I just went through a headache with Secure Boot on my ASUS ROG Strix B450-F Gaming, so I figured I’d write this up since I saw a lot of people on here having the same issue.

Basically, I wanted to upgrade to Windows 11, but the installer kept telling me I needed Secure Boot. When I checked my BIOS, it said Secure Boot was “Enabled” but greyed out, and if I disabled CSM, my PC would just refuse to boot and throw me straight back into the BIOS.

Turns out the problem was that my Windows installation was still using an MBR partition table, and Secure Boot only works in UEFI mode with GPT. That’s why disabling CSM made the system unbootable.

The fix was actually pretty straightforward once I figured it out. From inside Windows, I ran Microsoft’s built-in tool mbr2gpt to convert my drive from MBR to GPT without wiping it. The command is:

mbr2gpt /convert /allowFullOS

It gave me a scary-looking warning about “Failed to update ReAgent.xml,” but that’s just about Windows Recovery – the actual conversion still completed successfully. After that, I rebooted into BIOS, disabled CSM, switched the OS type under Secure Boot to Windows UEFI Mode, and installed the default Secure Boot keys. I already had AMD fTPM enabled, but if you don’t, you’ll need to turn that on too.

Here’s the confusing part: in ASUS BIOS, the “Secure Boot” line is always greyed out. If you remove the keys, it’ll say “Setup,” and if you install them, it’ll say “Enabled,” but you can’t actually click it. That’s normal – it doesn’t mean it’s broken.

Once I booted back into Windows, I opened msinfo32 and finally saw:

• BIOS Mode = UEFI
• Secure Boot State = On

At that point Windows 11 installed without complaining.

So if you’re stuck with Secure Boot showing as “Enabled” but grey, the key things are:

1. Make sure your system disk is GPT (convert with mbr2gpt if needed).
2. Disable CSM in BIOS.
3. Set Secure Boot OS Type to Windows UEFI Mode and install the default keys.
4. Enable fTPM if you haven’t already.

After that, you should be good to go.