Secure Boot - Enable or Disable in UEFI

How to Enable or Disable Secure Boot in UEFI​

UEFI (replaces BIOS) has a firmware validation process, called secure boot, which is defined in Chapter 27 of the UEFI 2.3.1 specification. Secure boot defines how platform firmware manages security certificates, validation of firmware, and a definition of the interface (protocol) between firmware and the operating system. Secure boot prevents “unauthorized” operating systems and software from loading during the startup process.

Quick summary

• UEFI allows firmware to implement a security policy
• Secure boot is a UEFI protocol not a Windows 8 feature
• UEFI secure boot is part of Windows 8 secured boot architecture
• Windows 8 utilizes secure boot to ensure that the pre-OS environment is secure
• Secure boot doesn’t “lock out” operating system loaders, but is a policy that allows firmware to validate authenticity of components
• OEMs have the ability to customize their firmware to meet the needs of their customers by customizing the level of certificate and policy management on their platform
• Microsoft does not mandate or control the settings on PC firmware that control or enable secured boot from any operating system other than Windows

For more information about secure boot, see:

• Secure Boot Overview
• "Secure Boot isn't configured correctly": troubleshooting
• Protecting the pre-OS environment with UEFI - Building Windows 8 - Site Home - MSDN Blogs
• Secured Boot and Measured Boot: Hardening Early Boot Components Against Malware

This tutorial will show you how to enable or disable secure boot in your PC's UEFI settings.

Any PC with a Windows 8 logo sticker has secure boot enabled by default. Secure boot can make Windows 8 very resistant to low-level malware such as rootkits.

If you have secure boot enabled, you may sometimes need to disable secure boot first before being able to boot from a USB flash drive depending on your UEFI firmware settings.

If you would like to post screenshots of your motherboard's secure boot settings, then please do. Here are some others posted so far:

• ASUS P8Z77-V Pro
• Secure Boot (Windows 8) | HP® Support

   Warning

Arm based Windows RT PCs and devices will have a locked boot loader, so you will not be able to disabled secure boot on them.

If you have a Windows 8.1 device that has the device encryption feature turned on and disable secure boot, then you may not be able to access the data on the disk until you enable secure boot again.

Do not enable secure boot with Windows 7, Vista, or XP installed. If you do, these OSs will not boot until secure boot is disabled.

EXAMPLE: "SecureBoot isn't configured correctly" watermark in Windows 8.1



You will see this watermark on the bottom right corner of your desktop if you have Windows 8.1 installed with UEFI and secure boot is not configured correctly even when enabled. To remove this watermark, you will just need to enable and configure secure boot correctly.

Sometimes the watermark doesn't go away even if you correct the settings in UEFI/BIOS or your BIOS doesn't support this feature at all.

Microsoft has acknowledged this issue and released a hotfix KB2902864 to solve this problem. Once you install this hotfix, it'll remove the annoying watermark from your Windows 8.1 desktop.

Windows 8.1 users who have the "SecureBoot isn't configured correctly" watermark on the desktop, can download this hotfix from the following links:

Update removes the "Windows 8.1 SecureBoot isn't configured correctly" watermark in Windows 8.1 and Windows Server 2012 R2

• Download Link for Windows 8.1 (32-bit or x86)
• Download Link for Windows 8.1 (64-bit or x64)
• Download Link for Windows Server 2012 R2

OPTION ONE

Enable or Disable Secure Boot on ASRock Motherboards

This steps below are for how to enable or disable secure boot on an ASRock X79 Extreme11 UEFI motherboard.

These steps will vary depending on what brand and model number your PC or UEFI motherboard is, so please read it's manual to compare with the steps below for how to do so with your specific PC and motherboard.


1. Do step 2 or 3 below depending on how you would like to boot to the UEFI firmware settings.

2. Boot to UEFI Firmware Settings in Windows 8/8.1 "Advanced Options" UI

A) Boot to the UEFI Firmware Settings, then go to step 4 below. (see screenshot below)



3. Boot to UEFI Firmware Settings at Boot
NOTE: This step can be used with any 32-bit or 64-bit Windows installed.

A) During the initial stages at boot, press the DELETE key to enter UEFI firmware settings, and go to step 4 below.
NOTE: Your PC may use another key to press instead, so be sure to read your PC's manual and/or the boot screen to see what key to press.

4. In the motherboard's UEFI firmware settings, click/tap on the Security menu, select the Secure Boot option, and click/tap/press Enter to enable or disable it. (see screenshots below)





5. If you enabled secure boot, then click/tap on the "Install default Secure Boot keys" option. (see screenshot below)
NOTE: This is to configure secure boot.







