How to Fix “Secure Boot Can Be Enabled When System in User Mode”

When attempting to enable Secure Boot on a Windows or Linux system, users may sometimes encounter the message: “Secure Boot can be enabled when System in User Mode.” This message can be confusing for those unfamiliar with UEFI firmware settings and usually leaves users stumped. Fortunately, addressing this issue is not overly complicated once you understand what it means and how the system flags different firmware states.

Secure Boot is a security feature in modern PCs with UEFI firmware. It ensures that only trusted software that has been signed with recognized keys can be executed during boot time. However, if your system is currently in Setup Mode or lacks installed Platform Keys (PKs), you’ll run into the prompt stating that Secure Boot can only be enabled in User Mode.

Why This Error Occurs

Systems issue this warning because Secure Boot requires properly enrolled keys to function. In Setup Mode, your motherboard’s firmware is essentially waiting for keys to be installed, which transitions it into User Mode where Secure Boot can be activated.

Step-by-Step Guide to Fix the Issue

• Step 1: Enter BIOS/UEFI Settings
  Restart your PC and enter the BIOS or UEFI settings. This is commonly done by pressing a specific key such as Delete, F2, or Esc during boot-up. Your computer should display which key to press during the initial boot screen.
• Step 2: Locate Secure Boot Configuration
  Inside the UEFI menu, look for the tab or section labeled something like Boot, Security, or Authentication. This is where Secure Boot settings typically reside.
• Step 3: Clear or Install Default Keys
  You will often see a setting named Install Default Secure Boot Keys or Load Factory Keys. Select this option to install Microsoft and OEM default keys. Doing this moves the system from Setup Mode to User Mode, thereby enabling Secure Boot.
• Step 4: Save and Restart
  After loading the default keys, save the changes and exit the BIOS. On most systems, this is done by pressing F10 and confirming. After reboot, check if Secure Boot can now be enabled.

Additional Tips

If the menu options don’t appear or are greyed out, try the following:

• Disable CSM (Compatibility Support Module): This legacy boot mode can interfere with Secure Boot operations. Disabling CSM may also reveal Secure Boot options on some firmware versions.
• Update BIOS/UEFI Firmware: An outdated UEFI version may lack visibility or full support for Secure Boot keys. Visit your motherboard or system manufacturer’s website for the latest firmware version.
• Restore Factory Defaults: As a last resort, reset all BIOS settings to their factory state. This can resolve inconsistencies in previous configurations that prevent Secure Boot activation.

Verifying Secure Boot Status

After applying changes and rebooting into your OS, you can verify the status of Secure Boot:

• Windows: Open System Information and find the Secure Boot State field. It should read On.
• Linux: Run the following command in the terminal:
  dmesg | grep -i secure
  or:
  mokutil --sb-state

Conclusion

The error message about Secure Boot Activation is simply a prompt that your UEFI is in Setup Mode and doesn’t currently contain the necessary secure boot keys. By entering BIOS/UEFI and installing the default keys or restoring factory keys, you can allow the system to transition into User Mode, thereby making Secure Boot available for activation.

Frequently Asked Questions

• Q: What is User Mode in UEFI?
  A: User Mode is the UEFI state where Secure Boot keys are installed and validated. This mode allows Secure Boot to be enabled.
• Q: What are Platform Keys (PK)?
  A: Platform Keys are cryptographic keys used by Secure Boot to authorize firmware and OS loaders during the startup process.
• Q: Is it safe to enable Secure Boot?
  A: Yes, Secure Boot helps protect the system from rootkits and other low-level attacks. However, it may conflict with unsigned operating systems like some Linux distributions unless configured accordingly.
• Q: Can Secure Boot affect dual-boot setups?
  A: It can. Secure Boot may prevent unsigned Linux distributions from booting. Many distros support Secure Boot today, but others may require it to be disabled or configured through custom keys.
• Q: I don’t see Secure Boot options in my BIOS, what should I do?
  A: Make sure CSM is disabled and that you’re running the system in pure UEFI mode. Also, check if a firmware update is available.