Unsolved
1 Rookie
•
2 Posts
•
7 Points
0
39
May 21st, 2026 00:36
Windows 11 Secure Boot is Off
I bought a Windows 11 Latitude 5300 that came with Secure Boot Off in the BIOS/UEFI. When I turn it on it obviously doesn't recognize the GPT installed and then goes into a quick Memory Diagnostics check which I escape out of.
I don't understand how they installed Windows 11... but with all this secure boot certificate talk about Windows 11 I wanted to bring this notebook into compliance.
Turning back the secure boot checkbox simply allows the notebook to boot again.
No Events found!
montyinc
1 Rookie
•
2 Posts
•
7 Points
0
May 21st, 2026 04:10
To get secure boot on my notebook. I had to create Windows 11 media (via microsoft.com). Turn on secure boot in BIOS/UEFI and reinstall Windows 11. Hopefully now my notebook has a little bit more security. (Of course backup your data before you reinstall.)
anne_droid
5 Journeyman
•
1.6K Posts
•
6.1K Points
0
May 21st, 2026 11:15
Hi
Well the advice above, from @montyinc, is very pertinent.
The internet has an expanded version ........
Pre-checks (do these first)
Confirm Secure Boot is actually OFF and BIOS mode (UEFI vs Legacy). Open System Information (msinfo32) and check "Secure Boot State" and "BIOS Mode."
Back up important files before changing firmware/boot mode — switching boot mode or partition type can make the system unbootable if something goes wrong.
Ensure your PC supports UEFI/Secure Boot (most systems made since ~2012 do).
If BIOS Mode = UEFI and Secure Boot is OFF
Restart into your UEFI/BIOS firmware settings via Windows: Settings > System > Recovery > Advanced startup > Restart now > Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.
In the UEFI settings, find the Secure Boot option (often under Security, Boot, or Authentication) and change it from Disabled to Enabled, then Save and Exit.
Reboot to Windows and confirm Secure Boot State now shows On in msinfo32.
If BIOS Mode = Legacy (CSM) or system disk uses MBR
You must convert the system to UEFI boot (and if needed convert the disk to GPT) before enabling Secure Boot. Do this without reinstalling Windows using the built-in Microsoft tool as follows:
Run Command Prompt as Administrator and validate conversion: mbr2gpt /validate /allowfullos.
If validation succeeds, convert with: mbr2gpt /convert /allowfullos. This updates partitioning and creates the necessary EFI partition.
Restart to UEFI firmware settings (use Advanced startup as above) and change Boot Mode/Boot List Option from Legacy/CSM to UEFI. Disable CSM if present. Save and Exit.
Then enable Secure Boot in the UEFI settings and save. Reboot and verify Secure Boot State = On in msinfo32.
Troubleshooting notes (common issues)
If the Secure Boot option is greyed out, look for a "Windows OS Configuration", "OS type", or "Secure Boot Mode" setting and set it to Windows UEFI/Standard/User before enabling Secure Boot.
Some OEMs require clearing or resetting Secure Boot keys before enabling; the BIOS may offer "Install default keys" or "Reset to Setup Mode" — use the default platform keys if prompted.
If mbr2gpt validation fails, check that you have enough free partitions (it needs to create an EFI partition) and that the disk is the OS disk; resolve partition issues or back up and use a clean install if conversion isn't possible.
Example quick command sequence (if you’re comfortable)
Open admin Command Prompt: mbr2gpt /validate /allowfullos
If OK: mbr2gpt /convert /allowfullos
Reboot into UEFI and switch Boot Mode to UEFI, then enable Secure Boot in firmware, save, reboot, verify with msinfo32.