Enabling Secure Boot sounds simple — flip a switch in BIOS and you're done. In practice, every motherboard brand labels the setting differently, buries it under a different menu, and ships with different defaults that get in the way. This guide walks through the three most common consumer brands — ASUS, MSI, and Gigabyte — with the exact steps and the gotchas that trip people up.
Before You Start — Check These Two Things
Secure Boot cannot be enabled on a system that's misconfigured at the OS or disk layer. Check both before opening BIOS:
- Confirm your drive is GPT, not MBR. Right-click the Start button → Disk Management → right-click your system disk (Disk 0) → Properties → Volumes tab. The Partition style should read GUID Partition Table (GPT).
- Confirm Windows is installed in UEFI mode. Press Win + R, type
msinfo32, and look at BIOS Mode. It must say UEFI.
If either check fails, Secure Boot will be greyed out or completely hidden until you convert the disk and switch to UEFI boot.
How to Enable Secure Boot on ASUS Motherboards
- Power on the PC and press DEL (or F2 on some boards) repeatedly to enter BIOS.
- Press F7 to switch to Advanced Mode.
- Go to the Boot menu.
- Find CSM (Compatibility Support Module) and set it to Disabled.
- Go to Secure Boot → set OS Type to Windows UEFI Mode.
- Press F10 to save and exit.
On some newer ASUS boards, the Secure Boot setting lives under the Security tab instead of Boot. If you don't see it under one, check the other.
Common error: Secure Boot is visible but greyed out. This almost always means CSM is still enabled — disable it, save, reboot back into BIOS, and Secure Boot should now be toggleable.
How to Enable Secure Boot on MSI Motherboards
- Power on and press DEL to enter the Click BIOS 5 interface.
- Go to Settings → Advanced → Windows OS Configuration.
- Set Secure Boot to Enabled.
- If you see a Secure Boot Mode dropdown, set it to Standard.
- Save and exit with F10.
If CSM is still enabled on your MSI board, Secure Boot will be locked. Disable CSM first under the same menu, save, reboot, and then enable Secure Boot.
How to Enable Secure Boot on Gigabyte Motherboards
- Power on and press DEL to enter BIOS.
- Go to the BIOS tab (or Tweaker → Advanced on some models).
- Find the Windows 10 Features (or Windows 8/10 Features) dropdown and set it to Windows 10.
- Set CSM Support to Disabled.
- Secure Boot should now be available — set it to Enabled.
- Save and reboot. Re-enter BIOS to confirm Secure Boot now shows as Enabled.
Gigabyte labels this setting unintuitively — the "Windows 10 Features" dropdown is the trigger that actually unlocks Secure Boot configuration. Many users get stuck here because the option appears unrelated.
Secure Boot Is Enabled But Windows 11 Still Won't Install?
Enabling Secure Boot is only one of the requirements. If Windows 11 setup still blocks you, the cause is usually one of:
- The system disk is still MBR (Secure Boot in BIOS doesn't change disk format).
- TPM 2.0 is missing or disabled — check for Intel PTT or AMD fTPM in BIOS.
- Secure Boot certificates are missing or corrupted from a previous install.
These are deeper issues that require more than flipping a BIOS switch. The SecureBootFix toolkit detects all of them in one pass and applies the right repair at each layer.
Quick Troubleshooting Reference
- Secure Boot greyed out → CSM still enabled. Disable CSM, save, reboot.
- Option not visible at all → System is in Legacy BIOS mode. Convert to UEFI first.
- Enabled but Windows 11 still fails the check → Likely MBR disk or missing TPM 2.0.
- Boot failure after enabling → Drive was MBR and now UEFI can't find a bootloader. Convert to GPT.
Wrapping Up
Every brand hides the setting in a different place, but the underlying steps are the same: disable CSM, switch to UEFI mode, enable Secure Boot. If you're still blocked after that, the issue is deeper than BIOS — and that's what the toolkit handles.