Check Secure Boot status before touching PC firmware

Secure Boot checks trusted signed software during startup. A status message may help explain a warning, but changing UEFI settings without understanding disk encryption and boot configuration can leave a PC unable to start or asking for a recovery key.

Before you start​

Before any firmware change, locate the device manufacturer's model documentation and your BitLocker recovery key if encryption is active. On a managed machine, ask IT first.

Do it step by step​

1. Open Windows Security, Device security, and look for Secure boot information. Record the shown state and any warning rather than immediately changing firmware.
2. Confirm the Windows edition and hardware model. Check whether the PC is already receiving normal Windows and firmware updates.
3. Read Microsoft's Secure Boot guidance and the manufacturer's instructions for this exact model. Make a recovery plan before entering UEFI settings.
4. If Secure Boot is already enabled, leave it on and address any separate certificate-update status through supported Windows Update guidance.
5. If it is off and you intend to enable it, arrange a maintenance window and follow vendor instructions; after reboot, recheck Device security and normal startup.

Check the result​

Windows should boot normally and Device security should show the intended state. Keep the recovery key accessible until the change has been tested through a restart.

If something goes wrong​

If Device security lacks a Secure Boot tile, capability or management policy may differ. Do not force firmware values copied from another model.

Know the limit​

Secure Boot is a startup trust layer, not proof that Windows has no malware. Microsoft recommends checking the PC manufacturer's guidance before firmware changes. Microsoft's Secure Boot guidance Microsoft's Device security overview