What Secure Boot is and why to keep it on

Among the computer’s settings you will find the Secure Boot feature. Most people never think about it, but it is an important layer of protection. Let us explain what Secure Boot does, why it is worth it, how to set it up, and when it can cause problems.

What Secure Boot is

Secure Boot is a security feature in modern UEFI that, at startup, only lets trusted and digitally signed software run. When the computer turns on, it checks whether the operating system and bootloader being started are signed with a verified key. If not, it blocks the startup.

Simply put, Secure Boot guards the gate right at startup and lets nothing untrustworthy in.

What it protects against

Some of the most dangerous attacks target exactly the computer’s startup, before the operating system and antivirus even load:

• Bootkits and rootkits. Malicious code that loads before the system, so ordinary protection does not see it and it is hard to remove.
• A spoofed bootloader that would take control of the computer right at the beginning.

Secure Boot prevents this by simply not running such unsigned code. It is a complement to ordinary protection, not a replacement, and this relates to cybersecurity principles.

Secure Boot, TPM, and Windows 11

Secure Boot is often mentioned together with the TPM (Trusted Platform Module), but these are two different things. TPM is a separate chip or firmware module that securely stores encryption keys and performs cryptographic operations, for example during disk encryption. Secure Boot, on the other hand, is a UEFI feature that checks software signatures at startup. Neither needs the other to work, but they complement each other and together form the foundation of a trustworthy computer startup.

Windows 11 requires both Secure Boot and TPM 2.0 to be enabled as a condition for installation and for receiving supported updates. If a compatibility check shows an error about unmet requirements, one of the first things worth checking is the Secure Boot status in BIOS/UEFI.

How to check whether Secure Boot is enabled, and how to set it up

Checking and changing the setting takes only a few minutes on most computers.

Checking the status on Windows:

1. Press the Start key, type msinfo32, then press Enter.
2. In the “System Information” window, in the right-hand panel, find the line “Secure Boot State”.
3. A value of “On” means Secure Boot is active, “Off” means it is disabled, and “Unsupported” means the device cannot offer it at all (older BIOS without UEFI).

Changing the setting directly in BIOS/UEFI:

1. Restart the computer.
2. Right at the first manufacturer screen, repeatedly press the key that opens BIOS/UEFI. This is usually Del or F2 (common laptops and motherboards), F10 (HP), F12 (Dell), or Esc (some HP and Lenovo models). The exact key is often briefly shown on the startup screen.
3. In the menu, look for a section called Boot, Security, or Authentication, it varies by manufacturer.
4. Find the “Secure Boot” item and switch it to Enabled or Disabled.
5. If the item is greyed out and cannot be changed, check whether Boot Mode is set to UEFI rather than Legacy or CSM. Some models (for example older Lenovo and HP laptops) also require setting a BIOS supervisor password before the change is allowed.
6. Save the changes, usually with the F10 key, and confirm the restart.

When to keep Secure Boot on and when to turn it off

For the vast majority of situations, Secure Boot should stay on. There are, however, a few exceptions where temporarily disabling it is justified:

In every case where it is disabled, the same principle applies: it is a temporary, deliberate decision, after which Secure Boot is ideally turned back on.

Common mistakes and myths about Secure Boot

A few inaccurate ideas circulate around Secure Boot that are worth clearing up:

• “Secure Boot is an antivirus.” It is not. It only checks the digital signature of software at startup, it does not scan for viruses or malicious code in a running system. Antivirus software and Secure Boot cover different stages of protection.
• “Turning off Secure Boot instantly means an infection.” That is not how it works. Disabling it only opens up one of several possible attack paths, the computer does not get infected on its own as a result. The risk grows mainly when combined with other factors, such as running software from unverified sources.
• “Secure Boot and TPM are the same thing.” As explained above, these are two different technologies that complement each other but work independently.
• “Secure Boot slows down the computer.” The signature check happens once at startup and takes a fraction of a second. It has no measurable effect on performance during everyday work, gaming, or running applications.

Troubleshooting common problems

The computer will not start after enabling Secure Boot. The most common cause is that Boot Mode is set to Legacy or CSM instead of UEFI, or that the disk contains corrupted boot records. Check in BIOS that UEFI mode is set, and if the problem persists, verify the status with msinfo32 after temporarily disabling it and starting from another drive.

“Secure Boot Violation” error. This message means the bootloader or operating system is not signed with a trusted key. It commonly happens with older bootable USB tools or a custom, unverified Linux kernel. The fix is to use the official, signed version of the tool or distribution that includes a so called shim loader, or to temporarily disable Secure Boot just for the duration of the needed operation.

A Linux installation does not work with Secure Boot enabled. Most common distributions (for example Ubuntu or Fedora) ship a signed shim and work fine with Secure Boot on, without any intervention. Problems mainly arise with proprietary drivers, typically NVIDIA graphics drivers. In that case the driver needs to be signed with a custom key and registered through the MOK manager (Machine Owner Key) tool, or you can temporarily switch to an open source driver alternative that has no issue with Secure Boot.

Should I keep it on?

Yes. For the vast majority of users it holds: keep Secure Boot on. It is extra protection that does not restrict you in any way in ordinary use and protects against a dangerous class of attacks. Modern Windows also requires it.

Turn it off only when you have a specific reason (for example installing a system that does not support it), and after finishing ideally turn it back on.

The connection with disk encryption

Secure Boot complements disk encryption well. Secure Boot protects the computer’s startup and encryption protects the data on the disk. Together they significantly complicate an attacker’s work.

Conclusion

Secure Boot is a quiet but important protection that, at the computer’s startup, does not let unsigned and potentially malicious code in. It protects against bootkits and rootkits that ordinary protection does not see, and together with TPM it forms the foundation of the Windows 11 requirements. For most people a simple rule holds: keep it on, and only turn it off deliberately, for as short a time as necessary.

This article is part of our Cybersecurity overview.