Microsoft's latest Windows update now confirms if your PC is Secure Boot-protected - how it works

Introduction

Microsoft's latest Windows update introduces a significant enhancement to system security by displaying your Secure Boot status directly in the operating system. Secure Boot is a critical security feature that ensures only trusted software can run during the boot process, preventing malicious code from infiltrating your system. This tutorial will guide you through checking and configuring Secure Boot on Windows 10 and Windows 11 systems, helping you understand how to leverage this security feature for enhanced protection.

Prerequisites

• Windows 10 or Windows 11 operating system
• Administrator privileges on the system
• Basic understanding of Windows system settings
• Internet connection for downloading updates

Step-by-Step Instructions

1. Check Your Current Secure Boot Status

The first step is to verify whether your system has Secure Boot enabled. Open the Start menu and search for 'Windows Security' or navigate to Settings > Update & Security > Windows Security > Threat protection. Alternatively, you can use the Command Prompt with administrator privileges.

msinfo32

This command opens the System Information tool where you can look for Secure Boot status under the 'System Summary' section. If you're using PowerShell, you can also run:

Get-CimInstance -ClassName Win32_BootConfiguration

Why this step is important: Understanding your current Secure Boot status helps you determine if your system is already protected or if additional configuration is needed.

2. Access UEFI Firmware Settings

To enable or disable Secure Boot, you'll need to access your system's UEFI firmware settings. Restart your computer and press the F2 key (or F12, Esc, or Del depending on your manufacturer) during boot-up. Look for 'Advanced' or 'Security' options in the BIOS/UEFI menu.

On newer systems, you can also access this through Windows Settings:

Start Menu > Settings > Update & Security > Recovery > Advanced Startup > Restart now

This will reboot your system into the UEFI environment where you can configure Secure Boot settings.

Why this step is important: Secure Boot can only be configured at the firmware level, not through Windows settings alone, making this access crucial for system security management.

3. Configure Secure Boot Settings

Once in the UEFI settings, locate the Secure Boot option. It's typically found under 'Security' or 'Boot' settings. Set it to 'Enabled' if it's currently disabled. Some systems may show options like 'Setup Mode' and 'User Mode' - ensure you're in 'User Mode' for normal operation.

After making changes, save and exit the firmware settings (usually by pressing F10). Your system will restart with the new configuration.

Why this step is important: Proper configuration of Secure Boot ensures that only signed, trusted code can execute during the boot process, preventing rootkits and bootkits from compromising your system.

4. Verify Secure Boot Status in Windows

After rebooting, verify that Secure Boot is properly enabled. Open Command Prompt as Administrator and run:

sbctl status

If you don't have sbctl installed, you can check using PowerShell:

Get-CimInstance -ClassName Win32_BootConfiguration | Select-Object -ExpandProperty SecureBoot

On Windows 11, you can also check through:

Start Menu > Settings > Windows Security > Device security > Check your device security

Why this step is important: Verifying the configuration confirms that your system properly recognizes the Secure Boot settings and is actively protecting against unauthorized boot processes.

5. Monitor Secure Boot Events

To ensure Secure Boot is functioning properly, monitor system logs for any Secure Boot events. Open Event Viewer:

Start Menu > Event Viewer > Windows Logs > System

Look for events related to 'Secure Boot' or 'Boot Configuration'. You can also use PowerShell to query Secure Boot events:

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-BootConfiguration/Operational'; ID=1001}

Why this step is important: Monitoring events helps you detect any potential issues or attempts to bypass Secure Boot, ensuring continuous protection of your system.

6. Update Your System Regularly

Keep your system updated with the latest Windows updates, as Microsoft continues to improve Secure Boot functionality. Run:

Windows Update > Check for updates

Regular updates ensure that your Secure Boot implementation stays current with the latest security standards and threat mitigations.

Why this step is important: Regular updates are essential for maintaining the effectiveness of Secure Boot, as new vulnerabilities and attack vectors are constantly being discovered and patched.

Summary

This tutorial has walked you through checking, configuring, and monitoring Secure Boot on Windows systems. Secure Boot is a fundamental security feature that prevents unauthorized code from running during the boot process, providing critical protection against rootkits and bootkits. By following these steps, you've learned how to verify your system's Secure Boot status, configure it properly through UEFI firmware settings, and monitor its operation through system logs. Remember that Secure Boot is just one component of a comprehensive security strategy, and should be combined with other security measures like Windows Defender, regular updates, and secure browsing practices for maximum protection.

Understanding and properly implementing Secure Boot is crucial for maintaining system integrity, especially in enterprise environments where security is paramount. The latest Windows updates have made this information more accessible, allowing users to better understand their system's security posture.