Secure boot enabled in bios but PC health check still says not enabled.

Understanding Secure Boot Settings: Resolving Conflicts Between BIOS and PC Health Check Reports

Introduction

Many modern PCs utilize secure boot technology to enhance system security by preventing unauthorized firmware, operating systems, or bootloaders from loading during the startup process. However, users sometimes encounter confusing situations where their BIOS indicates that Secure Boot is enabled, yet system health check tools report that it is not. This inconsistency can pose challenges, especially when attempting to run modern games or software that require specific UEFI configurations. In this article, we explore the common causes of this discrepancy and provide guidance on how to address it effectively.

Case Scenario Overview

Consider a user with a relatively recent PC build, featuring an Intel Core i7-13700K, a Gigabyte 4070 graphics card, MSI MAG Z790 TOMAHAWK MAX WIFI motherboard, 32GB of RAM, and both SSD and HDD storage. The Windows 10 installation is stored on a 1TB SSD. The user aims to participate in the Battlefield 6 beta but faces compatibility issues related to system security settings. Despite BIOS indicating Secure Boot is enabled, PC Health Check reports otherwise, leading to confusion and concern over potential system instability or bricking.

Common Causes of Discrepancies

Legacy BIOS Mode vs. UEFI Mode

While BIOS menus may show Secure Boot as enabled, the underlying boot mode—Legacy BIOS or UEFI—significantly impacts Secure Boot functionality. Windows 10, especially with Secure Boot enabled, typically requires UEFI mode. If the system is still operating in Legacy mode, Secure Boot will not be active from an OS perspective, causing conflicting reports.

Partial or Incorrect BIOS Configuration

Sometimes, BIOS settings are not fully configured correctly. For example, Secure Boot may be enabled, but the system’s firmware secure keys are not correctly enrolled, or the boot mode remains set to Legacy. These misconfigurations can lead Windows and system tools to detect Secure Boot as inactive.

Operating System Installation Mode

Windows installed in Legacy mode will not support Secure Boot, even if the BIOS indicates it is enabled. Confirming the boot mode is essential before troubleshooting Secure Boot issues.

Firmware Updates and Compatibility

Outdated firmware or BIOS versions can cause inconsistent Secure Boot reporting. Ensuring the motherboard firmware is up to date can resolve many incompatibility issues.

Recommended Steps to Resolve the Issue