check whether it says Enabled or Disabled.
6. If you change it, save the change and restart Windows.

Your computer may call the setting Secure Boot Control, Secure Boot State, or simply Secure Boot. Look for the setting that controls whether it is active.

If the BIOS or UEFI screen says Enabled, let Windows start normally and check Windows Security > Device security > Secure Boot. The Windows status should show On. This second check is useful because it confirms that Windows sees the firmware setting as active.

If the firmware says Disabled, Windows will normally show Off as well. Continue to the turn-on steps below rather than changing unrelated boot settings.

Check Secure Boot on Linux with mokutil

Linux users can check Secure Boot from a terminal with `mokutil`. The command needs to be run with root access.

Open a terminal and run:

```bash

sudo mokutil --sb-state

```

Enter your password if Linux asks for it.

The command reports whether Secure Boot is enabled or disabled. In other words:

• An enabled result means Secure Boot is active.
• A disabled result means it is not active.

This is the Linux equivalent of checking Windows Security or using PowerShell. If you're running Linux on a dual-boot PC, `mokutil` can help you confirm the firmware state without switching to Windows.

If the command says Secure Boot is unsupported, check the BIOS or UEFI setup directly. The firmware screen is the best place to confirm whether the computer offers the feature at all.

What On, Off, Disabled, and Unsupported mean

The wording changes depending on the tool you use, but the meaning is fairly simple.

On or enabled

Secure Boot is active. Windows Security uses On, while Linux tools usually use enabled. PowerShell reports the enabled state as True.

If you're checking your PC before a Windows 11 upgrade, this is the result you want for Secure Boot.

Off or disabled

Secure Boot is available, but it is not currently active. Windows Security shows Off. The BIOS or UEFI menu may show Disabled, and Linux may report disabled.

This doesn't mean the computer lacks Secure Boot. It means the setting is turned off. Go to the firmware settings and look for the option to enable it.

Unsupported or unavailable

An unsupported result means the tool cannot use Secure Boot on the current system. The feature may not be offered by the computer, or the current firmware setup may not support the check.

Don't treat unsupported as the same thing as Off. Off means the setting exists and is turned off. Unsupported means you need to check the BIOS or UEFI menu to find out whether the feature is available.

If you see different results in different places, use the firmware screen as another reference. Then restart and check the operating system again.

How to turn on Secure Boot in BIOS

Secure Boot is turned on through the PC's BIOS or UEFI settings, not from the regular Windows desktop.

1. Restart the computer.
2. Enter the BIOS or UEFI setup screen while the PC is starting.
3. Open the Boot, Security, or similar menu.
4. Select Secure Boot.
5. Change the setting to Enabled.
6. Save the changes and exit.
7. Let Windows start.
8. Open Windows Security > Device security > Secure Boot.
9. Confirm that the status now says On.

The menu may use different wording on different PCs. If you can't find Secure Boot, check each of the main setup sections rather than changing random boot options.

Only change the Secure Boot setting if you understand what your PC is showing. If the option is greyed out, unavailable, or missing, use the next section before making other changes. Don't change several firmware settings at once. That makes it harder to know what fixed the problem—or caused a new one.

Does Windows 11 enable Secure Boot automatically?

You shouldn't assume that Windows 11 turns Secure Boot on for you.

People often check this setting while moving from Windows 10 to Windows 11, and some PCs may need Secure Boot enabled before the upgrade. The important point is to check the current status instead of guessing.

Open Windows Security > Device security > Secure Boot. If it says On, Secure Boot is enabled. If it says Off, Windows isn't reporting it as active, even if you're already running Windows 11.

You can also confirm the result with:

```powershell

Confirm-SecureBootUEFI

```

Windows 11 does not remove the need to verify your firmware settings. If Secure Boot is off, use the BIOS or UEFI instructions to turn it on, then return to Windows Security and check again.

What to check if Secure Boot is missing or unavailable

Start by checking the firmware menu directly. Windows Security and PowerShell are useful, but BIOS or UEFI is where the setting is controlled.

Work through these checks:

1. Restart the PC and open the BIOS or UEFI setup screen.
2. Look under Boot, Security, and any similar menus.
3. Check whether Secure Boot appears.
4. If it appears as Disabled, you can try enabling it.
5. If it doesn't appear at all, the computer may not support the feature or may not be presenting it in the current firmware setup.
6. After any change, boot into Windows and check Device security > Secure Boot again.

If you're on Linux, use `sudo mokutil --sb-state` to check the result from the operating system. On Windows, use Windows Security first, then PowerShell when you need a second confirmation.

Use the check that matches your operating system. If Secure Boot is Off or disabled, continue to the BIOS or UEFI instructions and verify the result in Windows Security afterward.