Secure Boot on 2-in-1 Laptops: How It Works

What Secure Boot does

Secure Boot is a security standard that works at the moment your laptop powers on. Before Windows loads, the firmware checks the boot software against a set of trusted signatures. If the signatures match, the system continues to start. If they do not, the firmware blocks the software from running.

This matters on a 2-in-1 because the device is often carried between home, work, and campus, and it may be used on public networks. Secure Boot adds a layer of protection at the very start of the startup process, before the operating system has a chance to load its own defenses.

Secure Boot is part of the UEFI (Unified Extensible Firmware Interface) specification, which replaces the older BIOS system. Most modern laptops, including convertibles, use UEFI firmware. The setting is usually found in the firmware setup screen, sometimes labeled "Secure Boot" or "Secure Boot Control."

Windows 11 and the Secure Boot requirement

Windows 11 has a minimum system requirement that your device be "UEFI, Secure Boot capable," as stated on the official Windows 11 specifications page. This means the firmware must support Secure Boot, even if the feature is not turned on by default.

Most 2-in-1 laptops sold with Windows 11 have Secure Boot enabled out of the box. If you are buying a used or refurbished convertible, you may want to check that the setting is still active, especially if the previous owner changed firmware settings.

Secure Boot works alongside another security feature called TPM (Trusted Platform Module) version 2.0, which is also a Windows 11 requirement. Together, they help protect the startup process and the encryption keys used by features like BitLocker. You can read more about the difference in the TPM vs Secure Boot article.

How to check if Secure Boot is enabled

You can check the Secure Boot status without opening the firmware settings. In Windows 11, open the Start menu, type "System Information" and press Enter. In the System Summary section, look for "Secure Boot State." It will say either "On" or "Off."

If you prefer to check in the firmware, restart the laptop and press the key shown on the screen during startup (often F2, F10, or Del) to enter the UEFI settings. The exact key varies by brand, so check the maker's support page for your model.

In the firmware settings, look for a Security or Boot tab. The Secure Boot option may be listed as "Secure Boot," "Secure Boot Control," or "UEFI Secure Boot." If it is set to "Disabled," you can change it to "Enabled," save the changes, and restart.

Note: Some older laptops may have Secure Boot disabled because they were originally shipped with Windows 10 or an earlier version. If you are upgrading to Windows 11, the PC Health Check app from Microsoft can tell you whether your device meets the requirements, including Secure Boot capability.

What to do if Secure Boot is off

If you find Secure Boot is off on your 2-in-1, you can usually turn it back on in the firmware settings. The process is straightforward, but the exact steps depend on the maker and model. Check the official support page for your laptop brand to find the correct key and menu path.

Before enabling Secure Boot, make sure your Windows installation is compatible. If Windows was installed with Secure Boot off, turning it on may prevent the system from starting until you reinstall or repair the boot configuration. This is rare, but it is worth knowing before you change the setting.

If you are buying a used convertible, ask the seller whether Secure Boot is enabled, or check it yourself before you finalize the purchase. A laptop that has Secure Boot disabled may still work fine, but enabling it adds a layer of protection that is worth having.

For a new 2-in-1, Secure Boot is almost always on by default. You can verify it after the first startup using the System Information method described above. If it is off on a new device, it may have been turned off during manufacturing or by a previous owner, so it is worth checking.

Secure Boot and the 2-in-1 design

The convertible form factor does not change how Secure Boot works, but it does change how you might use the device. A 2-in-1 is often shared between family members or used in tablet mode for presentations, which means multiple people may have access to the firmware settings.

If you share a 2-in-1, you may want to set a firmware password to prevent others from changing Secure Boot or other security settings. This is a general recommendation, not a specific feature of any brand.

Secure Boot is one of several security features to consider when choosing a convertible. Others include Windows Hello biometric login, which you can read about in the biometric security login article, and TPM, which is covered in the TPM 2.0 security article.

When comparing 2-in-1 laptops, the presence of Secure Boot is not usually listed in the product specifications, because it is a standard feature of Windows 11 hardware. Instead, focus on the processor, RAM, and storage, which are the details that affect performance and usability. The best 2 in 1 laptop guide compares these stated details across models.

Common questions about Secure Boot

Can I disable Secure Boot? Yes, you can disable it in the firmware settings, but it is not recommended for everyday use. Some Linux distributions or older operating systems may require Secure Boot to be off, but Windows 11 works best with it on.

Does Secure Boot affect performance? No, Secure Boot runs during the startup process and does not affect the speed of your applications or the battery life of your laptop. It is a security check, not a performance feature.

Is Secure Boot the same as TPM? No, they are different. Secure Boot checks the boot software, while TPM stores encryption keys and provides hardware-based security. Both are required for Windows 11, and you can read more in the TPM vs Secure Boot article.

What if my laptop does not have Secure Boot? If a laptop is sold with Windows 11, it must be Secure Boot capable. If you have an older laptop that does not support Secure Boot, it may not be able to run Windows 11. Check the maker's support page for your model to see if a firmware update is available.

What to pick for your situation

Questions

What is Secure Boot on a laptop?

Secure Boot is a firmware security feature that checks the integrity of the boot software before Windows loads. It helps prevent unauthorized code from running during startup.

Is Secure Boot required for Windows 11?

Yes, Windows 11 requires a device to be UEFI and Secure Boot capable, as stated on the official Windows 11 specifications page.

How do I check if Secure Boot is enabled?

Open System Information in Windows 11 and look for "Secure Boot State" in the System Summary. It will say "On" or "Off."

Can I turn Secure Boot on if it is off?

Yes, you can enable it in the UEFI firmware settings, usually under a Security or Boot tab. The exact steps depend on the maker and model.

Does Secure Boot affect performance?

No, Secure Boot runs during startup and does not affect application speed or battery life. It is a security check, not a performance feature.

What is the difference between Secure Boot and TPM?

Secure Boot checks the boot software, while TPM stores encryption keys and provides hardware-based security. Both are required for Windows 11.