>

Check Secure Boot Status with Confirm-SecureBootUEFI

One cmdlet tells you whether Secure Boot is on — the check PC Health does before a Windows 11 upgrade.

Windowssecure-bootfirmwarepowershellLow risk
Run Confirm-SecureBootUEFI in an elevated PowerShell: True means enabled, False means disabled, and an error means the machine boots in legacy BIOS mode.

01Command

Command
$ Confirm-SecureBootUEFI

02What it does

Secure Boot blocks unsigned bootloaders and rootkits, and it is one of the four hard requirements for Windows 11 — so this is the first check when an upgrade or anti-cheat game complains. True/False comes back immediately, no reboot into firmware setup needed. A thrown error (“Cmdlet not supported on this platform”) means the machine is running legacy BIOS (CSM), which needs a firmware-mode migration before Secure Boot can even be considered. To actually enable it you must go into UEFI setup and turn on Secure Boot (sometimes after disabling CSM), but this cmdlet tells you whether that trip is necessary.

03Risk

RiskLow risk
RequirementsPowerShell as Administrator; UEFI firmware machine (fails on legacy BIOS)
!Warning: Toggling Secure Boot or CSM in firmware can affect dual-boot Linux setups — check your bootloader's signing support before changing it.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • Confirm-SecureBootUEFI
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: Documents Confirm-SecureBootUEFI returning True/False, and that it throws on non-UEFI systems.

Last verified: 2026-09-18 · Category: System & Settings

06Related solutions

Grep on Windows: Select-String
Windowssearchtextpowershell

Search inside text files and logs with regex, returning file, line number and match.

Low risk ✓ 2026-09-17
Zip Files with Compress-Archive
WindowsZip & Archivesarchivepowershell

Create or update a .zip from any files or folder contents straight from PowerShell.

Low risk ✓ 2026-09-17
Test a TCP port connection on Windows with Test-NetConnection
Windowsnetworktroubleshootingpowershell

A built-in PowerShell one-liner that answers 'is port 5432/3389/443 actually open through this network?' — no telnet client needed.

Low risk ✓ 2026-09-17