FACEIT "Please enable Secure Boot" — How to Fix It (2026)

Fix the FACEIT Anti-Cheat Secure Boot error: enable Secure Boot the right way (UEFI + GPT), rewrite the keys when "Enabled" isn't enough, with per-vendor BIOS paths for MSI, ASUS, Gigabyte and ASRock.

FACEIT Anti-Cheat shows "Secure Boot needs to be enabled to launch FACEIT AC" (or "Please enable Secure Boot") and won't start. It usually appears after a Windows reinstall, a hardware swap or a BIOS reset. The catch most people miss: "Secure Boot: Enabled" in BIOS is not the same as Secure Boot being active. This guide gets it truly active, step by step, for any motherboard.

Quick version: press Win+R → msinfo32 and check two fields — BIOS Mode must be UEFI and your system disk must be GPT. If BIOS Mode is Legacy, do not just turn Secure Boot on (your PC won't boot) — convert first. Otherwise it's a matter of enabling it and rewriting the keys.

Before anything: UEFI + GPT

Almost every Secure Boot error comes down to two things: your BIOS must run in UEFI mode (not Legacy/CSM) and your system disk must be GPT (not MBR). Check first — Win+R → msinfo32 → look at BIOS Mode and Secure Boot State:

What msinfo32 shows	What to do
BIOS Mode = UEFI, Secure Boot State = Off	Good — fixable in BIOS right now. Go to Step 1.
BIOS Mode = UEFI, Secure Boot State = On	Already on. If FACEIT still complains, re-check drivers and reinstall the AC client.
BIOS Mode = Legacy (CSM)	STOP — do not enable Secure Boot yet. Convert to GPT/UEFI first (see the Legacy section below).

Step 1 — enable Secure Boot (modern BIOS, 2022+)

On recent boards this is often all you need.

Enter BIOSReboot and press Del or F2 repeatedly to open BIOS.
Open the Security (or Boot) tabSet Secure Boot = Enabled and Secure Boot Mode = Standard.
Install keys if offeredKey Management → if "Install default keys" / "Restore Factory Keys" is available, run it.
Save and verifySave with F10 and exit. Reboot → msinfo32: Secure Boot State should now read On.

Step 2 — rewrite the keys ("Enabled" but still asking, or "Not Active")

Many boards show a separate status — Active / Not active. Even with Secure Boot = Enabled it can sit at "Not active", so it doesn't really work. Rewriting the keys fixes it.

Disable, then go CustomIn BIOS set Secure Boot = Disabled, then Secure Boot Mode = Custom (this unlocks the key options).
Restore the factory keysKey Management → "Restore Factory Keys" / "Install default keys" → confirm.
Re-enableSet Secure Boot Mode back to Standard, then Secure Boot = Enabled.
Save and checkSave and exit. After reboot the status should read Active / On.

Per-vendor BIOS paths

Brand	Where to look
MSI	Settings → Advanced → Windows OS Configuration → Secure Boot. Mode = Custom, then Image Execution Policy → Removable + Fixed Media = Deny Execute; preset / hardware OS → Maximum Security.
ASUS	Boot → Secure Boot → OS Type = "Windows UEFI Mode"; Key Management → Install / Clear Keys.
Gigabyte	BIOS → Secure Boot → Secure Boot Enable + Secure Boot Mode = Standard/Custom; Restore Factory Keys.
ASRock	Security → Secure Boot = Enabled + Active Secure Boot; Install Default Secure Boot Keys.

On mid-range BIOS (2019–2021) without a "Secure Boot Preset" line, the key step is Mode = Custom → Restore default keys, plus (on MSI) Image Execution Policy = Deny Execute for removable and fixed media — that blocks unsigned boot code and passes the FACEIT check.

Legacy / MBR disk — convert first

If msinfo32 shows BIOS Mode = Legacy, Secure Boot literally doesn't exist in that mode, and enabling it on a Legacy/MBR system makes the PC fail to boot. First check the disk: Win+R → diskmgmt.msc → disk Properties → Volumes → Partition style.

If the disk is GPTDisable CSM in BIOS (Boot → CSM / Legacy Support → Disabled / "UEFI only"), then enable Secure Boot.
If the disk is MBR — convertAdmin Command Prompt: mbr2gpt /validate /allowFullOS then mbr2gpt /convert /allowFullOS — only then disable CSM and enable Secure Boot.
Or clean-installReinstall Windows from USB with Rufus (scheme GPT, target UEFI) and CSM disabled — see our clean-install steps.

⚠ Back up first. Switching CSM → UEFI on an MBR disk without converting will stop Windows from booting. Photograph your BIOS settings before changing them.

Still asking after all that?

Update your BIOS and Windows — on beta BIOS versions Secure Boot can be flaky.
Gigabyte board with a 2022-era BIOS: Secure Boot shows Enabled but the AC sees it as invalid (expired Microsoft KEK cert) → Key Management → Restore Factory Keys + update BIOS.
No Secure Boot option at all → CSM (Legacy) is still on. Switch the board to UEFI first.
PC hangs or won't boot after enabling → your disk is MBR/Legacy: go back to the Legacy section.
Very rarely the BIOS module is damaged (board defect) → only a board swap helps.

With Secure Boot truly Active, the FACEIT error clears. If FACEIT next asks for TPM 2.0, follow our Enable TPM 2.0 guide; for any other code, see the FACEIT Anti-Cheat error fixes page.

FAQ

I set Secure Boot to Enabled but FACEIT still asks — why?

Enabled is not the same as Active. Many boards stay "Not active" until you rewrite the keys: Secure Boot → Disabled, Mode → Custom, Key Management → Restore Factory Keys, then Mode → Standard and Secure Boot → Enabled.

My PC won't boot after enabling Secure Boot.

Your disk is MBR/Legacy. Disable Secure Boot to boot again, then convert the disk to GPT/UEFI (mbr2gpt /convert /allowFullOS) before re-enabling.

There is no Secure Boot option in my BIOS.

CSM/Legacy mode is on. Switch the board to UEFI (disable CSM) and the option appears — but only enable it on a GPT disk.

Do I need to reinstall Windows?

Only if your disk is MBR and you can't or don't want to convert it with mbr2gpt. On a GPT disk you never need to reinstall just for Secure Boot.

Is enabling Secure Boot safe — will I lose data?

It is a BIOS setting and does not erase data, but changes are at your own risk. Photograph your BIOS settings first, and never enable it on a Legacy/MBR system without converting.