What Powershell command to alter SecureBootUEFI SetupMode = False to True

Question

What Powershell command to alter SecureBootUEFI SetupMode = False to True

Ian Tee 40

My Win11 HP PC will not apparently execute a Secure Boot, originally because the Windows Secure Boot Certificate was out-of-date . This certificate has now been updated from 2017 to 2023 with help from HP Support. But my PC will not reboot in Secure Mode & HP advises me not to try changing BIOS settings at this time, but rather contact Microsoft.

Before doing this, I have looked around using Powershell and by chance found that Powershell thinks SecureBootUEFI SecureBoot = True, but SecureBootUEFI SetupMode = False.

So, to me, logically trying to change SecureBootUEFI SetupMode = True should be the next step to try.

But I can find no online information about 'SetupMode' or any commands to try and alter it's status from False to True.

Any suggestions would be appreciated.

(IanT/29-Aug-2026)

++++

PS C:\WINDOWS\system32> Get-SecureBootUEFI -Decoded

cmdlet Get-SecureBootUEFI at command pipeline position 1

Supply values for the following parameters:

Name: SecureBoot

Name Value

---- -----

SecureBoot True

PS C:\WINDOWS\system32> Get-SecureBootUEFI -Decoded

cmdlet Get-SecureBootUEFI at command pipeline position 1

Supply values for the following parameters:

Name: SetupMode

Name Value

---- -----

SetupMode False

++++

Edition Windows 11 Pro

Version 25H2

Installed on ‎17/‎11/‎2024

OS build 26200.9168

Experience Windows Feature Experience Pack 1000.26100.344.0

++++

Ian Tee 40 Reputation points

2026-08-29T13:47:02.3466667+00:00

The AI generated answer that "SetupMode is readable, but not exposed here as a variable that can be directly changed with the documented PowerShell cmdlets" is clear, but does not advance an alternative solution as to how/where an apparent "read-only" variable can be changed !

Answer accepted by question author

0 additional answers

Your answer

Ian Tee 40 Reputation points

2026-08-29T13:47:02.3466667+00:00

The AI generated answer that "SetupMode is readable, but not exposed here as a variable that can be directly changed with the documented PowerShell cmdlets" is clear, but does not advance an alternative solution as to how/where an apparent "read-only" variable can be changed !

Answer 1

SetupMode is not a Windows variable that you can safely change with PowerShell. It is a UEFI firmware state, exposed to Windows through the Secure Boot variables. In particular, SetupMode=False is what you want on a PC that has Secure Boot keys enrolled.

Your two results are consistent with a normal Secure Boot configuration:

SecureBoot = True means the firmware is currently enforcing Secure Boot.

SetupMode = False means the firmware is not in UEFI "setup mode", meaning the platform is operating with its Secure Boot key hierarchy provisioned rather than waiting for keys to be installed.

So I would not try to change SetupMode to True. Doing so is not the next logical step, and there is no supported PowerShell command such as Set-SecureBootUEFI SetupMode True. The documented Set-SecureBootUEFI cmdlet can write certain UEFI Secure Boot variables, but SetupMode is controlled by the firmware as a consequence of the platform key state. It is not an ordinary Boolean setting that Windows can simply flip.

Microsoft's recent Secure Boot work involves replacing older UEFI certificates with newer certificates, and there are several separate pieces involved: the Platform Key (PK), Key Exchange Key (KEK), allowed-signature database (db), and the Secure Boot firmware variables/certificates. Updating one certificate does not necessarily mean that the firmware has completed the entire new Secure Boot certificate/key transition.

I would check the actual Secure Boot configuration rather than trying to alter SetupMode. In an elevated PowerShell window, run:

Confirm-SecureBootUEFI

Then run:

Get-SecureBootUEFI -Name PK,KEK,db,dbx

The second command will return binary data rather than a particularly useful human-readable description, so it is not necessarily the best diagnostic by itself.

An easier first check is to run:

msinfo32

Under System Summary, look for:

BIOS Mode Secure Boot State

Normally, you would expect:

BIOS Mode: UEFI Secure Boot State: On

If those say UEFI and On, then the PC is already booting with Secure Boot enabled. In that situation, SetupMode=False is not evidence of a problem. In fact, changing SetupMode to True would generally indicate moving the firmware into a state where Secure Boot keys can be provisioned, which is not what you normally want on a functioning Secure Boot system.

Btw. if by "will not reboot in Secure Mode" you mean that HP's firmware/Windows process is supposed to perform a Secure Boot certificate update and the machine refuses to complete that reboot/update, that is a different problem from Windows simply reporting Secure Boot as enabled. SecureBoot=True does not by itself prove that the particular Microsoft certificates HP was trying to install are present in the firmware's db database.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Ian Tee 40 Reputation points

2026-08-30T10:17:55.4366667+00:00

Hi Marcin,

Thanks for your detailed response. I think that the diagnostics from both Powershell & from msinfo32 both seem to be as you would expect, and imply that Secure Boot is enabled and working on my PC. Therefore the Windows Security Device Security status display for Secure Boot may be misleading me. So I think I will just have to leave things as they are, and possibly hope that some future Windows Update will resolve the the Windows Security Device Security status display.

Many thanks for your response. I've clicked Accept on it.

Ian T
Marcin Policht 107K Reputation points MVP Volunteer Moderator

2026-08-30T11:06:23.32+00:00

Hi Ian - for some reason - your action didn't take effect (accepting the answer) - would you mind giving it another try?

Answer 2

There is no supported PowerShell command in the provided material to change SetupMode from False to True directly.

What is supported:

Get-SecureBootUEFI can read Secure Boot UEFI variables, including SetupMode and SecureBoot.
Set-SecureBootUEFI can set only these Secure Boot variables: PK, KEK, DB, and DBX.
SetupMode is not listed as a supported target for Set-SecureBootUEFI.

That means SetupMode is readable, but not exposed here as a variable that can be directly changed with the documented PowerShell cmdlets.

For the current system state:

SecureBoot = True indicates Secure Boot is enabled.
SetupMode = False does not, by itself, indicate something that should be manually flipped with PowerShell based on the documented cmdlets.

A safe way to inspect the value is:

Get-SecureBootUEFI -Name SetupMode

or for Secure Boot:

Get-SecureBootUEFI -Name SecureBoot

Important: changing Secure Boot-related UEFI variables is a high-risk operation. Incorrect changes can prevent boot or break platform trust settings. The documented write cmdlet is limited to key and signature database variables, and it must be run in an elevated PowerShell session.