Secure Boot used to be something only enterprise IT admins worried about, but modern gaming has made it a player-side requirement. Several popular anti-cheat systems, including Riot’s Vanguard (Valorant) and EA’s kernel-level protection for titles like Battlefield, refuse to run unless Secure Boot is active alongside TPM 2.0. Windows 11 also expects it during installation. The good news: enabling Secure Boot for gaming takes 10–20 minutes on most systems and is completely reversible.
By the end of this guide, your PC will boot with Secure Boot enabled, your anti-cheat games will launch without the “Secure Boot must be enabled” error, and you’ll know how to verify the protection is actually active. This works on both Intel and AMD systems running Windows 10 or 11.
Before You Start
Secure Boot relies on UEFI firmware with keys installed, and switching from a legacy BIOS setup to UEFI is the part that trips people up. Check your current state first so you know whether you’re doing a five-minute toggle or a full conversion.
| What you need | Why | Optional? |
|---|---|---|
| UEFI-booted Windows installation | Secure Boot only works under UEFI, not legacy MBR/CSM boot | No |
| Administrator account in Windows | Converting the disk to GPT and running verification tools requires elevated privileges | No |
| TPM 2.0 enabled (firmware TPM on AMD, PTT on Intel) | Anti-cheat systems like Vanguard require both Secure Boot and TPM 2.0 | No |
| Full disk backup | The MBR-to-GPT conversion, if needed, carries a small risk of data loss | Recommended |
| Bootable media for Linux or older OSes, if you dual-boot | Some distros and old Windows versions won’t boot with Secure Boot on; you may need to disable it temporarily | Only if dual-booting |
| Gaming controller/keyboard for BIOS navigation | Not needed — you’ll use arrow keys; mouse support varies by motherboard | Yes |
Step-by-Step
1. Check whether your disk uses GPT or MBR (2 minutes)
Press Win + X and select Disk Management. Right-click your system disk (usually Disk 0), choose Properties, then open the Volumes tab. Look at Partition style: it will read either GUID Partition Table (GPT) or Master Boot Record (MBR). If it says GPT, skip to Step 3. If it says MBR, complete Step 2 first.
2. Convert MBR to GPT with mbr2gpt (5–10 minutes)
Right-click Start, select Terminal (Admin) or Windows PowerShell (Admin), and run:
mbr2gpt /validate /allowFullOS
If validation succeeds, run:
mbr2gpt /convert /allowFullOS
Then restart before continuing. What causes failure: the disk has more than three primary partitions or third-party boot managers. How to check: the validation output names the exact problem. What to do: delete unnecessary recovery partitions with Disk Management, or disable third-party boot loaders, then re-run validation. How to undo: if conversion fails mid-way, Windows typically remains bootable; restore from your backup if the system won’t start.
3. Confirm Windows booted in UEFI mode (1 minute)
Press Win + R, type msinfo32, and hit Enter. In System Summary, find BIOS Mode. It must say UEFI. If it says Legacy after your GPT conversion, you’ll need to re-enable UEFI boot in firmware settings during the next step.
4. Enter your motherboard’s UEFI firmware (2 minutes)
Restart the PC and tap the vendor key during POST: Del or F2 for ASUS, MSI, Gigabyte, and ASRock boards; F10 for HP; F2 or Fn + F2 on Dell; F1 on Lenovo desktops. If Windows boots before you can react, hold Shift while clicking Restart from the Start menu, then choose Troubleshoot → Advanced options → UEFI Firmware Settings → Restart.
5. Clear secure boot keys, then restore defaults (3–5 minutes)
The path varies by vendor, but the setting names are consistent:
- ASUS: Boot → Secure Boot → OS Type → set to Windows UEFI Mode; if keys show as “unusable,” go to Key Management → Install Default Secure Boot keys
- MSI: Settings → Advanced → Windows OS Configuration → Secure Boot → Secure Boot Support: Enabled, then Delete/Restore Factory Keys if prompted
- Gigabyte: BIOS → Boot → Secure Boot → set Secure Boot Enable, and use Restore Factory Keys under Key Management
- ASRock: Security → Secure Boot → set to Enabled, then Install Default Secure Boot Keys
If Secure Boot options are grayed out, first set OS Type to “Windows UEFI Mode” or disable CSM/Legacy Boot in the Boot menu — CSM blocks Secure Boot on nearly every board.
