Direct answer
Check whether the device supports UEFI Secure Boot and whether it is enabled, then compare the result with the approved baseline. Treat unsupported or access-denied results as unknown until their cause is established.
Identify the device and boot mode
Record the device model, Windows version, firmware and management owner. Devices can differ in firmware capabilities and boot configuration; consult vendor documentation before changing startup options. Establish whether a drive-encryption recovery key is available through the approved support process.
Inspect Secure Boot status
On an authorized UEFI device, an administrator can use Confirm-SecureBootUEFI in PowerShell. Microsoft documents True and False for supported systems, an unsupported-platform message for some systems and an access-denied result when required privileges are missing. Preserve the actual output and time rather than converting every error into a failure.
Reference: Microsoft: Confirm-SecureBootUEFI.
Investigate policy differences
Compare the observation with the baseline for that device role. If the system is not using a compatible boot configuration, a change may require planning beyond a firmware toggle. Identify hardware, operating-system and application dependencies and ask the device owner about recent maintenance.
Pilot and verify safely
Before an approved change, confirm an independent recovery method, maintenance window and BitLocker recovery procedure. Follow the device vendor's instructions and test a representative system. After restarting, verify that Windows starts, required applications work and the status is as intended.
Assessment limits
Secure Boot is one part of the startup trust chain. Its enabled status does not prove that Windows or applications are free of compromise, and a firmware change can affect boot or trigger recovery.
Frequently asked questions
Does access denied mean Secure Boot is disabled?
No. Microsoft documents access denied when the command lacks required privileges; recheck using an authorized administrative context.
Does Secure Boot replace endpoint antivirus?
No. It addresses a different stage of system startup and should be considered alongside other protections.
Should firmware settings be changed without a recovery key?
No. Coordinate with the owner and confirm the approved recovery procedure before changing boot or firmware settings.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.