What Secure Boot Actually Does — and Why It Still Matters in 2025

A gatekeeper that runs before Windows exists

Secure Boot lives in UEFI firmware and works like a doorman with a guest list. The firmware stores certificate databases — db with trusted signing keys and dbx with explicitly revoked ones — and every component of the boot chain, starting with the Windows boot manager, gets its signature checked against them before it is allowed to execute. Unsigned or revoked code is refused before the first pixel of Windows appears.

That matters because the boot chain is the one place antivirus cannot defend. A bootkit loads before the OS, before Defender, before any driver, so a compromised bootloader means the malware owns everything that comes after. Windows 11 made Secure Boot mandatory for a reason, and the feature costs you nothing at runtime: signature checks add milliseconds to a boot that already takes ten seconds.

• Blocks bootkits — the boot chain is the one malware territory antivirus cannot reach
• Costs no performance: verification happens once per boot, in milliseconds
• Checks code signatures, not your activity — it is not surveillance and does not phone home by itself
• Works with BitLocker: the measured-boot log feeds Windows' own tamper checks
• Stops rollback attacks — an old, signed-but-vulnerable bootloader can be revoked through dbx updates
• Cannot be switched off by malware inside a running Windows — the setting lives in firmware, not on disk

Checking yours — and the BitLocker trap

Press Win+R, run msinfo32 and look for two lines: BIOS Mode should say UEFI, and Secure Boot State should say On. On a machine in legacy CSM mode there is no Secure Boot at all — that alone is a reason to convert the disk from MBR to GPT with mbr2gpt and move to a modern boot flow, if the hardware supports it. The conversion takes under an hour and also unlocks TPM-dependent features like BitLocker and Windows 11 upgrade eligibility.

One warning before you ever touch the toggle: if BitLocker is encrypting your disk, disabling Secure Boot changes the measured boot state, and the next start will demand your 48-digit recovery key. Save it from aka.ms/myrecoverykey or your Microsoft account page first. The same caution applies to fiddling with TPM settings — fTPM on AMD or PTT on Intel.

The narrow cases for switching it off

Legitimate reasons to disable Secure Boot are rare but real: an ancient graphics card whose option ROM predates UEFI signing, some Win10-era capture cards, or a niche Linux setup running a custom kernel that nobody signed. Mainstream distributions boot fine with Secure Boot on because their shim bootloader is signed by Microsoft. Everything else on the list of reasons people cite — fan control, faster boots, old games — is folklore.

What is not legitimate is disabling it as a fix for slow boots, update errors or vague instability — none of those are caused by Secure Boot, and the internet's habit of recommending it for everything is how people end up with an unbootable PC and a lost recovery key. If a vendor support page tells you to turn it off to install their tool, ask what exactly fails the signature check. Sometimes the honest answer is the installer itself.

Questions and Answers

Read next