cant secure boot

On ASUS systems, do not try to click the greyed-out Secure Boot State field; verify Windows Boot Manager, disable CSM, and set OS Type to Windows UEFI mode, after which the state should update automatically.

Configure the ASUS UEFI safely

Before changing firmware settings:

• Record or photograph the current boot and CSM settings.
• If device encryption or BitLocker is enabled, have the recovery key available.
• Do not clear the TPM or erase Secure Boot keys.

Then:

1. Restart Windows into the firmware:
   • Settings → System → Recovery → Advanced startup → Restart now
   • Select Troubleshoot → Advanced options → UEFI Firmware Settings → Restart.^1^
2. In ASUS UEFI, enter Advanced Mode if necessary, commonly by pressing F7.
3. Open Boot and check the boot list.
   • Confirm that Windows Boot Manager is present and points to the Windows SSD.
   • Make it the first boot option.
   • If there is no Windows Boot Manager entry, stop here rather than disabling CSM.
4. Open Boot → CSM.
   • If Launch CSM is enabled, set applicable boot-device controls to UEFI only, then set Launch CSM to Disabled.
   • Windows showing BIOS Mode: UEFI does not necessarily mean ASUS Launch CSM is disabled. In the closely matching ASUS case, enabled CSM prevented the Secure Boot configuration from loading correctly.^2^
5. Press F10, save, and then re-enter UEFI. Confirm Windows Boot Manager is still present.
6. Go to the ASUS Secure Boot page—commonly Boot → Secure Boot, although laptop and prebuilt menu names can differ:
   • Set OS Type to Windows UEFI mode.
   • Leave the greyed-out Secure Boot State field alone. ASUS documents that this field is synchronized with the Secure Boot keys rather than acting as a selectable switch.^3^
7. Save with F10 and start Windows.

Verify the result

Press Windows+R, enter msinfo32, and check:

• BIOS Mode: UEFI
• Secure Boot State: On

If Windows no longer boots

Return to UEFI and restore the settings recorded earlier—particularly re-enable Launch CSM or change OS Type back to Other OS—so Windows can start. Microsoft permits temporarily disabling Secure Boot while resolving a startup issue.^1^

If Windows Boot Manager remains available but firmware reports a Secure Boot/key error, use Reset Secure Boot keys to factory defaults, not Clear Secure Boot keys, if your ASUS firmware provides both options. Microsoft distinguishes reset from clear because reset restores the manufacturer’s default variables.^4^

If that does not restore booting, provide:

• The exact error message or a photo of it.
• The complete ASUS model or motherboard model.
• Whether Windows Boot Manager remains listed.
• The values shown for Secure Boot State, Platform Key state, OS Type, and Launch CSM.

Those details determine whether this is a missing-key condition, a boot-entry problem, or model-specific ASUS firmware behavior.

References

1. Windows 11 and Secure Boot | Microsoft Support
2. MBR2GPT - Unable to activate Secure Boot in BIOS - Microsoft Q&A
3. [Motherboard] How to enable or disable Secure Boot - ASUS
4. How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 | Microsoft Support