Can I enable Secure Boot after installing Windows 11?

Topic

New Reply

The story: I bought a refurbished Dell Optiplex that had no operating system. I installed Win 11 using a USB stick made with media creation tool. Now I notice that secure boot is off according to the system info page (msinfo32).

It seems like it had to be off in order to allow system files to be written from the USB stick.

I’m not sure if I can just enter BIOS now and change it to enabled. Are there any steps to take before doing that? I saw a comment somewhere about unplugging all drives except the boot drive before doing it, then testing to see if it boots after the change, etc.

Or would enabling it require a reinstall?

Thanks in advance

Reply | Quote

Replies

Seattle27 wrote:

It seems like it had to be off in order to allow system files to be written from the USB stick.

What made it seem like that?

Reply | Quote

I read that somewhere (after the install), and it seemed to make sense to me that if secure boot was on that it wouldn’t allow writing of executables from a USB stick. How would it know that the stick had been made with MCT and hence be safe? Is the BIOS capable of recognizing something in the files created by MCT that would allow them to pass?

Anyway, what’s your take on enabling secure boot now after the install?

Reply | Quote

Seattle27 wrote:

Is the BIOS capable of recognizing something in the files created by MCT that would allow them to pass?

Yes, a signed bootloader:

When the PC starts, the firmware checks the signature of each piece of boot software,

Microsoft Learn — Secure Boot

 

Seattle27 wrote:

Anyway, what’s your take on enabling secure boot now after the install?

It shouldn’t cause a problem either before or after installation.

Dell’s instructions are included at a link in this Microsoft article:

Windows 11 and Secure Boot

1 user thanked author for this post.

Seattle27

Reply | Quote

Seattle27 wrote:

if secure boot was on that it wouldn’t allow writing of executables from a USB stick

Secure boot is an attempt to prevent malicious software booting from USB etc. and installing malware on your system.
If you can boot from USB with secure boot on, you can do any copying you want.

cheers, Paul

Reply | Quote