Windows installer says secure boot is not supported on pc

Secure Boot can appear enabled in firmware while Windows Setup reports it as unsupported if the PC or installation USB was started in Legacy/CSM mode; configure UEFI-only boot and explicitly start the USB entry labeled UEFI.

1. Check how Windows Setup was started

At the Windows Setup screen:

1. Press Shift + F10 to open Command Prompt.
2. Run:

wpeutil UpdateBootInfo
reg query HKLM\System\CurrentControlSet\Control /v PEFirmwareType

Interpret the result:

• 0x2 — Setup is running in UEFI mode. Continue to step 3.
• 0x1 — Setup is running in Legacy BIOS/CSM mode. Continue to step 2.

Microsoft documents these values as the way to identify Windows Setup’s current firmware mode.^1^

2. Start the installer in UEFI mode

Because Secure Boot is already enabled, do not merely toggle that setting again. Instead:

1. Restart and enter the firmware setup or one-time boot menu. Common keys include Esc, Delete, F1, F2, F10, F11, and F12.
2. Find the boot-mode setting and:
   • Set it to UEFI only.
   • Disable Legacy Boot or CSM.
3. Save the changes and reopen the one-time boot menu.
4. Select UEFI: USB Drive, not an entry named only USB Drive or Legacy USB.
5. Run the command above again and confirm that PEFirmwareType is now 0x2.

Windows Setup can show separate UEFI and BIOS entries for the same USB device; selecting the UEFI entry is required here.^1^ Microsoft also specifies that Legacy/CSM must be replaced by UEFI as the first or only boot mode for Secure Boot.^2^

3. If Setup is already in UEFI mode

Open the firmware settings and check the Secure Boot configuration for an option such as:

• Secure Boot mode: Standard
• Install default Secure Boot keys
• Restore/Reset keys to factory defaults

Use Reset/Restore factory keys, not Clear keys. Secure Boot requires provisioned platform and signature-database keys; an enabled toggle without valid keys may not establish an active Secure Boot state.^3^ A matching Windows 11 installation case was resolved by resetting the firmware keys to their factory values.^4^

Save, restart, and boot the installer through UEFI: USB Drive again.

If disabling CSM prevents an existing Windows installation from booting

That condition commonly indicates that the existing system disk uses MBR, while UEFI boot expects a GPT system disk. Do not convert or erase the disk unless important files are backed up.

If the existing Windows installation still starts in Legacy mode and must be preserved:

1. Open Command Prompt as administrator.
2. Validate the system disk:

mbr2gpt /validate /allowFullOS

3. Only if validation succeeds, convert it:

mbr2gpt /convert /allowFullOS

4. Restart into firmware settings immediately afterward, select UEFI-only, disable CSM, and enable Secure Boot.

MBR2GPT converts the system disk without deleting its data, but Microsoft requires the firmware to be changed to UEFI after conversion. If BitLocker is active, suspend its protection before conversion.^5^

If this is a clean installation and no files need to be preserved, booting the installer in UEFI mode and allowing Windows Setup to recreate the target disk’s partitions is simpler. Deleting partitions erases all data on that disk.

If it still reports unsupported

Check the PC or motherboard manufacturer’s support page for a firmware/BIOS update. Do not install firmware for a different exact model or hardware revision. If the latest firmware still cannot expose Secure Boot as active in UEFI mode with factory keys installed, the manufacturer must confirm whether that model meets the required UEFI Secure Boot implementation.

References

1. Boot to UEFI Mode or legacy BIOS mode
2. Windows 11 and Secure Boot | Microsoft Support
3. Secure boot
4. Win 11 installation problem - Microsoft Q&A
5. MBR2GPT.EXE