How to resolve the issue where, after enabling Secure Boot Mode (Sandal) in the BIOS, saving, and restarting the computer, Secure Boot Mode still fails to activate and displays the message: "Standard hardware security is not supported"?

The message “Standard hardware security not supported” appears when Windows detects that at least one of the requirements for standard hardware security isn’t fully met at boot time, even if TPM, DEP, and UEFI MAT are present. One common cause is that Secure Boot isn’t actually active (for example, keys aren’t installed or firmware isn’t in pure UEFI mode), so Windows can’t report standard hardware security.

To resolve this, follow these steps:

1. Verify that the system is booting in UEFI mode
   • In Windows, run msinfo32.
   • In System Summary, confirm that BIOS Mode is UEFI.
   • If it is not UEFI, switch the firmware from Legacy/CSM to UEFI-only, then reinstall or repair Windows as needed so it boots in UEFI mode.
2. Confirm Secure Boot is actually enabled
   • Open an elevated PowerShell window and run:

          Confirm-SecureBootUEFI
     

   • The value must be True for Secure Boot to be active. If it is False or an error is returned, Secure Boot is not fully enabled.
3. Enable Secure Boot in firmware and load default keys
   • Restart into UEFI firmware settings from Windows:
     • Go to Settings > System > Recovery > Advanced startup > Restart now.
     • Select Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.
   • In the firmware, locate Secure Boot (often under Security, Boot, or Authentication):
     • Set Secure Boot to Enabled.
     • If there is an option for Standard vs Custom, choose Standard.
     • If available, choose to Install/Load factory default Secure Boot keys (for example “Install All Factory Default Keys” or similar). This ensures Windows and OEM keys are present so Secure Boot can validate the bootloader.
   • Save changes and reboot.
4. Re-check Windows hardware security status
   • Open Windows Security > Device security.
   • If Secure Boot is enabled and the device meets the other requirements (TPM 2.0, DEP, UEFI MAT), the message should change to Your device meets the requirements for standard hardware security or higher.
5. If Secure Boot still cannot be enabled
   • Some devices require resetting firmware to factory defaults before Secure Boot can be turned on. Use the firmware option to reset BIOS/UEFI to defaults, then repeat the Secure Boot enablement and key installation.
   • If the firmware still does not allow Secure Boot to be enabled, contact the device or motherboard manufacturer for guidance, as recommended, because support and exact steps can be hardware-specific.

These steps align with the requirement that Secure Boot must be enabled and functioning, in addition to TPM 2.0, DEP, and UEFI MAT, for Windows to report that standard hardware security is supported.

References:

• Device Security in the Windows Security App
• Windows 11 and Secure Boot
• Disabling Secure Boot
• Windows 10 device with secure boot enabled shows as Not Compliant in Intune