How to Enable or Disable System Guard Secure Launch for Firmware Protection in Windows System Guard Secure Launch is a Windows Security feature that verifies firmware integrity and the hypervisor during the boot process, Before the operating system starts. It helps protect your device from tampered or malicious firmware and boot components. In this video, we’ll show you how to enable or disable the feature in Windows. Before we begin, be sure to subscribe to NinjaOne’s IT video hub and our YouTube channel for more tech content like this. Prerequisites for System Guard Secure Launch Settings Modification Before making any changes, ensure your system meets the following requirements: UEFI firmware with Secure Boot support Active and enabled TPM 2.0 Hyper-V and Virtualization-based Security support or enablement Administrator privileges If these prerequisites are met, you can then proceed with your chosen configuration method. Configuring System Guard Secure Launch Settings Users can choose between the Group Policy Editor, Registry Editor, or PowerShell to configure their System Guard Secure Launch settings. Method 1: Group Policy Method The Group Policy Editor is the preferred method for enterprise or batch deployments using Windows Pro, Enterprise, or Education editions. To use this method, press Win + R type gpedit.msc, and hit Enter to open the Local Group Policy Editor. Then go to Computer Configuration Administrative Templates System > Device Guard. Double-click Turn on Secure Launch and choose your preferred configuration. You can select Enabled to turn System Guard Secure Launch on or Disabled to turn it off. Click Apply, then OK, and reboot your system. Method 2: Registry Editor Users with no access to Group Policies can opt to use Registry Editor. This method should work on both Windows 10 and 11. To start, press Win + R, type regedit and click OK to open Registry Editor. In the Registry address bar, paste Look for the EnableSecureLaunch value. If it doesn't exist, create it by right clicking on the right pane and selecting New > DWORD (32-bit) Value. Name the new value. EnableSecureLaunch. Double-click the EnableSecureLaunch value to modify it. Set the Value data to 1 to enable System Guard Secure Launch or 0 to disable it. Finally, click OK to confirm. Method 3: PowerShell Alternatively, you can also use PowerShell to configure this feature. To do this, open PowerShell as an administrator and run the appropriate command to enable the feature. To enable the feature, run this command To disable the feature, run this command. Restart the device after making changes to ensure the setting is applied. System Guard Secure Launch adds an additional layer of protection by validating firmware and critical boot components before Windows starts. For more information, check out our official blog post on How to Enable or Disable System Guard Secure Launch for Firmware Protection in Windows Linked in the description below.