FACEIT Anti-Cheat shows "Secure Boot needs to be enabled to launch FACEIT AC" (or "Please enable Secure Boot") and won't start. It usually appears after a Windows reinstall, a hardware swap or a BIOS reset. The catch most people miss: "Secure Boot: Enabled" in BIOS is not the same as Secure Boot being active. This guide gets it truly active, step by step, for any motherboard.
GRIND · THE MOST CUSTOMIZABLE EXTENSION FOR FACEIT IN CS2
ENTER YOUR FACEIT NICKNAME.
DISCOVER YOUR ROLE.
Enter a nickname — see your role, five skill rings and form over 30 matches.
Example result: donk666
ROLES AND SKILL RINGS IN THE FACEIT MATCH ROOM
Want to see other players' roles right in the match room?
msinfo32 and check two fields — BIOS Mode must be UEFI and your system disk must be GPT. If BIOS Mode is Legacy, do not just turn Secure Boot on (your PC won't boot) — convert first. Otherwise it's a matter of enabling it and rewriting the keys.Before anything: UEFI + GPT
Almost every Secure Boot error comes down to two things: your BIOS must run in UEFI mode (not Legacy/CSM) and your system disk must be GPT (not MBR). Check first — Win+R → msinfo32 → look at BIOS Mode and Secure Boot State:
| What msinfo32 shows | What to do |
|---|---|
| BIOS Mode = UEFI, Secure Boot State = Off | Good — fixable in BIOS right now. Go to Step 1. |
| BIOS Mode = UEFI, Secure Boot State = On | Already on. If FACEIT still complains, re-check drivers and reinstall the AC client. |
| BIOS Mode = Legacy (CSM) | STOP — do not enable Secure Boot yet. Convert to GPT/UEFI first (see the Legacy section below). |
Step 1 — enable Secure Boot (modern BIOS, 2022+)
On recent boards this is often all you need.
- Enter BIOSReboot and press Del or F2 repeatedly to open BIOS.
- Open the Security (or Boot) tabSet Secure Boot = Enabled and Secure Boot Mode = Standard.
- Install keys if offeredKey Management → if "Install default keys" / "Restore Factory Keys" is available, run it.
- Save and verifySave with F10 and exit. Reboot →
msinfo32: Secure Boot State should now read On.
Step 2 — rewrite the keys ("Enabled" but still asking, or "Not Active")
Many boards show a separate status — Active / Not active. Even with Secure Boot = Enabled it can sit at "Not active", so it doesn't really work. Rewriting the keys fixes it.
- Disable, then go CustomIn BIOS set Secure Boot = Disabled, then Secure Boot Mode = Custom (this unlocks the key options).
- Restore the factory keysKey Management → "Restore Factory Keys" / "Install default keys" → confirm.
- Re-enableSet Secure Boot Mode back to Standard, then Secure Boot = Enabled.
- Save and checkSave and exit. After reboot the status should read Active / On.
Per-vendor BIOS paths
| Brand | Where to look |
|---|---|
| MSI | Settings → Advanced → Windows OS Configuration → Secure Boot. Mode = Custom, then Image Execution Policy → Removable + Fixed Media = Deny Execute; preset / hardware OS → Maximum Security. |
| ASUS | Boot → Secure Boot → OS Type = "Windows UEFI Mode"; Key Management → Install / Clear Keys. |
| Gigabyte | BIOS → Secure Boot → Secure Boot Enable + Secure Boot Mode = Standard/Custom; Restore Factory Keys. |
| ASRock | Security → Secure Boot = Enabled + Active Secure Boot; Install Default Secure Boot Keys. |
Legacy / MBR disk — convert first
If msinfo32 shows BIOS Mode = Legacy, Secure Boot literally doesn't exist in that mode, and enabling it on a Legacy/MBR system makes the PC fail to boot. First check the disk: Win+R → diskmgmt.msc → disk Properties → Volumes → Partition style.
- If the disk is GPTDisable CSM in BIOS (Boot → CSM / Legacy Support → Disabled / "UEFI only"), then enable Secure Boot.
- If the disk is MBR — convertAdmin Command Prompt:
mbr2gpt /validate /allowFullOSthenmbr2gpt /convert /allowFullOS— only then disable CSM and enable Secure Boot. - Or clean-installReinstall Windows from USB with Rufus (scheme GPT, target UEFI) and CSM disabled — see our clean-install steps.
Still asking after all that?
- Update your BIOS and Windows — on beta BIOS versions Secure Boot can be flaky.
- Gigabyte board with a 2022-era BIOS: Secure Boot shows Enabled but the AC sees it as invalid (expired Microsoft KEK cert) → Key Management → Restore Factory Keys + update BIOS.
- No Secure Boot option at all → CSM (Legacy) is still on. Switch the board to UEFI first.
- PC hangs or won't boot after enabling → your disk is MBR/Legacy: go back to the Legacy section.
- Very rarely the BIOS module is damaged (board defect) → only a board swap helps.
With Secure Boot truly Active, the FACEIT error clears. If FACEIT next asks for TPM 2.0, follow our Enable TPM 2.0 guide; for any other code, see the FACEIT Anti-Cheat error fixes page.
FAQ
I set Secure Boot to Enabled but FACEIT still asks — why?
Enabled is not the same as Active. Many boards stay "Not active" until you rewrite the keys: Secure Boot → Disabled, Mode → Custom, Key Management → Restore Factory Keys, then Mode → Standard and Secure Boot → Enabled.
My PC won't boot after enabling Secure Boot.
Your disk is MBR/Legacy. Disable Secure Boot to boot again, then convert the disk to GPT/UEFI (mbr2gpt /convert /allowFullOS) before re-enabling.
There is no Secure Boot option in my BIOS.
CSM/Legacy mode is on. Switch the board to UEFI (disable CSM) and the option appears — but only enable it on a GPT disk.
Do I need to reinstall Windows?
Only if your disk is MBR and you can't or don't want to convert it with mbr2gpt. On a GPT disk you never need to reinstall just for Secure Boot.
Is enabling Secure Boot safe — will I lose data?
It is a BIOS setting and does not erase data, but changes are at your own risk. Photograph your BIOS settings first, and never enable it on a Legacy/MBR system without converting.