6. Enable TPM 2.0 while you’re in the firmware (2 minutes)
Since anti-cheat systems typically require both, do this in the same visit:
- Intel boards: Advanced → PCH-FW Configuration → PTT: Enabled, or under Security → Trusted Platform Module
- AMD boards: Settings → Miscellaneous or Advanced → AMD fTPM switch: Enabled (sometimes labeled “AMD CPU fTPM”)
Press F10 to save and exit, confirm, and let the system reboot into Windows.
7. Disable CSM if Secure Boot still won’t engage (3 minutes)
What causes it: Compatibility Support Module forces legacy boot behavior, which conflicts with Secure Boot. How to check: re-open msinfo32 — if BIOS Mode reads Legacy, or Secure Boot State reads Off in Step 8’s check, CSM is likely active. What to do: return to firmware, find CSM or Launch CSM under the Boot menu, set it to Disabled, save, and reboot. Your GPU firmware must be UEFI-capable (any card from roughly the last decade is). How to undo: re-enable CSM and set OS Type back to “Other OS” if an older device stops booting.
Verify It Worked
Open msinfo32 again and confirm three lines:
- BIOS Mode: UEFI
- Secure Boot State: On
- TPM: if listed, shows a version of 2.0
For a deeper check, right-click Start → Terminal (Admin) and run:
Confirm-SecureBootUEFI
The response True confirms Secure Boot is enforced. For TPM, run tpm.msc — the management console should report “The TPM is ready for use” with Specification Version 2.0.
Finally, launch the game that was blocking you. Valorant, for example, will show a Vanguard status icon in the system tray; hovering over it should list Secure Boot as satisfied. If the game launches and a full match loads without an anti-cheat error, you’re done.
Mistakes to Avoid
Enabling Secure Boot without converting MBR to GPT first. If the disk is still MBR, forcing UEFI/Secure Boot changes will leave you with “No bootable device found” at startup. Always validate with mbr2gpt before touching firmware settings. To recover: re-enter firmware, re-enable CSM, and set OS Type to “Other OS” until the conversion is complete.
Deleting secure boot keys without restoring factory keys. Some guides tell you to clear keys to fix conflicts, but if you exit firmware with keys deleted and Secure Boot set to Enabled, some boards won’t post cleanly. Always follow a key deletion with “Install/Restore Default Secure Boot Keys” before saving.
Assuming BitLocker will behave. Converting the partition style or changing boot mode can trigger BitLocker recovery on systems upgraded from Windows 10. Check Settings → Privacy & Security → Device Encryption before starting, and have your 48-character recovery key saved to your Microsoft account or printed. Retrieving it after the fact requires another device.
Disabling fTPM/PTT on a system that already uses it. Turning TPM off after BitLocker or Windows Hello is active can make encrypted data inaccessible. If you must toggle it, suspend BitLocker first with Suspend-BitLocker -MountPoint "C:" -RebootCount 1 in an admin terminal.
Leaving CSM half-configured. Setting Secure Boot to Enabled while CSM remains on produces a system that boots but never actually enforces Secure Boot — msinfo32 will show “Secure Boot State: Off” even though the firmware menu says enabled. CSM must be fully disabled.
FAQ
Will enabling Secure Boot hurt my gaming performance?
No. Secure Boot runs during the boot process and verifies signatures before Windows loads. It has no measurable effect on frame rates, load times, or latency once the OS is running. If anything, you gain performance consistency because anti-cheat games actually launch instead of blocking you at startup.
Do all games require Secure Boot?
No. Only titles using specific kernel-level anti-cheat systems mandate it — currently the most prominent is Riot Vanguard (Valorant, League of Legends) and certain EA titles. Most single-player games and many multiplayer games run fine with Secure Boot off. Check the game’s official support pages before assuming it’s required, but enabling it costs nothing and satisfies every current requirement.
Can I dual-boot Linux with Secure Boot enabled?
Usually, yes. Major distributions — Ubuntu, Fedora, openSUSE — ship signed bootloaders that work with Secure Boot out of the box. Niche distros or custom kernels may not. If you hit a boot failure, return to firmware and temporarily set OS Type to “Other OS” (which disables enforcement) rather than deleting your Linux entry, then boot normally.
What if my motherboard doesn’t support Secure Boot at all?
Boards sold before roughly 2012, or systems running Windows exclusively in Legacy mode with no UEFI option, may lack Secure Boot entirely. Check msinfo32 — if BIOS Mode says Legacy and your firmware has no UEFI toggle, the hardware can’t do it. In that case, the affected anti-cheat games won’t run on that machine; a motherboard or full system upgrade is the only path forward. Any board sold as Windows 11-compatible includes both Secure Boot and TPM 2.0 support by definition.
