Secure Boot Protocol Secure Boot, based on special certified keys available only for Windows 8 and higher, will not allow you to install the system on your computer from any installation media, except for the carrier with “eight” or “ten”. Therefore, to start installing another operating system on your desktop computer or laptop, you need to disable Secure Boot V UEFI-BIOS.

Parameter "Secure Boot", responsible for disabling the secure boot protocol, is in most cases located in the sections "Security", "System Configuration" or "Boot". But I want to say that to install, for example, Windows 7 on new laptop With UEFI-BIOS it’s not enough to just turn it off "Secure Boot" V UEFI-BIOS, you also need to enable compatibility mode with other operating systems. The parameter responsible for this is called differently by all manufacturers: "Launch CSM", "CMS Boot", "UEFI and Legacy OS", "CMSOS". And it is overwhelmingly located in the section "Advanced", and in it, in subsections "Boot Mode" or "OS Mode Selection".

NOTEBOOKS

Disabling Secure Boot and UEFI on a Toshiba laptop

F2 and enter UEFI-BIOS. Go to the section "Security" and finding the parameter "Secure Boot" "Disabled".

In such a simple way we were able to disable Secure Boot V UEFI-BIOS. But that is not all. Now we need to enable compatibility mode for other operating systems. Let's go to the section "Advanced" find a subsection "System Configuration" and we go into it.

Here we select the parameter "Boot Mode" or "OS Mode Selection", and switch it from position "UEFI OS"(Maybe "UEFI Boot") to position "CSM Boot"(Maybe "UEFI and Legacy OS" or "CMSOS").

F10 "Yes"

Disabling Secure Boot and UEFI on an HP laptop

Sometimes things are not so obvious. For example, on some HP Pavillion laptop models, to disable Secure Boot Several additional operations need to be performed.

Press the key when booting the laptop F10(Maybe ESC, then F10) and enter UEFI-BIOS. Go to the section "System Configuration", we find the subsection "Boot Options" and we go into it.

Finding the parameter "Secure Boot" "Disabled". And the compatibility mode option for other operating systems "Legacy support", on the contrary, switch to position "Enabled".

We respond to the warning "Yes".
For the changes to take effect, click F10 and confirm saving the changes by selecting "Yes". Reboot. After the reboot, a warning window appears with the warning “A change to the operating system secure boot mode is pending...”. In English, we are asked to enter the code 8721 on the laptop keyboard (in your case, the code will, of course, be different) and press Enter. After this change in settings UEFI-BIOS will be saved and the laptop will reboot again.

When turning on the HP laptop, press the key ESC and we get to the start menu. In it we select "F9 Boot Device Options" and, having gone to the boot menu, select the installation flash drive (already connected) or the installation DVD with the operating system.

Disabling Secure Boot and UEFI on an Asus laptop
Aptio Setup Utility

Press the key when booting the laptop DELETE and enter UEFI-BIOS. Go to the section "Security" and finding the parameter "Secure Boot", switch it to position "Disabled".

Then go to the section "Boot" and finding the parameter "Fast Boot", switch it to position "Disabled".

For the changes to take effect, click F10 and confirm saving the changes by selecting . Go to the section "Boot" and finding the parameter "Launch CSM", switch it to position "Enabled".

Press again F10 and confirm saving the changes by selecting "Yes". Reboot. When you turn on the Asus laptop, press the key ESC and we get to the boot menu. In it, select the installation flash drive (already connected) or the installation DVD with the operating system.

Disabling Secure Boot and UEFI on a Samsung laptop
Aptio Setup Utility

Press the key when booting the laptop F2 and enter UEFI-BIOS. Go to the section "Boot" and find the parameter "Secure Boot".

Switch it to position "Disabled".

Click on the warning that the computer may boot with an error. Enter.

In the same section below there will be a parameter "OS Mode Selection".

Switch it to position "CMSOS" or "UEFI and Legacy OS".

A warning will appear again about the possibility of the next boot of the laptop with an error. Click Enter. For the changes to take effect, click F10 and confirm saving the changes by selecting "Yes". Reboot. Now we can load any operating system onto our laptop.

Disabling Secure Boot and UEFI on an Acer Aspire laptop
InsydeH20 Setup Utility

Press the key when booting the laptop F2 and enter UEFI-BIOS. Go to the section "Main" and finding the parameter "F12 Boot Menu", switch it to position "Enabled". With this action we allowed the laptop boot menu to appear when pressing a key F12.

Now let's go to the section "Security" and finding the parameter "Set Supervisor Password", press the key Enter. In the top field, set a password (we will reset it later) and click Enter. In the lower field, enter the same password and click again Enter.

Enter.

Go to the section "Boot" and finding the parameter "Boot Mode", switch it from position "UEFI" to position "Legacy".

For the changes to take effect, click F10 and confirm saving the changes by selecting "Yes". Reboot. Since it makes sense to remove the password we previously set (the ability to disable/enable "Secure Boot" will remain), again by F2 we enter UEFI-BIOS, go to the section "Security" and finding the parameter "Set Supervisor Password", press the key Enter. In the top field, enter the password we previously set and click Enter. In the second and third fields we do not enter anything, just click Enter.

