Does Secure Boot slow games down?

No. Secure Boot only does work at boot time, verifying signatures on the boot chain before Windows starts. It is not in the path of anything a game does once you are at the desktop. The features sometimes enabled alongside it — VBS and HVCI in particular — can cost performance, but Secure Boot on its own does not.

Which games actually require it?

Battlefield 6, via EA's Javelin anti-cheat, and VALORANT via Riot's Vanguard, are the clearest cases. The list is set by anti-cheat vendors rather than by Microsoft, and it moves — check the individual game's support page rather than trusting any list that is more than a few months old, including this one.

Is TPM 2.0 the same thing as Secure Boot?

No, they are separate. Secure Boot is a firmware feature that checks signatures on boot software. TPM 2.0 is a hardware module that stores keys and measurements. Windows 11 requires both to install, and Riot's Vanguard checks both on Windows 11, but a game can require one without the other. EA's Battlefield 6 page names Secure Boot as the requirement and describes TPM as a related feature rather than a separate gate.

Do I need Secure Boot on Windows 10?

For VALORANT, no — Riot enforced the TPM 2.0 and Secure Boot check on Windows 11 specifically, and the game kept running on Windows 10 machines that did not meet it. For Battlefield 6, yes: EA's requirement is not Windows-11-only, and EA notes Secure Boot is available on both Windows 10 and Windows 11.

Why does Vanguard now want VBS, HVCI and IOMMU too?

Those are the entry requirements for Vanguard: On-Demand, the mode where the anti-cheat driver stops loading at Windows startup and runs only while VALORANT or League of Legends is open. It is opt-in, not a new floor for playing — Riot said about 3% of players are on hardware that cannot support it, and those players keep the always-on driver instead.

Is it safe to turn Secure Boot off again afterwards?

Technically you can, but Microsoft's guidance is to re-enable it once whatever forced you to disable it has been resolved. Beyond the games that check for it, Secure Boot is what stops unsigned code loading before Windows does, and Windows 11 assumes it is on.

Do PC games require Secure Boot on Windows 11?

Last verified August 2026Tested against Windows 11 24H2, Windows 11 25H2, Windows 10 22H2Good evidence

Partially

Windows itself does not need Secure Boot on for you to play games, and the overwhelming majority of your library will not notice either way. A small but growing set of competitive titles with kernel-level anti-cheat refuse to start without it — Battlefield 6 requires Secure Boot outright, and VALORANT requires Secure Boot plus TPM 2.0 on Windows 11.

What you need

UEFI firmware, not Legacy BIOS/CSM — Secure Boot cannot be enabled in Legacy mode
A GPT system disk, because UEFI boot requires it
Secure Boot set to Enabled in firmware, with the OEM keys present (Secure Boot State reads On in msinfo32)
For VALORANT on Windows 11: TPM 2.0 enabled as well, usually shown in firmware as PTT on Intel or fTPM on AMD
For Vanguard's On-Demand mode: Windows 11 25H2 plus VBS, HVCI and IOMMU on top of Secure Boot and TPM 2.0

Supported on

Windows 11 24H2 and 25H2 — Secure Boot is on by default on machines that shipped with Windows 11
Windows 10 22H2 — Secure Boot exists here too, and Battlefield 6's requirement applies to Windows 10 as well
Any PC built in roughly the last decade, provided it was installed in UEFI mode rather than Legacy/CSM

Limitations

Turning Secure Boot on does not migrate a Legacy/MBR install for you. If Windows was installed in Legacy mode, enabling Secure Boot in firmware alone will leave the PC unable to boot until you convert the disk to GPT and switch to UEFI.
Dual-boot setups with an unsigned bootloader can stop booting when Secure Boot is enabled. Mainstream Linux distributions with signed shim binaries are fine; custom or self-compiled kernels usually are not.
BitLocker treats firmware changes as a tamper signal and can ask for your recovery key on the next boot. Have the key before you change anything.
Vanguard's On-Demand mode is not available to everyone. Riot said around 3% of players are on hardware that cannot support it; those players keep the always-on driver and can still play.
Microsoft is rotating the Secure Boot certificates issued in 2011, which start expiring in June 2026. Machines that never receive the updated certificates can end up unable to verify newer boot software.
Secure Boot state is reported by the firmware, so a bad or partially applied firmware update can make Windows report it as Off even when it is enabled in the BIOS menu.

How to set it up

Check what you already have. Press Windows+R, run msinfo32, and read two lines in System Summary: BIOS Mode and Secure Boot State.
```
msinfo32
```
If BIOS Mode says UEFI and Secure Boot State says On, you are done — nothing here applies to you.
If BIOS Mode says UEFI but Secure Boot State says Off, you only need to flip the firmware setting. Suspend BitLocker first if the drive is encrypted, then go to Settings > System > Recovery > Restart now, and choose Troubleshoot > Advanced options > UEFI Firmware Settings.
In firmware, find Secure Boot under a Boot, Security or Authentication tab, set it to Enabled, save and exit. The menu layout differs per manufacturer; Microsoft's own guidance is to check your PC maker's documentation for the exact path.
If BIOS Mode says Legacy, stop. Enabling Secure Boot now will make the PC unbootable. Convert the system disk to GPT first with Microsoft's MBR2GPT tool from an elevated Command Prompt, then switch the firmware to UEFI, then enable Secure Boot.
```
mbr2gpt /validate /allowFullOS
```
For VALORANT on Windows 11, also enable TPM 2.0 — listed as PTT on Intel platforms and fTPM on AMD — and confirm it afterwards by running tpm.msc.
```
tpm.msc
```
Re-verify with msinfo32 after rebooting. Secure Boot State must read On; the game checks the reported state, not the BIOS menu.

