Secure boot

meaks89

meaks89

meaks89

Associate
Joined
5 Jun 2025
Posts
32
Location
UK
Hi,

Trying to update windows 10 to 11 and PC health checker says PC must support secure boost.

Asus b450 f gaming Rogers strix motherboard.

I have gone into bios, turned csm off. Restart - straight back to bios, I have selected uefi boot device control only. And takes me back to bios after restart.

Not clued up on any of this but any simple guidance anyone can give would be appreciated, thanks
 
My understanding is Windows 11 requires the motherboard to support Secure Boot feature but you don't have to enable it to install.

If you do turn on Secure Boot be aware Windows will automatically start encrypting your disks with BitLocker. This can be turned off in settings if/when you boot into Windows.
 
Last edited:
meaks89 said:
I have gone into bios, turned csm off. Restart - straight back to bios, I have selected uefi boot device control only. And takes me back to bios after restart.
Click to expand...
What is the problem exactly? That once CSM is off you can't boot into Windows? If so, you probably don't have your boot drive formatted using GPT. Drives formatted to MBR are not bootable with secure boot enabled and CSM off.
 
meaks89 said:
I'm at a loss to how to do this
Click to expand...
Can you explain where you're getting stuck in this process?

I don't understand from your post what the problem you're having is.

Going straight back to BIOS, is sometimes not even a problem, as such, you just have to select the boot device again.

But, I don't know if you're telling us that going into the BIOS is the problem you're having here, or not?

If it is (with CSM disabled) returning to the BIOS and skipping your boot drive, then the most likely reason is the drive being formatted to MBR. You will need to check that once in Windows.
 
How do I check once in windows as I think thats probably the issue.

In bios the secure boot says enabled but its greyed out.
 
meaks89 said:
How do I check once in windows as I think thats probably the issue.
Click to expand...
You can use disk management in Windows (part of Windows, not an app). Easier if you google it, but you need to find "Disk 0" near the bottom, right click and select properties and then under volume tab it should say partition style.

Or: diskpart (open command prompt as admin, type > diskpart > type list disk, if they don't have GPT * then they're MBR.
 
meaks89 said:
How do I check once in windows as I think thats probably the issue.

In bios the secure boot says enabled but its greyed out.
Click to expand...
Is there a button on the Secure Boot menu page in the BIOS that says something like Load Default Keys?

From AI "If Windows was installed in Legacy (BIOS) mode, the firmware has nothing to boot after you turn CSM off, so it simply returns to the setup screen every time." That could be a problem, you will need to lookup how to convert Windows to UEFI. But you need to fix the Secure Boot first.
 
Last edited:
RavenLunatic said:
If you do turn on Secure Boot be aware Windows will automatically start encrypting your disks with BitLocker. This can be turned off in settings if/when you boot into Windows.
Click to expand...
Secure Boot is about only allowing the system to boot into OS's which have had their bootloaders signed, it's got nothing to do with BitLocker.

BitLocker needs the TPM to be enabled. Personally I've not heard of it automatically encrypting an existing system if you enable the TPM after the OS was installed. It might automatically encrypt a brand new installation if you sign in to a Microsoft Account as part of the setup process. It certainly never automatically encrypts if you're not using a Microsoft Account.
 
andshrew said:
Secure Boot is about only allowing the system to boot into OS's which have had their bootloaders signed, it's got nothing to do with BitLocker.

BitLocker needs the TPM to be enabled. Personally I've not heard of it automatically encrypting an existing system if you enable the TPM after the OS was installed. It might automatically encrypt a brand new installation if you sign in to a Microsoft Account as part of the setup process. It certainly never automatically encrypts if you're not using a Microsoft Account.
Click to expand...
I did this last week on one of my PC's, disabling CSM and enabled Secure Boot. It then unknown to me turned on BitLocker encrypting my Windows OS partition and a connected SSD storage Partition. I only found out when I booted my Ubuntu OS and the Windows Partitions where marked encrypted. Booting into Windows confirmed it. I wasn't expecting that as you say Secure Boot and Bitlocker are meant to be different things, but it happened.
 
If your W10 OS was installed on a drive formatted for MBR, turning off CSM wil switch the BIOS over to UEFI-only and make that drive "dissappear" as a boot option.
*edit* I see this was already posted...
 
Last edited:
I did this a while back and did it online (the live method). There should be guides covering this but this is something you can base it on. If you have stuff backed up or are not bothered then its an option over starting fresh.
 
Last edited:
You must log in or register to reply here.
Back
Top Bottom