Disable Secure Boot Guide: How to Safely Change Firmware Settings

What Is Secure Boot and How Does It Work?

Secure Boot is a fundamental security protocol defined in the Unified Extensible Firmware Interface (UEFI) specification. As part of broader UEFI Secure Boot hardening efforts across modern computer hardware, it guarantees that a computer starts exclusively using firmware and software recognized as trustworthy by the Original Equipment Manufacturer (OEM).

Understanding how secure boot works requires examining the boot initialization sequence. When you power on a machine, the UEFI firmware checks the signature of each piece of boot software against a trusted database stored in non-volatile memory. This includes Option ROMs on expansion cards, UEFI applications, and the primary operating system bootloader.

During startup, the hardware performs rigorous bootloader signature validation using a Public Key Infrastructure (PKI) hierarchy. If the digital signature matches a trusted public key in the signature database (db) and is not listed in the revoked signatures database (dbx), control passes to the bootloader. If validation fails, the firmware halts execution before untrusted code can run at the kernel level.

Risks and Considerations Before Disabling Secure Boot

Disabling boot validation reduces platform security by allowing execution of unsigned binaries. Before altering your system configuration, evaluate the operational impact on installed security controls and software applications.

• Loss of hardware-level defense against malicious bootkits that load before operating system security software starts.
• Automatic locking of encrypted drives using Windows BitLocker, which requires inputting a 48-digit recovery key upon restart.
• Disabling of OS security features like Virtualization-based Security (VBS) and Credential Guard in Windows environments.
• Incompatibility with online multiplayer video games whose anti-cheat systems mandate hardware boot verification.

How to Check If Secure Boot Is Enabled in Windows

You can quickly verify your system’s current boot validation status without restarting your machine by using native Windows system tools.

• Press Windows Key + R to open the Run dialog box.
• Type msinfo32 into the input field and press Enter to launch System Information.
• Select System Summary in the left pane and look for BIOS Mode to confirm it displays UEFI.
• Locate Secure Boot State in the right pane to verify whether it reads On, Off, or Unsupported.

System Requirements for Secure Boot Configuration

Hardware and software components must meet specific platform criteria to execute signature verification during startup.

• Motherboard firmware compliant with UEFI Specification 2.3.1 Errata C or newer versions.
• System boot drive partitioned with the GUID Partition Table (GPT) scheme instead of legacy MBR formatting.
• Graphics processing units and expansion devices containing UEFI-compliant Option ROMs.
• A discrete or firmware-based Trusted Platform Module (TPM) version 2.0 enabled in system firmware.

Disable Secure Boot Guide: Step-by-Step Instructions

Entering your motherboard firmware setup interface allows you to change boot security parameters. The safest path from Windows involves accessing hardware settings through the Advanced Startup menu.

• Open the Windows Start Menu and select Settings, then navigate to System and click Recovery.
• Locate the Advanced startup heading and click the Restart now button.
• Select Troubleshoot on the blue menu screen, then click Advanced options.
• Choose UEFI Firmware Settings and click Restart to boot directly into the system firmware.

UEFI/BIOS Menu Steps by Manufacturer (ASUS, Dell, HP, Lenovo, MSI)

Firmware interfaces differ significantly across hardware vendors, though the core toggle resides within security or boot management categories.

• ASUS: Press F2 or Delete at startup to enter setup. Press F7 for Advanced Mode, select the Boot tab, open Secure Boot, and set OS Type to Other OS or set Secure Boot Control to Disabled.
• Dell: Press F2 when the Dell logo appears. Expand Boot Configuration or Security in the left sidebar, locate Secure Boot, toggle the setting to Disabled, and click Apply Changes.
• HP: Press F10 repeatedly during boot. Select the Security or Advanced tab, open Secure Boot Configuration, set Secure Boot to Disable, and press F10 to save changes.
• Lenovo: Press F1 or F2 when powering on. Navigate to the Security tab, select Secure Boot, change the status from Enabled to Disabled, and press F10 to exit.
• MSI: Press Delete during POST setup. Go to Settings > Advanced > Windows OS Configuration, select Secure Boot, set Secure Boot Support to Disabled, and save settings.

How to Re-Enable Secure Boot Safely

Re-establishing boot signature checks requires restoring default cryptographically signed keys inside the motherboard settings. According to official Microsoft documentation, restoring default factory keys within firmware is often necessary if cryptographic signatures were modified during custom OS installations.

• Remove non-compliant hardware cards, unsigned device drivers, or custom secondary operating systems.
• Enter UEFI firmware settings using your hardware manufacturer key combination or Windows recovery settings.
• Navigate to the Secure Boot options page inside the firmware configuration utility.
• Select Restore Factory Keys or Load Default Keys, set Secure Boot to Enabled, then save and exit.

Troubleshooting Common Secure Boot Issues

Configuration errors or outdated hardware formats can block changes to boot settings or cause startup errors.

• If the Secure Boot option appears greyed out or unselectable, set a hardware Administrator/Supervisor Password in the firmware security tab to unlock protected options.
• Disable any active Compatibility Support Module (CSM), as legacy Basic Input/Output System (BIOS) emulation modes cannot run alongside modern boot validation.
• Clear custom cryptographic signature stores or reset key management parameters if signature mismatch errors prevent startup after hardware changes.

Fixing “Secure Boot Is Enabled But Not Active”

The message “Secure Boot Is Enabled But Not Active” indicates that while firmware verification is turned on in configuration settings, the motherboard is running in Setup Mode without active platform keys. Without a loaded Platform Key (PK), the system cannot enforce signature requirements on loaded binaries.

To resolve this state, open your UEFI setup screen and navigate to the key management submenu under Secure Boot. Select the option to Restore Factory Keys or Install Default PK. This reloads OEM default certificates, transitions the system from Setup Mode to User Mode, and fully activates hardware signature validation.

Converting MBR Disks to GPT Format for UEFI Mode

Modern UEFI boot validation requires system storage drives to use the GPT partition standard rather than older MBR formats. Windows includes a built-in conversion utility to migrate partition tables without data loss.

• Open an elevated command prompt by typing cmd in the Windows search bar, right-clicking Command Prompt, and choosing Run as administrator.
• Validate disk compatibility by executing the command mbr2gpt /validate /allowFullOS.
• Perform the non-destructive partition conversion by running mbr2gpt /convert /allowFullOS.
• Restart your machine, enter UEFI setup, change boot mode settings from CSM/Legacy to UEFI Only, and save settings.