Known problems

VALORANT refuses to launch on Windows 11 when Vanguard cannot confirm Secure Boot and TPM 2.0, showing a VAN error code. Riot publishes the per-code steps on its own support site.
Battlefield 6 prompts that Secure Boot is required and refuses to launch until it is enabled.
Windows reports Secure Boot State as Off even though the firmware menu shows it enabled, usually because the system disk is still MBR or the machine is booting through a CSM path.
The PC no longer boots after enabling Secure Boot on an install that was set up in Legacy/CSM mode.
BitLocker demands a recovery key on the first boot after the firmware change.

Alternatives

Play the affected title on console: Console versions do not run the PC anti-cheat driver, so none of these firmware requirements apply.
Keep Secure Boot on permanently: It is the state Windows 11 ships in and expects, and it costs nothing in game performance. Leaving it on avoids repeating this whenever another title adopts the requirement.
Reinstall Windows in UEFI mode: If MBR2GPT will not validate your disk, a clean install from UEFI-booted media gives you a GPT disk and Secure Boot support without fighting the conversion.

Common questions

Does Secure Boot slow games down?: No. Secure Boot only does work at boot time, verifying signatures on the boot chain before Windows starts. It is not in the path of anything a game does once you are at the desktop. The features sometimes enabled alongside it — VBS and HVCI in particular — can cost performance, but Secure Boot on its own does not.
Which games actually require it?: Battlefield 6, via EA's Javelin anti-cheat, and VALORANT via Riot's Vanguard, are the clearest cases. The list is set by anti-cheat vendors rather than by Microsoft, and it moves — check the individual game's support page rather than trusting any list that is more than a few months old, including this one.
Is TPM 2.0 the same thing as Secure Boot?: No, they are separate. Secure Boot is a firmware feature that checks signatures on boot software. TPM 2.0 is a hardware module that stores keys and measurements. Windows 11 requires both to install, and Riot's Vanguard checks both on Windows 11, but a game can require one without the other. EA's Battlefield 6 page names Secure Boot as the requirement and describes TPM as a related feature rather than a separate gate.
Do I need Secure Boot on Windows 10?: For VALORANT, no — Riot enforced the TPM 2.0 and Secure Boot check on Windows 11 specifically, and the game kept running on Windows 10 machines that did not meet it. For Battlefield 6, yes: EA's requirement is not Windows-11-only, and EA notes Secure Boot is available on both Windows 10 and Windows 11.
Why does Vanguard now want VBS, HVCI and IOMMU too?: Those are the entry requirements for Vanguard: On-Demand, the mode where the anti-cheat driver stops loading at Windows startup and runs only while VALORANT or League of Legends is open. It is opt-in, not a new floor for playing — Riot said about 3% of players are on hardware that cannot support it, and those players keep the always-on driver instead.
Is it safe to turn Secure Boot off again afterwards?: Technically you can, but Microsoft's guidance is to re-enable it once whatever forced you to disable it has been resolved. Beyond the games that check for it, Secure Boot is what stops unsigned code loading before Windows does, and Windows 11 assumes it is on.

Did this fix work?

If a step is wrong, outdated, or did not help, telling us is the fastest way to get it corrected. Reports are reviewed before new articles.

Report a problem with this page

Sources

Secure Boot Information — Battlefield 6Official
Electronic Arts · Documentation · checked Aug 22, 2026
- Battlefield 6 requires Secure Boot to be enabled and prompts the player when it is off
- EA states Secure Boot is available on both Windows 10 and Windows 11 devices
- EA describes TPM as a dependent security feature its anti-cheat can leverage, not as a stated hard requirement
Windows 11 and Secure BootOfficial
Microsoft · Support page · checked Aug 22, 2026
- Microsoft's route into firmware settings is Settings > System > Recovery > Restart now, then Troubleshoot > Advanced options > UEFI Firmware Settings
- Enabling Secure Boot may require switching the boot mode from Legacy BIOS/CSM to UEFI
- Where both UEFI and Legacy/CSM are offered, Microsoft says to make UEFI the first or only option
- Microsoft recommends re-enabling Secure Boot after any issue that required temporarily disabling it
- Microsoft refers users to their PC manufacturer for the firmware-specific steps
Secure bootOfficial
Microsoft · Documentation · checked Aug 22, 2026
- Secure Boot has the firmware verify the signature of every piece of boot software before handing control to the operating system
- Secure Boot depends on UEFI 2.3.1 firmware with SecureBoot=1 and SetupMode=0 and a provisioned signature database
- Microsoft is replacing the Secure Boot certificates issued in 2011, which begin expiring in June 2026
Riot Games' Vanguard no longer starts on boot for supported PCsReputable
Notebookcheck · News · checked Aug 22, 2026
- Vanguard: On-Demand keeps Riot's anti-cheat driver from loading at boot and runs it only while VALORANT or League of Legends is open
- On-Demand mode requires Windows 11 version 25H2, Secure Boot, TPM 2.0, VBS, HVCI and IOMMU
- Riot said roughly 35% of players already met the requirements, 62% must enable features manually, and 3% have hardware that cannot support On-Demand
- Players who cannot meet the requirements keep the always-on driver and are not blocked from playing
- Reported 27 June 2026
Riot Games' Valorant game is enforcing TPM 2.0 on Windows 11Reputable
Windows Latest · News · checked Aug 22, 2026
- Riot updated Vanguard to enforce TPM 2.0 and Secure Boot specifically on Windows 11
- VALORANT continued to run on Windows 10 machines that did not meet those requirements