Secure Boot - Enable or Disable in UEFI

How to Enable or Disable Secure Boot in UEFI​

UEFI (replaces BIOS) has a firmware validation process, called secure boot, which is defined in Chapter 27 of the UEFI 2.3.1 specification. Secure boot defines how platform firmware manages security certificates, validation of firmware, and a definition of the interface (protocol) between firmware and the operating system. Secure boot prevents “unauthorized” operating systems and software from loading during the startup process.

Quick summary

• UEFI allows firmware to implement a security policy
• Secure boot is a UEFI protocol not a Windows 8 feature
• UEFI secure boot is part of Windows 8 secured boot architecture
• Windows 8 utilizes secure boot to ensure that the pre-OS environment is secure
• Secure boot doesn’t “lock out” operating system loaders, but is a policy that allows firmware to validate authenticity of components
• OEMs have the ability to customize their firmware to meet the needs of their customers by customizing the level of certificate and policy management on their platform
• Microsoft does not mandate or control the settings on PC firmware that control or enable secured boot from any operating system other than Windows

For more information about secure boot, see:

• Secure Boot Overview
• "Secure Boot isn't configured correctly": troubleshooting
• Protecting the pre-OS environment with UEFI - Building Windows 8 - Site Home - MSDN Blogs
• Secured Boot and Measured Boot: Hardening Early Boot Components Against Malware

This tutorial will show you how to enable or disable secure boot in your PC's UEFI settings.

Any PC with a Windows 8 logo sticker has secure boot enabled by default. Secure boot can make Windows 8 very resistant to low-level malware such as rootkits.

If you have secure boot enabled, you may sometimes need to disable secure boot first before being able to boot from a USB flash drive depending on your UEFI firmware settings.

If you would like to post screenshots of your motherboard's secure boot settings, then please do. Here are some others posted so far:

• ASUS P8Z77-V Pro
• Secure Boot (Windows 8) | HP® Support

   Warning

Arm based Windows RT PCs and devices will have a locked boot loader, so you will not be able to disabled secure boot on them.

If you have a Windows 8.1 device that has the device encryption feature turned on and disable secure boot, then you may not be able to access the data on the disk until you enable secure boot again.

Do not enable secure boot with Windows 7, Vista, or XP installed. If you do, these OSs will not boot until secure boot is disabled.

EXAMPLE: "SecureBoot isn't configured correctly" watermark in Windows 8.1



You will see this watermark on the bottom right corner of your desktop if you have Windows 8.1 installed with UEFI and secure boot is not configured correctly even when enabled. To remove this watermark, you will just need to enable and configure secure boot correctly.

Sometimes the watermark doesn't go away even if you correct the settings in UEFI/BIOS or your BIOS doesn't support this feature at all.

Microsoft has acknowledged this issue and released a hotfix KB2902864 to solve this problem. Once you install this hotfix, it'll remove the annoying watermark from your Windows 8.1 desktop.

Windows 8.1 users who have the "SecureBoot isn't configured correctly" watermark on the desktop, can download this hotfix from the following links:

Update removes the "Windows 8.1 SecureBoot isn't configured correctly" watermark in Windows 8.1 and Windows Server 2012 R2

• Download Link for Windows 8.1 (32-bit or x86)
• Download Link for Windows 8.1 (64-bit or x64)
• Download Link for Windows Server 2012 R2

OPTION ONE

Enable or Disable Secure Boot on ASRock Motherboards

This steps below are for how to enable or disable secure boot on an ASRock X79 Extreme11 UEFI motherboard.

These steps will vary depending on what brand and model number your PC or UEFI motherboard is, so please read it's manual to compare with the steps below for how to do so with your specific PC and motherboard.


1. Do step 2 or 3 below depending on how you would like to boot to the UEFI firmware settings.

2. Boot to UEFI Firmware Settings in Windows 8/8.1 "Advanced Options" UI

A) Boot to the UEFI Firmware Settings, then go to step 4 below. (see screenshot below)



3. Boot to UEFI Firmware Settings at Boot
NOTE: This step can be used with any 32-bit or 64-bit Windows installed.

A) During the initial stages at boot, press the DELETE key to enter UEFI firmware settings, and go to step 4 below.
NOTE: Your PC may use another key to press instead, so be sure to read your PC's manual and/or the boot screen to see what key to press.

4. In the motherboard's UEFI firmware settings, click/tap on the Security menu, select the Secure Boot option, and click/tap/press Enter to enable or disable it. (see screenshots below)





5. If you enabled secure boot, then click/tap on the "Install default Secure Boot keys" option. (see screenshot below)
NOTE: This is to configure secure boot.







A) Click/tap on Yes to approve. (see screenshot below)





B) Secure boot has now been enabled and configured. (see screenshot below)



8. Click/tap on the Exit menu, and click/tap on Save Changes and Exit (reboot). (see screenshot below)
NOTE: You can usually also press the F10 to save changes and exit.




