I'm trying to enable Secure Boot on my Gigabyte GA-Z270-Gaming K3, but different guides give conflicting instructions. The BIOS is on version F9d, which appears to be the latest version Gigabyte provides for this motherboard, dated March 2018. I've already enabled TPM, disabled CSM, and set the Windows 8/10 WHQL option. The computer still boots normally, but I'm nervous about the final Secure Boot step, especially the option to restore or install the default keys. If the key mode says "Standard," should I leave it that way?
2 Answers
The WHQL setting and disabled CSM are the relevant prerequisites on that Gigabyte BIOS. “Standard” is the normal setting and should generally be left alone. Before making the change, confirm in Windows that the system is using UEFI mode rather than Legacy mode. You can check this with System Information: look for “BIOS Mode” and make sure it says “UEFI.”
The 2018 BIOS date shouldn’t be a problem—Secure Boot was already supported well before then, and F9d is the newest BIOS listed for this board. Since you’ve enabled TPM, disabled CSM, and selected the Windows WHQL setting, you’re mostly set. Leave the Secure Boot mode on “Standard.” If the keys haven’t been installed, choose the option to install or restore the factory default Secure Boot keys, then enable Secure Boot and save the changes.
Installing the default keys is normal; it doesn’t erase Windows or reset your personal files. The important thing is that Windows is installed in UEFI mode on a GPT drive. If it was installed in legacy/MBR mode, disabling CSM or enabling Secure Boot could prevent it from booting.