How to Turn on Secure Boot Asrock Motherboard

If you’re trying to run something that needs Secure Boot (often Windows 11) and your ASRock PC won’t let you turn it on, the fix is usually straightforward. First, confirm your firmware is in UEFI mode (not CSM). Then go into the BIOS Security area and enable Secure Boot.

Below is a clean step-by-step checklist, plus what to do when you run into common issues like ASRock Secure Boot not Active, an ASRock Secure Boot BIOS loop, or confusion between User Mode and Setup Mode.

---

Confirm your firmware mode: UEFI vs CSM (why Secure Boot won’t enable)

Secure Boot requires UEFI mode. If your system is running in CSM (Compatibility Support Module), Secure Boot typically won’t turn on.

Before you hunt for the Secure Boot toggle, make sure you’re not set to legacy boot.

In your BIOS, do this:

• Disable CSM
• Set the system to UEFI

Look for settings like:

• CSM → set to Off/Disabled
• UEFI/Legacy → choose UEFI (not Legacy)

Once CSM is disabled, Secure Boot usually becomes available.

---

Enter ASRock BIOS setup (press F2 during POST)

1. Shut down or restart your PC.
2. As soon as it starts, during the first screen/startup time, press F2.
3. Keep pressing F2 until you enter the BIOS setup screen.

That timing matters. If you miss it, you’ll boot into Windows instead of BIOS.

---

Switch to the right BIOS area: find the Security tab

Inside BIOS:

• Look for a top menu called Security (or something very close to it).
• Open the page where Secure Boot settings live.

The exact menu layout can differ by ASRock model, but the goal is always the same: find the page where you can change Secure Boot, and Secure Boot Mode if it’s there.

---

Enable Secure Boot (set Secure Boot to Enabled)

1. In the Security area, find Secure Boot.
2. Set Secure Boot to Enabled.

If you can enable it right away, save your changes at the end.

If the option is greyed out, won’t stick, or behaves oddly, continue below.

---

If you can’t enable it: set Secure Boot Mode to Custom

When Secure Boot won’t enable, a common workaround is:

1. In the same Secure Boot area, find Secure Boot Mode.
2. Change Secure Boot Mode to Custom.
3. Then try setting Secure Boot to Enabled again.

This Custom mode path is often what fixes the stuck cases.

---

Re-check related settings that often go with Secure Boot (TPM/UEFI)

Secure Boot and modern install requirements often come together, so while you’re in BIOS, double-check the main supporting pieces.

Make sure you’re really in UEFI (not CSM)

If you haven’t done it yet, confirm:

• CSM is Disabled
• UEFI is set as the boot/firmware mode

If you have a UEFI/CSM mismatch, Secure Boot can look like it’s enabled but still not actually work.

How to enable TPM 2.0 on ASRock motherboard

If your setup also requires TPM 2.0, enable it in BIOS around the same time.

Look for options like:

• TPM
• TPM 2.0
• Security Device
• A setting to switch TPM to 2.0

Then set it to On/Enabled and save. If your board uses different labels, the idea is the same: find the TPM/TPM 2.0 switch and enable it.

---

Save and reboot: what to do after enabling

After you enable Secure Boot (and adjusted UEFI/CSM/TPM as needed):

1. Find Save & Exit (often F10).
2. Confirm the save.
3. Let the system reboot normally.

Once Windows loads, verify Secure Boot is actually active. Some systems show the status right away; others will keep asking until it’s truly enabled.

If Windows/software says Secure Boot isn’t active, use the troubleshooting section below.

---

Troubleshooting: Secure Boot not Active, BIOS loop, and User Mode vs Setup Mode

Even with the right steps, a few classic problems show up. Use the symptom-based fixes here.

Secure Boot not Active (it says enabled in BIOS, but Windows/software disagrees)

What it usually means: the BIOS change didn’t fully take effect, or the system isn’t in the right mode.

Try this sequence:

1. Reboot into BIOS with F2.
2. Confirm CSM is Disabled and the system is set to UEFI.
3. Go back to Security → Secure Boot and confirm it’s Enabled.
4. If it still won’t register correctly, set Secure Boot Mode to Custom, then re-enable Secure Boot.
5. Save and reboot again.

Many cases labeled ASRock Secure Boot not Active come down to a UEFI/CSM mismatch or a Secure Boot mode/value that didn’t finalize properly.

---

ASRock Secure Boot BIOS loop (booting keeps restarting or you can’t get into Windows)

What it usually means: the system can’t complete the boot path with Secure Boot on, often due to inconsistent setup settings.

Try this:

1. Power on and enter BIOS using F2.
2. Go to the CSM/UEFI side and confirm:

• CSM disabled
• UEFI mode

1. Then return to Security → Secure Boot.
2. If enabling Secure Boot causes the loop, switch Secure Boot Mode to Custom, then set Secure Boot again.
3. Save and reboot.

If it still loops, go back and verify you didn’t leave other boot/security settings in a conflicting state. Keep it simple: UEFI first, then Secure Boot.

---

Secure Boot can be enabled only in User Mode (Setup vs User Mode confusion)

Some ASRock BIOS versions use two modes:

• Setup Mode
• User Mode

If you see a message like Secure Boot can be enabled when system in User Mode, it means your current state is preventing the change.

Do this:

1. Re-enter BIOS with F2.
2. Find the Secure Boot mode/state option (the page that mentions User Mode / Setup Mode).
3. Switch to the mode that allows the change (the message is essentially telling you what it expects).
4. After Secure Boot becomes editable, set Secure Boot to Enabled.
5. Save and reboot.

If the BIOS says it only works in User Mode, follow that instruction rather than fighting the toggle.

---

“System in setup Mode Secure Boot ASRock” (it won’t behave like you expect)

If you see a prompt saying the system is in setup Mode and Secure Boot won’t turn on the way you expect, treat it like the previous issue:

• Go back to the Secure Boot state/mode setting.
• Use the option that moves you into the state where Secure Boot can be enabled.
• Then return to Security → Secure Boot and set it to Enabled.

This is usually one of those cases where the setting exists, but the system state needs to be correct first.

---

Quick checklist recap (the order that fixes most ASRock Secure Boot problems)

Do it in this order every time:

1. F2 during POST → enter BIOS
2. Disable CSM → ensure UEFI
3. Go to Security
4. Set Secure Boot to Enabled
5. If it won’t enable: set Secure Boot Mode to Custom
6. (If needed) enable TPM 2.0
7. Save & reboot
8. If Windows/software says “not active,” re-check UEFI/CSM and toggle again

---

After enabling Secure Boot, reboot and confirm it’s active. If you still get a “not Active” message or a BIOS loop, come back and troubleshoot based on the exact symptom you see.