How to check if Secure Boot is enabled from CMD and PowerShell

Secure Boot is a built - in security feature in systems using UEFI (Unified Extensible Firmware Interface), designed to ensure that the computer boots using only trusted software. It is especially important in environments where the security of the operating system and its components must be guaranteed from the moment the computer is turned on.

In many situations, such as when you want to install an alternative operating system or check if your computer is ready for standards like those required by Windows 11, you may need to know if Secure Boot is enabled. This can be easily done. from the line of commands in Windows using tools like msinfo32 or the cmdlet of PowerShell Confirm-SecureBootUEFI.

What is Secure Boot and what is it for?

Secure Boot is a security mechanism present in UEFI systems that prevents unsigned or uncertified software from running during the boot process. This prevents, for example, the loading of malware or any type of software that does not come from a source verified by the OEM.

This system was introduced by Microsoft with Windows 8 and has been a fundamental part of security improvements in subsequent versions, including Windows 10 and Windows 11. When enabled, the UEFI firmware verifies that all digital signatures of drivers, operating systems , and boot software are valid before allowing them to run.

Check if Secure Boot is enabled from Windows

Instead of restarting the computer and directly accessing the BIOS or UEFI, Windows allows you to check whether Secure Boot is enabled using built-in tools. This greatly simplifies the process for users who are inexperienced in manipulating their computer's firmware settings.

Option 1: System Information (msinfo32)

• Balance Windows + R to open the run box.
• Write msinfo32 and press Enter.
• In the window that appears, find the field Secure Boot State.

This field will display one of the following values:

• Able: The system has Secure Boot enabled.
• Disabled: Secure Boot is inactive, but available.
• Not compatible: : Your device's firmware does not support this feature.

Option 2: Using PowerShell with Confirm-SecureBootUEFI

For more advanced users, you can open a PowerShell console with administrator privileges and run the following command:

Confirm-SecureBootUEFI

This cmdlet returns:

• True: Secure Boot is enabled.
• False: Secure Boot is disabled.
• Compatibility Error: Indicates that the system does not support UEFI or Secure Boot.

This method is especially useful for audit scripts or business environments where you want to automate the checking of the security status of multiple computers.

Common errors when running Confirm-SecureBootUEFI

When you run the cmdlet, you might get an error such as "Cmdlet not supported on this platform" . This can be due to two factors:

• Your BIOS is set to Legacy mode instead of UEFI.
• Your firmware does not have Secure Boot available or active., something common in older or customized equipment.

Importance of Secure Boot in Windows 11

One of the mandatory requirements for installing Windows 11 is having Secure Boot enabled, along with TPM 2.0. This decision by Microsoft stems from the need to establish a more robust security foundation for new operating systems. Secure Boot works in conjunction with other technologies such as BitLocker and Windows Hello to provide a more secure environment from startup.

If you're unsure whether your computer can run Windows 11, checking the Secure Boot status is an essential diagnostic step. You can learn more about how to do this by accessing your BIOS or UEFI.

Manual review from BIOS or UEFI

If after using the methods above you still have doubts or need to enable/disable Secure Boot , you will need to access your computer's BIOS/UEFI directly:

• Restart your computer and press the corresponding key to access the BIOS (usually F2, Del or Esc).
• Once inside, look for the tab Security o Boat.
• There you will find the option Secure Boot. You will be able to change its status between Enabled y Disabled.

Please note that not all manufacturers allow you to modify this setting . In some cases, the option may be locked or unavailable if the system does not meet certain requirements.

Compatibility and errors in business environments

In environments like Microsoft Intune, devices may appear as incompatible with security requirements even though Secure Boot is enabled. This is especially true when working with devices using TPM 1.2 , as many policies require TPM 2.0, which needs full UEFI support to function correctly. To better understand the differences between these TPM modules, review the differences between TPM 1.2 and TPM 2.0.

When a Mobile Device Management (MDM) policy is configured to require Secure Boot and TPM 2.0, devices that do not meet either of these requirements may appear as "Not Supported ." To avoid confusion, it is recommended to properly audit the TPM version and firmware configuration, ensuring that:

• TPM is enabled and visible from the console tpm.msc.
• BIOS mode is in UEFI, which can be verified with Reviewing the Windows 11 installation.
• The PCR7 configuration is linked to volume protection.

Check additional protections

To check if the system disk is protected by PCR7 (Platform Configuration Register), you can run the following command from PowerShell:

manage-bde -protectors -get $env:systemdrive

This command displays the BitLocker protectors, and if it says it's associated with PCR7, it means that Secure Boot and other security measures are working correctly.

License types and relationship with Secure Boot

Windows OEM licenses are typically tied to the computer's hardware and firmware. This means that if your device is OEM, it most likely already has Secure Boot enabled from the factory. You can check your license type using the following commands in CMD or PowerShell:

• slmgr /dli: displays the license type.
• slmgr /dlv: offers deeper details.
• slmgr /upk: removes the license.

There is also the RETAIL license , which is activated with your Microsoft account, and is not restricted to hardware.

Knowing this information is also helpful in understanding whether your system is designed to comply with security standards like Secure Boot. For more information on how to check the status of Secure Boot, you can visit this page.

Knowing whether Secure Boot is active is critical, as it facilitates system protection from startup and is a requirement for many platforms and security configurations. Using the built-in Windows tools or accessing the BIOS directly ensures an efficient and secure check of this feature's status.

Related articles:

How to access BIOS or UEFI on your Windows 11 computer

Isaac

Passionate writer about the world of bytes and technology in general. I love sharing my knowledge through writing, and that's what I'll do on this blog, show you all the most interesting things about gadgets, software, hardware, tech trends, and more. My goal is to help you navigate the digital world in a simple and entertaining way.