A) Click/tap on Yes to approve. (see screenshot below)





B) Secure boot has now been enabled and configured. (see screenshot below)



8. Click/tap on the Exit menu, and click/tap on Save Changes and Exit (reboot). (see screenshot below)
NOTE: You can usually also press the F10 to save changes and exit.




9. The computer will now restart to startup Windows.

OPTION TWO

Enable or Disable Secure Boot on Acer PCs

1. See: How to Enable or Disable Secure Boot

[video=youtube;5nG4zMdrHKs]

OPTION THREE

Enable or Disable Secure Boot on HP PCs

1. See: Secure Boot (Windows 8) | HP® Support






That's it,
Shawn

Related Tutorials

---

• How to Check if Secure Boot is Enabled or Disabled in Windows 8 and 8.1
• How to Boot to UEFI Firmware Settings from inside Windows 8
• How to Install Windows 8 Using "Unified Extensible Firmware Interface" (UEFI)
• How to Install Windows 7 Using "Unified Extensible Firmware Interface" (UEFI)
• How to Create a Bootable UEFI USB Flash Drive for Installing Windows 7 and Windows 8
• How to Downgrade Windows 8 to Windows 7
• How to Do a Dual Boot Installation with Windows 8 and Windows 7 or Vista
• How to Check if Windows is Booted in UEFI or Legacy BIOS Mode
• How to Hide or Show Windows 8 Edition and Build Version Watermark on Desktop
• How to Configure Early Launch Antimalware Boot-Start Driver Initialization Policy in Windows 8 and 10

 

[Brink]

Thank you Ray. I added that as OPTION TWO.

 

[gregor69]

What issue are you having?

Does it say you have secure boot enabled (true) in step 1 and 2 in that tutorial?

If true, the you would want to disable secure boot by using step 3 in that tutorial.

Hi Brink,

The original owner of my laptop upgraded Windows 7 to Windows 8 Pro, if you can, could you direct me to a guide on how to downgrade/revert it back to Windows 7?

Note: The laptop does not have UEFI so I couldn't complete the guide I linked above.

 

[Brink]

Greg,

Since it doesn't have UEFI, this will make it easier to return to Windows 7.

If the factory recovery partition is still in tact, then you may be able to do a factory recovery to restore the laptop back to factory conditions with Windows 7.

If not, or you prefer a clean install without the factory bloatware, you could use the tutorial below to do a clean install of Windows 7. You will need to have the Windows 7 product key number on the COA sticker on the bottom of the laptop or under it's battery to use to activate Windows 7 with.

Clean Reinstall - Factory OEM Windows 7 - Windows 7 Help Forums

 

[theog]

Secure Boot (Windows 8) | HP® Support
Screenshots in the above link.

DESKTOP

Disabling Secure Boot

You may want to disable Secure Boot in order to install new hardware or boot from a CD or DVD. Follow these steps to disable Secure Boot:

1) Turn off the computer.

2) Turn on the computer and immediately press the F10 key repeatedly, about once every second, until the Computer Setup Utility opens.

3) Use the left and right arrow keys to select the Security menu, then use the up and down arrow keys to select Secure Boot Configuration , and then press Enter .

4) The Secure Boot Configuration warning displays. Press F10 to continue.

5) Use the up and down arrow keys to select Secure Boot , then use the left and right arrow keys to change the setting to Disable .

6) Use the up and down arrow keys to select Legacy Support , then use the left and right arrow keys to change the setting to Enable .

7) Press F10 to accept the changes.

8) Press F10 again, then press Enter twice to restart the computer.

9) As soon as the computer starts, a message appears indicating that the boot mode has changed.

10) Type the four-digit code shown in the message, then press Enter to confirm the change.

NOTEBOOK.

You may want to disable Secure Boot in order to install new hardware or boot from a CD or DVD. Follow these steps to disable Secure Boot:

1) Turn off the computer.

2) Immediately press the Escape key repeatedly, about once every second, until the Startup Menu opens.

3) Use the right arrow key to choose the System Configuration menu, use the down arrow key to select Boot Options , then press Enter .

4) Use the down arrow key to select Secure Boot , press the Enter key, then use the down arrow key to modify the setting to Disabled .

5) Press Enter to save the change.

6) Use the left arrow key to select the File menu, use the down arrow key to select Save Changes and Exit , then press Enter to select Yes .

7) The Computer Setup Utility closes and the computer restarts. When the computer has restarted, the Operating System Boot Mode Change screen appears, prompting you to confirm the Boot Options change. Type the code shown on the screen, then press Enter to confirm the change and continue to Windows.

