Introduction

Changing firmware settings does not have to feel risky or confusing. You can start the process directly from Windows and hand off cleanly into UEFI. That means less guesswork and no frantic key tapping during boot. This guide shows exactly how to reach your UEFI menus from within Windows, which tools and commands work, and which settings you are likely to change. You will see when you can use vendor utilities inside Windows and when you must enter UEFI to apply the setting.
We focus on common tasks that most users and admins want to perform: enabling virtualization for Hyper-V or WSL2, turning on or off Secure Boot, enabling TPM for device security and BitLocker, and selecting the right boot mode and boot order. You will learn how to prepare safely, reach UEFI three different ways, make changes with confidence, and verify the results back in Windows.
Each section builds on the last. After you set expectations about what changing BIOS settings from Windows really means, you will check your current state and prepare. Then you will open UEFI using Settings, commands, or OEM hotkeys. Finally, you will apply changes, confirm success, and handle problems without panic.

change bios settings from windows

What ‘from Windows’ really means: UEFI vs. legacy BIOS and what you can and cannot change

Windows does not flip most firmware toggles live while the operating system is running. Instead, Windows offers clean paths to reboot into the device firmware so you can adjust settings there. Modern systems use UEFI, which can expose a handoff tile named ‘UEFI Firmware Settings’ within Advanced startup. On older or legacy configurations that boot with CSM, that tile will not appear because the system does not support a UEFI handoff.
You can still efficiently start from Windows even if the actual change happens inside UEFI. Three methods cover nearly every scenario: the Windows Settings path that restarts into Advanced startup, command-line switches that jump straight to UEFI or the recovery menus, and classic OEM hotkeys during power-on. A few OEM utilities can stage or apply certain settings from inside Windows and complete them at the next reboot.
Before you choose a method, confirm your device capabilities. Knowing whether the device boots in UEFI, and whether Secure Boot and TPM are active, helps you decide what you can adjust and how to proceed.

Check your firmware and security state from Windows (UEFI or Legacy, Secure Boot, TPM)

Run a few quick checks before making any changes. These checks reveal whether your device uses UEFI, whether Secure Boot is on, whether TPM is present, and whether virtualization is already enabled.
– Press the Windows key, type msinfo32, and open System Information. Look for ‘BIOS Mode’ to see UEFI or Legacy. Check ‘Secure Boot State’ to see On or Off.
– Open Windows Security, then Device security. If you see Security processor details, TPM is likely present and active. You can also press Windows key + R, run tpm.msc, and confirm Status and Specification version.
– Open Task Manager, switch to the Performance tab, and select CPU. Check the ‘Virtualization’ field. If it shows Enabled, VT-x or SVM is already active.
If you see Legacy mode, you will not find the UEFI handoff tile. If Secure Boot is off but you plan to enable it, confirm that the boot drive uses GPT and the system uses UEFI mode. If TPM is missing, the device may need Intel PTT or AMD fTPM enabled in UEFI. With this baseline set, prepare the device so firmware changes do not interrupt your work or cause preventable lockouts.

Prepare safely: backups, suspend BitLocker, admin rights, AC power, and restore points

Preparation reduces risk when you hand off control from Windows to firmware. A few minutes here can save hours later.
– Back up important files. Use File History, OneDrive, or your preferred backup tool.
– Suspend BitLocker. Open Control Panel, go to BitLocker Drive Encryption, and select Suspend protection. Save your recovery key to your Microsoft account or a secure file.
– Ensure administrator rights. You need admin privileges for commands and OEM tools.
– Plug in AC power for laptops and tablets. Avoid firmware edits on a low battery.
– Close apps and save work. This prevents open files from delaying your restart.
– Create a restore point. While this does not undo firmware changes, it helps if drivers or updates conflict after your reboot.
Once ready, choose how you want to reach UEFI. The Settings route is the most guided path, which is a good place to start before moving to command shortcuts.

Method 1: Open UEFI Firmware Settings via Windows Settings > System > Recovery > Advanced startup

If you prefer a click-first experience, use the Settings path to reach the UEFI handoff.

Steps

  1. Open Settings and select System.
  2. Select Recovery. Under Recovery options, select ‘Restart now’ next to Advanced startup and confirm.
  3. Your device restarts to the Windows Recovery Environment.
  4. Select Troubleshoot > Advanced options > UEFI Firmware Settings.
  5. Select Restart to boot directly into UEFI.
    If you see the ‘UEFI Firmware Settings’ tile, the device supports a direct transfer to firmware. If the tile is missing, your system may use legacy boot, WinRE might be disabled, or an OEM policy could hide this path. Do not worry; the next method uses fast commands that work on many devices. After that, you can fall back to OEM hotkeys.

Method 2: Command-line fast path — shutdown /r /fw /t 0, shutdown /r /o, and variations

Command switches give you a reliable, fast way to jump into UEFI or the recovery menus from anywhere, including remote sessions.

Use /fw to request firmware on next boot

  • Open an elevated Windows Terminal, Command Prompt, or PowerShell.
  • Run: shutdown /r /fw /t 0
  • The device reboots and requests UEFI firmware on the next boot if supported.