9. The computer will now restart to startup Windows.

OPTION TWO

Enable or Disable Secure Boot on Acer PCs

1. See: How to Enable or Disable Secure Boot

[video=youtube;5nG4zMdrHKs]

OPTION THREE

Enable or Disable Secure Boot on HP PCs

1. See: Secure Boot (Windows 8) | HP® Support






That's it,
Shawn

Related Tutorials

---

• How to Check if Secure Boot is Enabled or Disabled in Windows 8 and 8.1
• How to Boot to UEFI Firmware Settings from inside Windows 8
• How to Install Windows 8 Using "Unified Extensible Firmware Interface" (UEFI)
• How to Install Windows 7 Using "Unified Extensible Firmware Interface" (UEFI)
• How to Create a Bootable UEFI USB Flash Drive for Installing Windows 7 and Windows 8
• How to Downgrade Windows 8 to Windows 7
• How to Do a Dual Boot Installation with Windows 8 and Windows 7 or Vista
• How to Check if Windows is Booted in UEFI or Legacy BIOS Mode
• How to Hide or Show Windows 8 Edition and Build Version Watermark on Desktop
• How to Configure Early Launch Antimalware Boot-Start Driver Initialization Policy in Windows 8 and 10

 

[Brink]

Hello s0urce, and welcome to Eight Forums.

Secure Boot is a security feature that prevents “unauthorized” operating systems and software from loading during the startup process. For example, a rootkit virus.

It's up to you to enable or disable Secure Boot, but if you would like better security, it's recommended to enable.

 

[s0urce]

Thank you, Brink.

It should be okey for me to enable it now or it should be done before installing a new OS? I did a clean install of Windows 10 but i don't know if we can still enable it without breaking anything.

 

[Brink]

I'd enable it afterwards.

 

[avismile10]

hi
i have a GA-P85-D3 (rev. 1.x)
how do i enable secure boot?
thanks in advance

 

[Brink]

Hello avismile,

I'm not sure if this is exactly the same for your GIGABYTE motherboard, but it should get you close.

 

[avismile10]

Hello avismile,

I'm not sure if this is exactly the same for your GIGABYTE motherboard, but it should get you close.

View attachment 64344

thanks

 

[Brink]

You're most welcome.

 

[MCPlayer18]

Gramma Nazi:

*You're

 

[Brink]

Gramma Nazi:

*You're

LOL, yeah the spell check autocorrect got me again.

 

[excusemebruh]

Hi everyone
i was wondering if anyone could let me know how to disable secure boot on my gigabyte ga-990fxa-ud3 rev 4.0 motherboard. I am trying to install windows 10(yes i know this is windows 8 forum but u guys look like u know what ur doing) and i have a MRB partition table on my disk and it only works on a GPT disk. So in order to install it on my mbr i have to apparently disable secure boot but idk if there is one in my bios so i would appreciate any suggestions.

btw here is the link to my windows 10 thread on my whole issue installing if ur interested in helping: Need Help trying to set up dual boot into windows 7&10 on single ssd - Windows 10 Forums

good day to everyone and thnx in advance

 

[Brink]

Hello excudemebruh, and welcome to Eight Forums.

Looking at the specs for your Gigabyte ga-990fxa-ud3 rev 4.0 motherboard below, it supports UEFI.

http://www.gigabyte.com/products/product-page.aspx?pid=4672#ov

Since this is a Gigabyte board, is it the same in the screenshot I posted at the link below?

http://www.eightforums.com/tutorial...nable-disable-uefi-post518029.html#post518029

 

[excusemebruh]

yeah i saw that picture before but for some reason (maybe because I'm running windows 7) i do not seem to have "Secure Boot state" option. Here are some screenshot so you can understand what I mean:

 

[excusemebruh]

lol actually never mind i somehow was able to get the installation to work

I just tried setting the legacy usb as first in the boot order(which oddly enough i was positive i tried multiple times yesterday) and not the uefi usb option and it worked !

fyi the legacy option is the usb drive without uefi in front of it

thanks for the reply and i hope u have a great day.

 

[Brink]

Great news.

 

[pacificsurf]

If Im trying to do process of elimination on why I'm having windows 8 boot issues, is it okay to leave secure boot disabled and switch from UEFI to Legacy mode in bios? That should have no negative impact on booting windows?

"Secure boot doesn’t “lock out” operating system loaders, but is a policy that allows firmware to validate authenticity of components"

 

[Brink]

If Im trying to do process of elimination on why I'm having windows 8 boot issues, is it okay to leave secure boot disabled and switch from UEFI to Legacy mode in bios? That should have no negative impact on booting windows?

"Secure boot doesn’t “lock out” operating system loaders, but is a policy that allows firmware to validate authenticity of components"

Hello,

Disabling Secure Boot by itself shouldn't cause an issue with boot. Be sure you turn off Device Encryption or BitLocker first.

However, switching from UEFI to Legacy BIOS (CSM) will often break boot, and require a clean install to stay on Legacy BIOS if you don't want to switch back to UEFI.