How to Fix Secure Boot State Off in System Information, but On in BIOS

Secure Boot is an important security feature that helps protect your Windows 11 PC from malicious software and unauthorized bootloaders during startup. It is also one of the official requirements for installing and running Windows 11. Many users enable Secure Boot in their BIOS or UEFI settings, only to find that System Information in Windows still shows the Secure Boot State as Off.

This discrepancy can be confusing because it suggests that Secure Boot is enabled in firmware but not active within Windows. The issue is usually caused by incorrect boot mode settings, disabled Platform Keys (PK), incompatible partition styles, or firmware misconfigurations. In some cases, recent BIOS updates or changes to boot settings can also prevent Windows from recognizing Secure Boot properly.

Fortunately, there are several ways to resolve this issue and ensure that Windows 11 correctly detects Secure Boot as enabled. In this guide, we will walk you through all the effective solutions step by step.

How to Fix Secure Boot State Off in System Information, but On in BIOS

1. Verify Secure Boot Status in Windows

Before making any changes, confirm the current Secure Boot status in Windows.

1. Press Windows + R to open the Run dialog box.
2. Type msinfo32 and press Enter.
3. In the System Summary section, locate:
   • BIOS Mode
   • Secure Boot State
4. Verify whether:
   • BIOS Mode shows UEFI
   • Secure Boot State shows Off

If BIOS Mode is set to Legacy, Secure Boot cannot function properly.

2. Ensure the System Uses UEFI Mode

Secure Boot only works when Windows is installed in UEFI mode.

1. Press Windows + X and select Terminal (Admin).
2. Run the following command:

diskpart

3. Then type:

list disk

4. Check whether an asterisk (*) appears under the GPT column.

If your system drive uses MBR instead of GPT, Secure Boot may not work correctly.

You may need to convert the disk to GPT before Secure Boot can be enabled fully.

3. Convert MBR to GPT (If Necessary)

If your disk uses the MBR partition style, convert it to GPT using the MBR2GPT tool.

1. Open Terminal (Admin).
2. Validate the disk:

mbr2gpt /validate /allowFullOS

3. If validation succeeds, run:

mbr2gpt /convert /allowFullOS

4. Restart your computer.
5. Enter BIOS and switch the boot mode to UEFI if necessary.

After conversion, check the Secure Boot status again.

4. Disable Compatibility Support Module (CSM)

Some motherboards disable Secure Boot automatically when CSM or Legacy Boot is enabled.

1. Restart your PC and enter BIOS or UEFI settings.
2. Locate the Boot or Advanced section.
3. Find CSM (Compatibility Support Module).
4. Set CSM to Disabled.
5. Save the changes and restart your computer.

Once Windows boots, open System Information to verify whether Secure Boot is now active.

5. Restore Factory Secure Boot Keys

Secure Boot requires Platform Keys (PK) and other security keys to function.

1. Enter BIOS or UEFI settings.
2. Navigate to the Secure Boot section.
3. Look for an option such as:
   • Install Default Secure Boot Keys
   • Restore Factory Keys
   • Reset to Setup Mode
4. Install or restore the default keys.
5. Save the changes and restart your PC.

Windows should now recognize Secure Boot correctly.

6. Enable Secure Boot in Standard Mode

Some BIOS versions offer multiple Secure Boot modes.

1. Open BIOS settings.
2. Navigate to Secure Boot.
3. Ensure:
   • Secure Boot is Enabled
   • Secure Boot Mode is set to Standard
4. Save the settings and restart your computer.

Using Custom mode without proper keys may cause Windows to display Secure Boot as disabled.

7. Update Your BIOS or UEFI Firmware

Outdated firmware can sometimes cause Secure Boot detection issues.

1. Identify your motherboard or laptop model.
2. Visit the manufacturer’s support website.
3. Download the latest BIOS update.
4. Follow the manufacturer’s instructions to install the update.
5. Restart your computer after updating.

After the update, verify the Secure Boot status again.

8. Check TPM Status

Secure Boot and TPM often work together to meet Windows 11 requirements.

1. Press Windows + R.
2. Type tpm.msc and press Enter.
3. Verify that TPM is:
   • Present
   • Enabled
   • Ready for use

If TPM is disabled, enable it in BIOS.

9. Reset BIOS Settings to Default

Incorrect firmware settings may prevent Secure Boot from functioning properly.

1. Enter BIOS or UEFI settings.
2. Locate:
   • Load Optimized Defaults
   • Restore Defaults
3. Apply the default settings.
4. Re-enable:
   • UEFI mode
   • Secure Boot
5. Save and restart your PC.

This can resolve hidden configuration conflicts.

10. Verify Secure Boot Using PowerShell

After making changes, verify whether Windows detects Secure Boot correctly.

1. Open Windows PowerShell as administrator.
2. Run the following command:

Confirm-SecureBootUEFI

3. Review the result:
   • True = Secure Boot is enabled
   • False = Secure Boot is disabled

If the command returns True, Windows now recognizes Secure Boot correctly.

Conclusion

If System Information shows Secure Boot State: Off even though Secure Boot is enabled in BIOS, the issue is usually related to boot mode settings, missing Secure Boot keys, Legacy/CSM mode, or an MBR partition style. In most cases, converting the system disk to GPT, disabling CSM, and restoring factory Secure Boot keys successfully resolve the problem.

Once Secure Boot is properly configured, Windows 11 should recognize it as enabled, helping your system meet security requirements and improve protection against boot-level threats.