Use /o to reach Advanced startup

  • If /fw does not work, run: shutdown /r /o /t 0
  • The device reboots to the recovery menus. From there, select Troubleshoot > Advanced options > UEFI Firmware Settings.

Tips for reliable handoffs

  • Add a brief delay with /t 5 if you need seconds to prepare.
  • If Fast Startup causes you to miss firmware, disable it in Control Panel > Power Options > Choose what the power buttons do > Change settings > clear ‘Turn on fast startup’.
    These commands are fast and predictable, which is ideal for admins and power users. If your device still resists opening UEFI, the OEM hotkey path will always be available at boot.

Method 3: OEM hotkeys and Fast Startup caveats

Every vendor offers keys to enter firmware setup and a one-time boot menu. Fast Startup can shorten the POST phase and hide prompts, so disable it if you cannot catch the key press.
– Dell: F2 for Setup, F12 for Boot Menu.
– HP: F10 for Setup, ESC then F9 for Boot Menu.
– Lenovo: F1 or F2 for Setup, Enter or F12 for Boot Menu, or use the Novo button.
– ASUS: Del or F2.
– MSI: Del.
– Acer: F2 or Del.
Power off fully, then power on and tap the key repeatedly as soon as the screen lights up. Another reliable trick: hold Shift while selecting Restart from the Start menu, then choose Troubleshoot > Advanced options to find the UEFI handoff. With UEFI open, you can change the settings you verified earlier. Next, learn what each common setting does and where to find it.

Change common firmware options once in UEFI: virtualization, Secure Boot, TPM, boot mode and boot order

UEFI menus vary by vendor, but the core options look similar. Move carefully, change one item at a time, and save before exiting.

Virtualization (Intel VT-x, VT-d, AMD SVM, IOMMU)

  • Location: Typically under Advanced, CPU Configuration, or Chipset.
  • What to do: Enable VT-x or SVM for hypervisors and WSL2. Enable VT-d or IOMMU for device assignment and better I/O virtualization.
  • Why it matters: Tools like Hyper-V, VirtualBox, VMware Workstation, and WSL2 require virtualization. Without it, VMs may not start or will perform poorly.

TPM (Intel PTT or AMD fTPM)

  • Location: Security or Trusted Computing.
  • What to do: Enable Intel PTT on Intel platforms or AMD fTPM/PSP on AMD platforms.
  • Why it matters: TPM 2.0 unlocks BitLocker, Windows Hello, and core Windows 11 security features. If TPM is off, Windows may show reduced security and some features will not work.

Secure Boot

  • Location: Security, Boot, or a dedicated Secure Boot menu.
  • What to do: Enable Secure Boot to validate bootloaders and drivers. If you dual boot or use unsigned drivers, plan for compatibility.
  • Caution: Turn off and on only with BitLocker suspended. Changing Secure Boot can trigger recovery prompts.

Boot mode (UEFI vs. Legacy/CSM)

  • Location: Boot mode or CSM settings in the Boot section.
  • What to do: Keep UEFI for Windows 11. Do not switch to Legacy unless you understand the disk layout and bootloader impact.
  • Caution: Switching modes on a GPT disk can render Windows unbootable. If you must change modes, prepare recovery media.

Boot order and one-time boot

  • Location: Boot priority or Boot Option Priorities.
  • What to do: Move the OS boot entry to the top for normal use. For installs or recovery, temporarily boot from USB using the one-time boot menu.
  • Tip: Prefer the one-time boot menu for temporary boots so you do not forget to undo a permanent boot order change.
    After you apply changes, save and exit. The system will reboot. Next, see how certain vendors let you make limited changes from inside Windows without entering UEFI.

Make limited BIOS changes from inside Windows using OEM tools (Dell, HP, Lenovo, ASUS, MSI)

OEM utilities give admins a way to script or stage firmware changes at scale. They usually require a reboot to apply and may require a BIOS password.
– Dell: Dell Command | Configure provides command-line and PowerShell interfaces. It can toggle Secure Boot, enable TPM, adjust boot order, and manage passwords. Many changes finalize after a restart.
– HP: HP BIOS Configuration Utility reads and applies settings from REPSET files. Use it in task sequences or scripts. Sensitive changes need the BIOS password and a reboot.
– Lenovo: Think BIOS Config and WMI classes let you export, set, and password-protect firmware options on ThinkPad and ThinkCentre devices. Commercial Vantage can assist with updates.
– ASUS and MSI: Consumer tools like Armoury Crate, AI Suite, or MSI Center focus on updates and performance tuning. They rarely expose deep firmware flags but help update BIOS safely from Windows.
Use admin rights and suspend BitLocker before applying changes that affect boot flow, Secure Boot, or TPM. Test on a single device, check return codes, and document what you changed. If Windows does not show the UEFI handoff at all, the next section explains why and how to restore it.

