Secure Boot: check before you change

Check the current state first

Press Win + R, enter msinfo32, and inspect BIOS Mode and Secure Boot State. Record both before changing firmware settings.

Prepare your recovery options

If device encryption or BitLocker is enabled, make sure you can access your recovery key. Follow the operating-system and manufacturer instructions for any firmware change that can affect recovery.

Use the exact board instructions

Secure Boot requires an appropriate UEFI boot configuration. Disabling CSM or switching a legacy installation to UEFI without preparation can stop that installation from booting. Do not change these options blindly.

For MSI AM4, start with the official MSI Secure Boot and TPM guide. Its steps and defaults should not be assumed for every MSI board or firmware.

Verify after restarting

Reopen System Information and check the operating-system state. A firmware toggle labelled Enabled does not by itself prove that Secure Boot is active with the necessary keys enrolled.

This is a preparation checklist. It does not instruct you to clear TPM data, delete Secure Boot keys, or alter disk partitions.

Original sources

Source-linked editorial summary · Reviewed 2026-10-22 · Not hardware-tested