Fix Secure Boot State Unsupported in Windows
If Windows shows “Secure Boot State: Unsupported” in System Information, it means your PC’s firmware either doesn’t have Secure Boot enabled or doesn’t support it at all. The fix is to enter your UEFI/BIOS settings, enable Secure Boot (if available), and ensure your disk is GPT-partitioned with UEFI boot mode; if your firmware lacks the option, you may need to update it or replace the hardware. This article explains what the message means, how to fix it on most PCs, and what to do when Secure Boot simply isn’t available.
What Does “Secure Boot State: Unsupported” Mean?
Secure Boot is a UEFI firmware feature that verifies the digital signature of the operating system loader and drivers before allowing them to run. It prevents “bootkits” — malware that loads before Windows — from hijacking the boot process. When Windows reports “Unsupported,” it means the firmware (the BIOS/UEFI) either:
- Does not have Secure Boot enabled (most common on older or budget PCs).
- Is running in legacy BIOS/CSM mode instead of UEFI.
- Has a firmware version that predates Secure Boot support.
- Is a very old motherboard (pre-2011) that never implemented Secure Boot.
The message appears in System Information (msinfo32) under “Secure Boot State.” It does not necessarily mean your PC is broken — it simply means the feature is off or absent.
Why Does Windows 11 Require Secure Boot?
Windows 11’s minimum hardware requirements include UEFI with Secure Boot capability. Microsoft mandates it to increase baseline security across all devices. If your PC reports “Unsupported,” you cannot upgrade to Windows 11 through the normal Windows Update path, even if you bypass the TPM check. However, Windows 10 (and earlier) can run without Secure Boot, and many users continue using them.
How to Fix “Secure Boot State: Unsupported”
Follow these steps in order. Most fixes require entering the UEFI/BIOS setup, which is accessible by pressing a key (usually Del, F2, F10, or Esc) immediately after powering on the PC.
- Check current boot mode: Open System Information (msinfo32) and look at “BIOS Mode.” If it says “Legacy” or “BIOS,” your PC is booting in CSM mode. Secure Boot only works in UEFI mode.
- Enable UEFI boot mode: In BIOS, find “Boot Mode” or “Boot List Option” and change it from “Legacy” or “CSM” to “UEFI.” Save and exit.
- Enable Secure Boot: Look for “Secure Boot” under “Security,” “Boot,” or “Authentication” tabs. Set it to “Enabled” (or “Windows UEFI mode”).
- Reset Secure Boot keys: If the option is grayed out, try “Restore Factory Keys” or “Reset to Setup Mode.”
- Convert disk to GPT: If Windows doesn’t boot after switching to UEFI, your disk is likely MBR. Use the free MBR2GPT tool (from an elevated command prompt) to convert it without data loss:
mbr2gpt /convert. - Update firmware: Check your motherboard manufacturer’s website for a BIOS/UEFI update. Newer firmware may add Secure Boot options.
What If Your PC Doesn’t Have Secure Boot Option?
If you cannot find any Secure Boot setting in your BIOS, your hardware may genuinely not support it. This is common on PCs from around 2012 or earlier, and on some budget laptops. In that case:
- You cannot enable Secure Boot — no software tweak will create it.
- You can still run Windows 10, but not Windows 11 officially.
- You can use a workaround for Windows 11 (like modifying the ISO), but that violates Microsoft’s requirements and may leave your system less secure.
- Consider replacing the motherboard or PC if Secure Boot is a hard requirement for you.
Common Mistakes and Misconceptions
- “Unsupported” means “disabled” — not always. It can also mean the firmware lacks the feature entirely.
- Enabling Secure Boot without UEFI mode does nothing. Both must be active.
- Changing boot mode can make Windows unbootable. Always back up data before switching from Legacy to UEFI.
- Secure Boot is not the same as TPM. TPM (Trusted Platform Module) is a separate chip; Windows 11 requires both.
Secure Boot vs. Legacy BIOS: What’s the Difference?
Legacy BIOS uses the Master Boot Record (MBR) and runs in 16-bit real mode. It has no built-in security verification. UEFI is the modern replacement, using GUID Partition Table (GPT) and offering Secure Boot. UEFI also boots faster and supports larger disks. If your PC is from the last decade, it almost certainly has UEFI — but it may be configured to run in legacy mode for compatibility.
Frequently Asked Questions
Q: Can I enable Secure Boot on a PC that doesn’t have the option?
No. If the firmware doesn’t expose a Secure Boot setting, it likely doesn’t support the feature. Updating the BIOS might add it on some models, but if it’s not there after an update, the hardware is too old.
Q: Will enabling Secure Boot erase my data?
No. Turning on Secure Boot itself doesn’t erase data. However, switching from Legacy to UEFI mode can prevent Windows from booting until you convert the disk to GPT. That conversion is non-destructive, but it’s wise to back up first.
Q: Why does System Information show “Unsupported” even though Secure Boot is enabled?
This usually happens when Windows is booted in Legacy mode. Even if Secure Boot is enabled in BIOS, it only applies when booting via UEFI. Check “BIOS Mode” — it must say “UEFI.”
Q: Is it safe to use Windows 10 without Secure Boot?
Yes. Secure Boot is a security enhancement, but Windows 10 does not require it. You lose some protection against bootkits, but the OS runs normally.
Q: Can I install Windows 11 if Secure Boot is unsupported?
Officially, no. Microsoft’s Windows 11 requirements include UEFI with Secure Boot. There are unofficial workarounds, but they involve modifying the installation media and may not receive updates or support.
Q: How do I check if my disk is GPT or MBR?
Open Disk Management (diskmgmt.msc), right-click the disk, choose Properties, go to Volumes tab, and look at “Partition style.” GPT is required for UEFI boot.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.