How to Enable Secure Boot for FACEIT

The error Secure Boot is not enabled means exactly what it says: secure boot is switched off in your motherboard firmware. FACEIT has required it from every player since November 25, 2025, because without it an unsigned driver can be loaded into the system — the cheapest route there is for kernel-level cheats.

It takes five minutes to enable. But two things have to happen before you enter UEFI, or you can lose access to your own disk.

AK-47 | RedlineAWP | AsiimovM4A4 | AsiimovUSP-S | Kill ConfirmedAK-47 | Slate

Before you start: BitLocker and disk layout

BitLocker. Changing Secure Boot breaks the encryption key binding, and on the next boot Windows will ask for a 48-digit recovery key. Search for "Manage BitLocker": if encryption is on, suspend protection or save the recovery key. On retail laptops BitLocker is often on by default.

Disk layout. Press Win + R, type msinfo32, and find the BIOS Mode line:

• UEFI — you can continue;
• Legacy — convert the disk to GPT first, otherwise the system will simply not boot once Secure Boot is on. That is a separate procedure: converting MBR to GPT.

Step 1. Reach UEFI without guessing the key

You do not have to catch Del or F2 during boot — Windows can restart straight into the firmware:

1. Start → Settings → System → Recovery.
2. Next to "Advanced startup", click Restart now.
3. After the reboot: Troubleshoot → Advanced options → UEFI Firmware Settings → Restart.

The machine will open UEFI on its own. If there is no "UEFI Firmware Settings" entry, the system is booted in Legacy mode — go back to the disk layout.

Step 2. Turn CSM off

CSM (Compatibility Support Module, called Legacy Support or Launch CSM on some boards) is compatibility mode for older systems. While it is on, Secure Boot cannot be enabled: the option will be grayed out or missing entirely.

Look for CSM under Boot. Set it to Disabled. Some boards then ask for an "OS type" — choose Windows UEFI mode.

Step 3. Enable Secure Boot

The setting lives under Boot, Security, or Authentication, depending on the vendor:

Set it to Enabled, save (usually F10), and let the machine boot.

Step 4. Verify

Win + R → msinfo32 again. You need two lines:

• BIOS Mode: UEFI
• Secure Boot State: On

If the second line says "Unsupported" rather than "Off", Secure Boot did not turn on but reverted instead — most often CSM is still enabled.

If Secure Boot is grayed out

Three causes, by frequency:

1. CSM is still on. The most common case — on some boards CSM hides in a Boot Configuration submenu and is easy to miss.
2. No UEFI administrator password is set. A number of HP and Lenovo laptops will not let you touch Secure Boot until a Supervisor Password is set under Security. Set one, enable Secure Boot, and you can remove the password afterward.
3. The firmware is in Setup Mode. The secure boot keys have been erased — look for an entry like "Restore Factory Keys" or "Install Default Secure Boot Keys" and use it.

FACEIT still complains after enabling it

Then you have hit the next requirement — there are four in total, and the anti-cheat only reports the first unmet one. Next in line is usually TPM 2.0, then IOMMU and VBS. The full map of errors is in the general breakdown.

Why Secure Boot is required at all

The requirement looks like nitpicking until you see what it actually protects. Secure Boot verifies the signatures of everything loading before Windows starts and prevents unsigned code from running at that earliest stage.

That matters specifically for an anti-cheat. Cheats that cannot be caught from inside the system load before it, as a driver or through the bootloader. To a program running inside Windows such a cheat is invisible: it sits one level below. Secure Boot together with TPM closes that door, which is why anti-cheats require them enabled rather than recommended.

It also explains why the requirement cannot be worked around in FACEIT settings: the point is not a checkbox but the state of the boot chain, and it is checked on the system, not on the client.

What to do if the system will not boot afterwards

The situation is rare but frightening, and getting out of it is simple once you know the order.

1. Do not reinstall the system immediately. In the vast majority of cases the data is intact and the problem is that the firmware is looking for the bootloader in the wrong place.
2. Go back into UEFI and restore CSM to its previous state. If the system boots, the disk is laid out as MBR, and what you need is a conversion to GPT rather than a fight with Secure Boot.
3. Check the boot order. After a mode change the Windows Boot Manager entry sometimes slides down the list, and the firmware tries another device.
4. If the bootloader is damaged, repair it from a Windows installation USB: the recovery environment can fix booting without losing files.

Separately: if BitLocker is enabled on the disk and you changed boot settings, the system will ask for the recovery key. It is tied to your Microsoft account, so find it in advance, before rebooting, not after.

Common misconceptions about Secure Boot

"It slows the computer down." It does not. Signature verification happens once at boot and takes a fraction of a second; Secure Boot has no effect on in-game performance.

"You cannot install Linux with it." You can. Major distributions are signed and boot with Secure Boot enabled without any tricks. Disabling it is only needed for unsigned kernels and some manually built drivers.

"It is Microsoft spying." Secure Boot verifies signatures of loading code and sends nothing anywhere. It is a firmware mechanism on your motherboard, not a service.

"If I turn it off, everything breaks again." Turning it off returns the system to its previous state, provided the disk stayed GPT and you did not touch CSM. What usually breaks booting is not Secure Boot itself but changing the disk layout mode along with it.