Secure Boot: what it does and what turning it off costs
What Secure Boot verifies, how to read its state on Windows, which anti-cheats require it, and what you give up when you turn it off to make something else work.
Short answer
Secure Boot checks each boot component's signature against keys the firmware trusts, but never inspects PCIe devices or blocks DMA hardware. Several current anti-cheats require it, so disabling it to fix an unrelated problem can lock you out of the game entirely.
On this page10
- What does Secure Boot check?
- Does Secure Boot block a DMA card?
- How to check Secure Boot state in Windows
- Checking Secure Boot from the command line
- What depends on Secure Boot?
- Should you turn Secure Boot on or off?
- What you give up by turning Secure Boot off
- Before you change Secure Boot
- Common questions about Secure Boot
- Sources
What does Secure Boot check?
Secure Boot is a UEFI feature with one job. At power-on, before the operating system exists, it checks each component it is about to run, in order: the bootloader, the kernel loader and the early drivers. If any of them is unsigned, or signed with a key the firmware does not trust, the firmware refuses to run it. It is a boot-path integrity check, not a runtime scanner, so once Windows is running it cannot see what a PCIe device does.
Does Secure Boot block a DMA card?
Secure Boot does not block a DMA card. It never examines PCIe devices, reads their config space or decides whether a card may access memory, because a separate mechanism handles that. If a card is invisible to the game PC, the cause is enumeration, seating or the slot, not Secure Boot. Secure Boot matters to this stack only indirectly, because it is tied to boot mode and some anti-cheats check for it.
How to check Secure Boot state in Windows
On the game PC, read the current Secure Boot state and the boot mode it depends on before you touch anything. Knowing both is the difference between a reversible change and a machine that will not start.
- Press Windows and R, type msinfo32, and press Enter
- In System Summary, read Secure Boot State, which reports On, Off or Unsupported
- In the same panel, read BIOS Mode, which must be UEFI for Secure Boot to be available at all
- If Secure Boot State says Unsupported, check BIOS Mode first, because a legacy install cannot use Secure Boot
- Write both values down before you open the firmware menu
- After any change, reboot into Windows and read both values again instead of trusting the firmware screen
Checking Secure Boot from the command line
The PowerShell cmdlet is the unambiguous check, and it needs an Administrator prompt. It returns True when Secure Boot is supported and enabled, and False when it is supported but disabled. On a machine that is not UEFI, it reports that the cmdlet is not supported on the platform.
Confirm-SecureBootUEFI
msinfo32
bcdedit /enum {current}What depends on Secure Boot?
Three things depend on Secure Boot. First, several current kernel-level anti-cheats require it to be enabled and will refuse to let the game start without it, which makes this the dependency that matters most in practice. The list of titles changes, so check the current requirement for your game instead of trusting a year-old post. Second, some Windows security features and some corporate policies expect it to be on. Third, it is tied to boot mode: it exists only on a UEFI install, so any decision about CSM is also a decision about Secure Boot.
Should you turn Secure Boot on or off?
Find the row that matches your situation. The answer keeps coming back to one rule: do not disable a game requirement to fix something it probably did not cause.
| Your situation | What is really going on | What to do |
|---|---|---|
| Secure Boot is on and everything works | Nothing to solve | Leave it alone. Note the state so you can restore it after a firmware update |
| Game refuses to launch and names Secure Boot | The anti-cheat requires it and it is off | Turn it on. If it reports Unsupported, the install is in legacy mode and that is the real problem to fix |
| A guide says to disable it to make a card work | Almost certainly wrong. Secure Boot does not gate PCIe enumeration | Diagnose seating, slot and the Above 4G Decoding chain first. Do not disable a game requirement on a guess |
| Secure Boot State reports Unsupported | The machine is booting in legacy or CSM mode, so the feature is unavailable | Decide whether you want a UEFI install at all. Converting the disk is a deliberate project with a backup, not a quick toggle |
| You turned it off and the game now refuses to start | You traded a game requirement for a change that probably did nothing | Turn it back on, confirm the game launches, then resume diagnosing the original problem elsewhere |
| You want it off for an unsigned driver | That is exactly the case Secure Boot is designed to prevent, and it is a genuine security reduction | Understand what you are giving up, check whether your game requires Secure Boot first, and do not do this on a machine you use for anything personal |
Warning
What you give up by turning Secure Boot off
Turning Secure Boot off weakens the one check that stops an unsigned component from running before Windows does, and on some titles it also ends your ability to play. Turning it on costs nothing if your boot path is already signed and UEFI, and it can fix a game that will not launch. Disabling it never improves your position with an anti-cheat, so anyone who says switching it off makes a setup safer has the mechanism backwards.
Before you change Secure Boot
- You have read Secure Boot State and BIOS Mode in msinfo32 and written both down
- You have checked whether the game you play currently requires Secure Boot
- You have ruled out seating, slot and the Above 4G Decoding dependency chain as the real cause
- You know how to get back into the firmware menu if the machine does not boot
- You have a recovery drive, or you accept the risk of not having one
Common questions about Secure Boot
Does Secure Boot detect a DMA card?
No, because it verifies signatures on boot components before the operating system loads. It does not inspect PCIe devices and has no visibility into them while the system is running.
My game requires Secure Boot. Can I still run a DMA setup?
Having Secure Boot on does not by itself stop the hardware working, so the two requirements are not automatically in conflict. It also does nothing to reduce detection risk, which comes from firmware quality, configuration and how you play, and no firmware setting removes that risk.
Why does Secure Boot State say Unsupported?
Almost always because the machine boots in legacy or CSM mode rather than UEFI. Check BIOS Mode in msinfo32, and if it says Legacy, Secure Boot cannot be enabled until that changes.
Will turning Secure Boot on break my Windows install?
Not if the install is UEFI with a signed boot path. If the boot path is unsigned or the install is legacy, the machine can fail to boot. Check your BIOS Mode and have a way back before you change the setting.
Is Secure Boot the same thing as TPM?
No. Secure Boot verifies the boot chain, while a TPM is a chip that stores keys and measurements. Some anti-cheats and some Windows features ask for both, but they are separate requirements.
Sources
The steps for reading Secure Boot state and the decision table come from the team's own support work.
- 01Kernel DMA Protection (Microsoft Learn)
the separate IOMMU policy that governs device access to memory, which is the job Secure Boot does not do
learn.microsoft.com
- 02TPM 2.0 and Secure Boot requirement (Activision Support)
Call of Duty's own stated TPM 2.0 and Secure Boot requirement
support.activision.com
- 03Kernel-level anti-cheat (overview)
what kernel-level anti-cheat is as a product category
en.wikipedia.org
Read next
- BIOS settings for DMA on the game PC
- Windows versions and builds: what breaks and when
- Clean Windows before a spoofer
- DMA troubleshooting: fixes for common issues
- Every DMA term explained in plain English
- How a wrong system clock breaks TLS and licence checks
- Setting up Windows on the second PC for reliable reads
Still stuck? Open a ticket on Discord
All guides