If ‘UEFI Firmware Settings’ is missing in Windows: causes and fixes

When the tile is missing from Advanced options, work through these causes methodically.
– Legacy or CSM boot mode: msinfo32 shows Legacy. Windows cannot offer a UEFI handoff. Consider converting the disk with the MBR2GPT tool if supported, then enable UEFI in firmware.
– WinRE disabled: In an elevated terminal, run reagentc /info. If disabled, run reagentc /enable to restore Advanced startup menus.
– OEM restrictions: Managed or locked-down devices may hide the tile. Use OEM hotkeys or approved admin tools instead.
– Outdated or buggy firmware: Update BIOS from the vendor. Newer versions expose the variables that /fw relies on.
– BitLocker or group policy: Security policies can block certain boot transitions. Adjust local policy if you manage the device, or contact your admin.
If none of these apply, try shutdown /r /fw /t 0. If that fails, rely on the hotkey path. Once you finish your changes, verify everything back in Windows so you know the settings stuck.

Verify changes back in Windows (msinfo32, Device Security, tpm.msc, Task Manager, bcdedit)

Verification closes the loop and prevents confusion later. Use quick, built-in tools to confirm status.
– Virtualization: Open Task Manager > Performance > CPU and check the ‘Virtualization’ field. If Disabled, revisit UEFI and enable VT-x or SVM.
– TPM: Run tpm.msc and confirm the status reads that the TPM is ready for use and the specification version is 2.0. Device security in Windows Security also shows TPM health.
– Secure Boot: Open msinfo32 and check ‘Secure Boot State: On’. Ensure ‘BIOS Mode’ reads UEFI.
– Boot mode and entries: msinfo32 confirms UEFI mode. bcdedit /enum shows boot entries if you need to inspect them. For boot order changes, use the one-time boot menu to validate an external boot path.
If results are not what you expect, make one change at a time and retest. That method keeps troubleshooting simple. If something goes wrong, the next section gives practical rollback steps.

Troubleshooting and safe rollback (firmware reset, clearing CMOS, handling boot loops, password locks)

Even careful changes can cause issues. The key is to stay calm and reverse what you just changed.
– Boot loops or no boot: Re-enter UEFI and choose ‘Load Setup Defaults’ or ‘Optimized Defaults’. Save and reboot. Disconnect external drives and USB devices, then try again.
– BitLocker recovery: If asked for a recovery key, sign in at account.microsoft.com/devices/recoverykey or use your saved key. After recovery, suspend BitLocker before making more firmware changes.
– Firmware password problems: If you forget a BIOS or UEFI password, some vendors allow recovery with proof of ownership. Others require service. Keep passwords in an approved vault.
– Clear CMOS as a last resort: Power down, unplug, and use the board jumper or remove the coin-cell battery for several minutes on desktops. Always consult your device manual.
– Update firmware: If a setting refuses to stick or menus seem broken, update to the latest BIOS from the OEM support site, then try again.
– Repair boot mode mistakes: If switching UEFI and Legacy broke boot, switch back or boot from Windows installation media and use automatic repair. Do not convert modes without a recovery plan.
After recovery, re-enable BitLocker and confirm Secure Boot and TPM states. Record what you changed and why. That audit trail speeds future maintenance and helps others repeat your success.

Conclusion

You can start firmware configuration confidently from Windows using three reliable paths: Settings, commands, and OEM hotkeys. The actual toggles live in UEFI, but Windows provides clean, repeatable handoffs that save time. With a small safety checklist — backups, suspended BitLocker, admin rights, and AC power — you lower risk and avoid surprises.
Most users only need to enable virtualization, Secure Boot, and TPM, and sometimes adjust boot order. Verify each change back in Windows so you do not guess. If Windows hides UEFI access, use the command-line path, check WinRE status, update firmware, and rely on OEM hotkeys as a fallback. Keep recovery keys and firmware passwords safe, document changes, and change only one item at a time.
Follow this process and you will change BIOS settings from Windows with clarity, control, and minimal downtime.

Frequently Asked Questions

How do I open BIOS/UEFI from Windows if the UEFI Firmware Settings option is missing?

Start with a command: run shutdown /r /fw /t 0 as admin to request firmware on next boot. If that fails, run shutdown /r /o /t 0 to reach Advanced startup, then choose Troubleshoot > Advanced options. Check WinRE with reagentc /info and enable it with reagentc /enable if needed. If msinfo32 shows Legacy mode, the UEFI tile will not appear; use your OEM hotkey such as F2, Del, or F10 during power on.

Can I change BIOS options directly in Windows without rebooting, and which OEM tools support it?

Most firmware changes require a reboot into UEFI. Some OEM tools can stage or apply settings from Windows and finish on restart. Examples include Dell Command | Configure, HP BIOS Configuration Utility, and Lenovo WMI or Think BIOS Config. These tools can manage TPM, Secure Boot, boot order, and passwords on supported models. Always run as admin, suspend BitLocker first, and test on one device before scaling.

Will changing Secure Boot, TPM, or boot order affect BitLocker or Windows startup?

Yes. Toggling Secure Boot, enabling or disabling TPM, or switching boot mode can trigger BitLocker recovery or break boot if the disk layout does not match. Suspend BitLocker before changes and keep your recovery key handy. Change one setting at a time, save, reboot, and verify in Windows to avoid confusion. If a change causes a boot loop, load firmware defaults and try again.