Secure Boot can only be enabled when the system is in "User Mode," not in "Setup Mode." Here's what that means and the process to enable it:
- Setup Mode is the initial state when Secure Boot has not been configured and no Platform Key (PK) is enrolled. Secure Boot is disabled in this mode.
- User Mode is the state after the Platform Key has been enrolled in the system firmware (BIOS/UEFI). This enrollment switches the system from Setup Mode to User Mode.
- Only in User Mode can Secure Boot be enabled, ensuring that the system boots only trusted, signed software.
If you see the message "Secure Boot can be enabled when system in User Mode," it means you are currently in Setup Mode and need to enroll the Platform Key to switch to User Mode. After enrolling this key in the BIOS, you will be able to enable Secure Boot. Typical steps to resolve this:
- Enter your BIOS/UEFI firmware settings.
- Disable Compatibility Support Module (CSM) if enabled (depends on your motherboard).
- Find the Secure Boot section and choose to enroll the Platform Key (PK).
- After enrolling the Platform Key, switch Secure Boot mode to "Standard" or "Custom."
- Enable Secure Boot and save changes.
This process ensures that Secure Boot can be activated only after the system trusts the keys that validate the bootloader and operating system. In summary, Secure Boot cannot be enabled when the system is in Setup Mode; it can be enabled only once the system is in User Mode, which requires enrolling the Platform Key in BIOS/UEFI settings.
