Windows 10: Enable Secure Boot Without Reinstalling
Updated October 21, 2026
Overview
In most cases you can enable Secure Boot without reinstalling. The prerequisite is that your Windows disk is partitioned as GPT and the PC boots in UEFI mode. Secure Boot will not work if Windows was installed in legacy BIOS/CSM mode on an MBR disk. Enabling it without checking first can cause Windows to fail to boot (easily fixed by turning it back off).
Step 1: Check Your Current State
Press Win + R, type msinfo32, and press Enter. Look at these two lines:
- BIOS Mode: UEFI or Legacy
- Secure Boot State: On, Off, or Unsupported
If BIOS Mode says UEFI, skip to Step 3. If it says Legacy, continue to Step 2.
Step 2: Convert MBR to GPT (Only if in Legacy Mode)
Windows 10 includes MBR2GPT, which converts the disk in place without wiping anything. Open an administrator Command Prompt and run:
mbr2gpt /validate /allowFullOS
If validation passes, run:
mbr2gpt /convert /allowFullOS
Then reboot into your BIOS/UEFI settings, switch the boot mode from Legacy/CSM to UEFI, and disable CSM. Windows should boot normally. MBR2GPT needs the disk to have no more than three primary partitions (it needs room to add the EFI system partition), so if validation fails, that is the usual cause.
Step 3: Enable Secure Boot
Enter the BIOS/UEFI setup (usually Del, F2, F10, or F12 at startup). Look under the Boot or Security tab for Secure Boot and enable it. Some boards want you to set the OS type to "Windows UEFI" or load the default Secure Boot keys first.
If the option is greyed out, CSM is probably still enabled, or you may need to select "Restore Factory Keys" / "Install default Secure Boot keys."
After booting back into Windows, run msinfo32 again and confirm Secure Boot State says On.
Enabling TPM in the BIOS
Enabling TPM in the BIOS is safe and does not require reinstalling Windows. It is usually listed as TPM, fTPM (AMD), or PTT (Intel) under the Security or Advanced tab.
Check for encryption first. If BitLocker or Device Encryption is turned on, changing TPM settings can trigger a BitLocker recovery prompt at the next boot, and you would need your recovery key to get in. Check under Settings > Privacy & security > Device encryption (or "BitLocker drive encryption" in Control Panel), and make sure you have the recovery key saved, ideally in your Microsoft account at account.microsoft.com/devices/recoverykey, before making the change. If encryption is off, there is nothing to worry about.
Check whether it is already on. Before going into the BIOS, run tpm.msc. If Windows already detects a TPM, it may be enabled and need no change.
Cautions
- Back up important data first. MBR2GPT is reliable, but any partition-table change is worth a backup.
- Secure Boot is not the only Windows 11 requirement. You also need TPM 2.0 (check with
tpm.msc), a compatible CPU, 4 GB RAM, and 64 GB storage. Run the PC Health Check app to confirm Secure Boot is the only thing blocking you. - On a custom-built or older PC, the BIOS may not support UEFI Secure Boot at all, in which case this route will not work.