You opened System Information to check whether your PC can run Windows 11, and next to Secure Boot State it says Unsupported.
That word is misleading. In most cases it doesn’t mean your PC can’t do Secure Boot, it means Windows can’t see it right now. There are three different situations behind that one message, and only one of them is bad news.
What the three values actually mean
Press Win + R, type msinfo32, press Enter. Look at two rows:
| BIOS Mode | Secure Boot State | What it means |
|---|---|---|
| UEFI | On | Everything is fine |
| UEFI | Off | Hardware supports it, it’s just disabled in firmware |
| Legacy | Unsupported | Your drive uses the old MBR partition style — fixable |
| UEFI | Unsupported | Firmware genuinely lacks Secure Boot (older or unusual boards) |
The row that matters is BIOS Mode. If it says Legacy, your hardware is almost certainly fine — Windows was just installed the old way. That’s the common case, and it’s fixable without reinstalling anything.
Why this matters
Windows 11 requires Secure Boot and TPM 2.0. If Secure Boot shows as Unsupported, the upgrade will be blocked and PC Health Check will fail you. Some anti-cheat systems in newer games also require it now.
Case 1: BIOS Mode says Legacy — convert to UEFI
Your disk uses MBR partitioning, which can’t do UEFI boot, which means Secure Boot is unavailable. Windows includes a tool that converts MBR to GPT without deleting your data.
Back up first. This works reliably, but you’re changing the partition table on your boot drive. Don’t skip this.
Step 1 — check the disk can be converted
Open Command Prompt as administrator and run:
mbr2gpt /validate /allowFullOSIf you get Validation completed successfully, continue. If it fails, note the error: the most common one is that the disk has more than three primary partitions, or there’s not enough free space at the start of the disk for the EFI partition.
Step 2 — find your disk number
diskpart
list disk
exitNote the number of the disk Windows is on, usually 0.
Step 3 — convert
mbr2gpt /convert /disk:0 /allowFullOSReplace 0 with your disk number. It takes under a minute.
Step 4 — switch the firmware to UEFI
This part is essential. If you convert the disk but leave the firmware in Legacy/CSM mode, the PC won’t boot.
- Restart and enter your BIOS/UEFI (tap
Del,F2,F10orF12— your splash screen says which) - Find Boot Mode, CSM, or Launch CSM, usually under Boot or Advanced
- Set boot mode to UEFI and disable CSM (Compatibility Support Module)
- Save and exit
Step 5 — enable Secure Boot
Back in the firmware:
- Look under Boot, Security, or Authentication for Secure Boot
- Set Secure Boot Mode or OS Type to Standard or Windows UEFI mode
- Set Secure Boot to Enabled
- If it’s greyed out, see the section below
- Save and exit
Check msinfo32 again. BIOS Mode should read UEFI and Secure Boot State should read On.
Case 2: BIOS Mode says UEFI, Secure Boot is Off
Simpler: the hardware is ready, the setting is just off. Go straight to Step 5 above.
When Secure Boot is greyed out
This trips up a lot of people. Two things usually cause it:
No administrator password set. Many firmwares refuse to let you change security settings until a supervisor/administrator password exists. Find Set Supervisor Password or Administrator Password under the Security tab, set one, then Secure Boot becomes editable.
Write that password down. Some boards make it genuinely difficult to clear.
Secure Boot keys aren’t loaded. Look for Restore Factory Keys, Install Default Secure Boot Keys, or Reset to Setup Mode and run it. That loads Microsoft’s default certificates, after which Secure Boot can be enabled.
Also check that CSM is fully disabled — many boards keep Secure Boot locked while any compatibility module is active.
If the PC won’t boot after enabling Secure Boot
Go back into the firmware and turn Secure Boot off. You’re back where you started, nothing is broken. Then check:
- Is CSM disabled?
- Was the disk actually converted to GPT? Run
msinfo32and confirm BIOS Mode says UEFI. - Do you dual-boot Linux? Some distributions need their own key enrolled, or work only with Secure Boot off.
- Do you have an old graphics card? Cards from before roughly 2013 have non-UEFI video BIOS and can produce a black screen with CSM disabled.
Case 3: genuinely unsupported firmware
If BIOS Mode already says UEFI and there’s no Secure Boot option anywhere in the firmware, check for a BIOS update from your motherboard or PC manufacturer first. Some boards from around 2012–2015 gained Secure Boot in a later firmware release.
If there’s no update and no option, the board doesn’t support it. Windows 10 runs fine; Windows 11 won’t officially install. There are unofficial ways around the requirement, but they leave you on an unsupported configuration that can break at any update, so it isn’t something to rely on for a machine you depend on.
Check TPM at the same time
Windows 11 needs both Secure Boot and TPM 2.0, so you may as well check both while you’re in there.
Press Win + R, type tpm.msc, press Enter.
- “The TPM is ready for use” with Specification Version 2.0 — you’re set
- “Compatible TPM cannot be found” — it’s probably disabled in firmware
In the firmware, look for:
- Intel — PTT (Platform Trust Technology), usually under Advanced → PCH-FW Configuration
- AMD — fTPM or AMD CPU fTPM, usually under Advanced → AMD fTPM configuration
Set it to Enabled. It’s firmware-based, so you don’t need a physical TPM chip on most machines built after about 2016.
Quick reference
| Symptom | Fix |
|---|---|
| BIOS Mode: Legacy | Run mbr2gpt, then switch firmware to UEFI |
| BIOS Mode: UEFI, Secure Boot Off | Enable it in firmware |
| Secure Boot option greyed out | Set a supervisor password, or restore factory keys |
| No Secure Boot option at all | Update the BIOS; if none, hardware doesn’t support it |
| PC won’t boot after enabling | Disable it again, verify CSM is off and disk is GPT |
| Secure Boot on but Windows 11 still blocked | Check TPM 2.0 in tpm.msc |
Common questions
Does converting MBR to GPT delete my files? mbr2gpt is designed to convert in place without data loss, and it works reliably. Back up anyway — any operation on a partition table carries some risk, and a backup takes ten minutes.
Do I need to reinstall Windows to get Secure Boot? No. That was the old advice and it’s out of date. mbr2gpt has shipped with Windows since version 1703 specifically so you don’t have to.
Is Secure Boot worth enabling if I’m staying on Windows 10? It’s a genuine security improvement — it stops unsigned code loading during boot, which blocks a class of bootkit malware. Not urgent, but worth having.
Will enabling Secure Boot break my dual-boot Linux setup? Ubuntu, Fedora and other major distributions support Secure Boot out of the box. Smaller distributions and custom kernels may need their key enrolled through MOK, or Secure Boot turned off.
My PC is quite new and still shows Legacy. That happens when Windows was installed from a USB drive that booted in Legacy mode. The hardware is fine: the install just went down the old path. mbr2gpt fixes it.
Do these in order: convert the disk first, then change the firmware. If you enable UEFI mode in firmware while the disk is still MBR, the machine won’t boot and you’ll have to go back into the BIOS to undo it.