 

[Brink]

Thank you Ray. Added to list.

 

[theog]

Fujitsu Manual:
View attachment Secure Boot 1.zip

Security -> Secure Boot -> Secure Boot Control

Fujitsu Manual:
View attachment Secure Boot 2.zip

Security – Secure Boot Configuration – Secure Boot Option : [Disabled]

Technical Support pages from Fujitsu

 

[Pichard Rarker]

Trying to disable secure boot on a gigabyte GA990FXA-ud3. Trying to boot Linux and to do so this has to be disabled. I have searched everywhere and can't find it, here is my boot screen, do all uefi have the secure boot option? Is it possible it's simply other OS for OS type?
Thank you

 

[theog]

Trying to disable secure boot on a gigabyte GA990FXA-ud3. Trying to boot Linux and to do so this has to be disabled.View attachment 21704 I have searched everywhere and can't find it, here is my boot screen, do all uefi have the secure boot option? Is it possible it's simply other OS for OS type?
Thank you

Welcome to EightForums.

GIGABYTE - Motherboard - Socket AM3+ - GA-990FXA-UD3 (rev. 1.0)

Qualified for Windows® 7


The motherboard qualified for WHQL (Windows Hardware Quality Labs) certification of Windows 7 from Microsoft®, setting the standard for future Windows 7 certified motherboards...

The gigabyte GA990FXA-ud3 is Qualified for Windows 7, therefore NO Secure Boot.

 

[Brink]

Hello Pichard, and welcome to Eight Forums.

From your screenshot it looks like you have a GA-990FXA-UD3 (rev. 3.0) motherboard with UEFI DualBIOS instead of (rev. 1.0) with DualBIOS with Hybrid EFI technology. Please verify the revision number of your motherboard.

GIGABYTE - Motherboard - Socket AM3+ - GA-990FXA-UD3 (rev. 3.0)

Manual PDF: http://download.gigabyte.us/FileList/Manual/mb_manual_ga-990fxa-ud3_v.3.x_e.pdf​

​

I looked through your manual, and I don't see anything about it have secure boot as well.

Hope this helps,
Shawn

 

[Pichard Rarker]

Hey Brink,

Thank you for the hlep, It's rev. 3.
Is is strange for this new of a motherboard to not have secure boot? Is it possible that it's called something else?

Thank you again.

 

[theog]

SAMSUNG's Digital World - Support
Screenshots in the above link.

1) Enter the BIOS by pressing the F2 key while your system is booting up.

2) Move to the boot menu using the right arrow key.

3) Select 'Secure Boot' and then select 'DISABLED'

 

[Brink]

Hey Brink,

Thank you for the hlep, It's rev. 3.
Is is strange for this new of a motherboard to not have secure boot? Is it possible that it's called something else?

Thank you again.

Pichard,

Sorry I missed your reply. It's a newer version of an older hybrid UEFI style motherboard that doesn't support secure boot yet. Only the full UEFI motherboards support secure boot.

 

[zsatan]

Greg

What options do you have in CSM, UEFI or UEFI & Legacy is needed.


Found some Asus K55N screenshots, but not options in CSM.




ENABLE CSM

ENABLE PXE OpROM

ENABLE Secure Boot

View attachment 19538
View attachment 19539
View attachment 19540
View attachment 19541
View attachment 19542

i'm use asus k46cb wx 126d
i don't have menu Launch CSM and Secure Boot
ask i'm install windows 8 UEFI success
ask comfirm secrue boot show in powershell < false >

 

[Brink]

Hello zsatan, and welcome to Eight Forums.

From page A-4 in the appendix of the K46CB manual, do you have any other options available when you have UEFI Boot set to be "Enabled"?

 

[zsatan]

Hello zsatan, and welcome to Eight Forums.

From page A-4 in the appendix of the K46CB manual, do you have any other options available when you have UEFI Boot set to be "Enabled"?

View attachment 26041

bios i'don't have menu UEFI Boot

 

[Brink]

zsatan,

It doesn't appear that your BIOS has any UEFI settings.

Please open MSINFO32 (System Information), then see if BIOS Mode says UEFI or Legacy like below.

 

[zsatan]

supports UEFI ??
not supports UEFI ??

 

[Brink]

zsatan,

Well, you definitely are in UEFI mode, but I'm not seeing any support or options for secure boot in your BIOS settings.

 

[zsatan]

zsatan,

Well, you definitely are in UEFI mode, but I'm not seeing any support or options for secure boot in your BIOS settings.

thx

 

[Brink]

You're welcome. Sorry about that.