How to Fix Windows 11 Secure Boot Error During Installation

What Causes This?

The Windows 11 Secure Boot error usually appears when your PC is not configured to meet Microsoft’s installation requirements. In most cases, Secure Boot is turned off in UEFI/BIOS, the system is using Legacy/CSM boot mode instead of UEFI, or the disk is formatted with MBR instead of GPT. It can also happen if TPM 2.0 is disabled, since Windows 11 checks both Secure Boot and TPM during setup.

Common Symptoms

• Windows 11 Setup says your PC does not meet the minimum system requirements
• You see a message that Secure Boot must be enabled to install Windows 11
• PC Health Check reports Secure Boot is unsupported or off
• The installer stops even though your hardware seems compatible
• BIOS shows Legacy or CSM mode instead of UEFI mode

How to Fix It Manually

1. Check whether Secure Boot is currently enabled

   1. Press Windows + R, type msinfo32, and press Enter.
   2. In System Information, look for:
      • BIOS Mode — it should say UEFI
      • Secure Boot State — it should say On
   3. If BIOS Mode says Legacy, Secure Boot cannot be enabled until you switch to UEFI.

2. Confirm TPM 2.0 is available

   1. Press Windows + R, type tpm.msc, and press Enter.
   2. In the TPM Management window, check Status and Specification Version.
   3. Windows 11 needs TPM 2.0. If TPM is disabled, you may need to turn it on in BIOS/UEFI. It may appear as TPM, PTT (Intel), or fTPM (AMD).

3. Convert your system disk from MBR to GPT if needed

   1. Press Windows + X and choose Disk Management.
   2. Right-click your system disk and choose Properties > Volumes.
   3. Check Partition style:
      • GUID Partition Table (GPT) = good
      • Master Boot Record (MBR) = must be converted
   4. If the disk is MBR, open Command Prompt as Administrator:
      • Press Windows, type cmd
      • Right-click Command Prompt > Run as administrator
   5. Run:

      mbr2gpt /validate /allowFullOS
      mbr2gpt /convert /allowFullOS

   6. Restart your PC after the conversion completes.

4. Enable UEFI and Secure Boot in BIOS/UEFI

   1. Restart your PC and enter BIOS/UEFI setup. Common keys are F2, Del, Esc, or F10 during startup.
   2. Find the Boot or Security tab.
   3. Disable CSM or Legacy Boot if it is enabled.
   4. Set boot mode to UEFI.
   5. Turn Secure Boot to Enabled.
   6. If prompted, load default Secure Boot keys or choose Standard mode.
   7. Save changes and exit.

5. Verify the settings in Windows

   1. After rebooting, open msinfo32 again.
   2. Confirm:
      • BIOS Mode: UEFI
      • Secure Boot State: On
   3. Run the Windows 11 installer again.

6. Disconnect unnecessary drives and cleanup before retrying

   1. Unplug extra USB drives, external disks, and old bootable media.
   2. Make sure your Windows installation files are current if using a USB installer.
   3. Delete temporary files with Settings > System > Storage > Temporary files to avoid setup issues caused by low space or leftover update files.

Fix It Automatically with Kudu

If your PC is cluttered with temporary files, broken update leftovers, or other system junk, Kudu can help clean things up before you retry the Windows 11 installation. It gives you a faster way to remove unnecessary files and reduce common setup problems without digging through multiple Windows menus.

Download Kudu Free →