Click on the message “Changes have been saved” again Enter. That's all! The password has been reset, and the ability to disable/enable "Secure Boot" preserved. For the changes to take effect, click F10 and confirm saving the changes by selecting "Yes". Reboot. Now we can load any operating system onto our laptop.

DESKTOP COMPUTERS

Disable Secure Boot and UEFI on the motherboard Asus board

DELETE(Maybe F2) and enter UEFI-BIOS. Click F7 to go to "Advanced Mode".

Go to the section "Boot", we find the subsection "Secure Boot" and we go into it.

Switching the parameter "Secure Boot" to position "Other OS".

Returning to the root of the section "Boot" and go to the subsection "CSM (Compatibility Support Module)".

Switching the parameter "Launch CSM" to position "Enabled".

In the additional options that open, select "Boot Device Control" and switch to position "Legacy OpROM only" or "UEFI and Legacy OpROM".

Let's go to the parameter "Boot from Storage Devices" and switch it to position "Legacy OpROM first" or "Both, Legacy OpROM first".

With these actions we disabled Secure Boot and enabled advanced boot mode. For the changes to take effect, click F10 and confirm saving the changes by selecting "Yes"

Disable Secure Boot and UEFI on the Asrock motherboard

Press the key when booting the computer DELETE(Maybe F2) and enter UEFI-BIOS. Go to the section "Security" and finding the parameter "Secure Boot", switch it to position "Disabled".

For the changes to take effect, click F10 and confirm saving the changes by selecting "Yes". Reboot. Now we can load any operating system onto our computer.

Disabling Secure Boot and UEFI on a Gigabyte motherboard

Press the button when loading the computer DELETE and enter UEFI-BIOS. Go to the section "BIOS Features" and finding the parameter "Windows 8 Features", switch it to position "Other OS". Then the parameter "Boot Mode Selection" switch to position "Legacy only" or "UEFI and Legacy". And finally, the parameter "Other PCI Device ROM Priority" switch to position "Legacy OpROM".

For the changes to take effect, click F10 and confirm saving the changes by selecting "Yes". Reboot. Now we can load any operating system onto our computer.

Disable Secure Boot and UEFI on MSI motherboard

Press the key when booting the computer DELETE and enter UEFI-BIOS. Go to the section "SETTINGS", go to subsection "Boot", and finding the parameter "Boot Mode Select", switch it to position "Legacy+UEFI".

For the changes to take effect, click F10 and confirm saving the changes by selecting "Yes". Reboot. Now we can load any operating system onto our computer.

To install different operating systems and software, you must disable UEFI Secure Boot in the BIOS, since by default this function prohibits the installation of any operating systems other than Windows.

How to disable Secure Boot in UEFI Asus

To disable Secure Boot in UEFI Bios, follow the instructions:

1. Go to BIOS, to do this, restart the computer and press F2 as soon as the picture appears on the screen, or:

• Click on the notifications icon and click on the “All settings” link.
• Open the “Update and Security” section, click on the “Recovery” button.
• In the window that opens, click “Restart now”.
• The computer will restart and a blue window with options will appear.
• Click on the “Diagnostics” link => “ Extra options”.
• Now you need to select “UEFI Firmware Settings”.
• After the next reboot, you will be taken to UEFI or Bios (old name).

2. Click on the "Exit/Advanced Mode" button:

3. Click on the bottommost button "Advanced Mode":

Scroll down the screen and tap "Secure boot" menu:

5. In OS Type(Operating System Type) and select Other OS(Other OS):

6. To save the settings, press F10, after which the computer will reboot. Now you can install any operating system and any programs!

If you are unable to enter BIOS UEFI Asus

Right-click on the Start menu.

Go to "Power Management".

In the window that opens, uncheck the “Enable” line quick start” and click “Save Changes”.

If you have any questions or something doesn’t work out, be sure to leave a comment and I will quickly help you.

If you bought a PC or laptop with a pre-installed Windows 8 operating system, and then wanted to remove it and change it, for example, to “Seven” or even any version of Linux OS, then you will have problems with this, due to the “Secure boot” system "Boot".

Microsoft developers during development latest version Windows 8 has completely abandoned support for sixteen bit BIOS versions. Instead, the system became 100% compatible with the so-called UEFI BIOS, which has a secure boot system “Secure Boot”.

The Secure Boot system is designed to prevent startup malware before loading the operating system and antivirus software, respectively.

It would seem like a very wonderful system, but due to Secure Boot it is simply impossible to install another operating system or software, not having digital signature. Let's give a simple example. You bought new computer with pre-installed Windows 8 and decided to install on it additionally or instead of G8 OS Windows 7 or some Unix-like system. You can forget about it, the secure boot feature will not allow you to do this. If you do not agree with this state of affairs, then you will need to disable Secure Boot in the UEFI BIOS, that is, go into the I/O system and disable this annoying system.

Manufacturers of modern motherboards mostly deactivate this function even before they complete the devices or put them on sale. If Unix developers of similar systems have already decided this problem in their OS by adding secure support to them UEFI boot BIOS, then their colleagues from Microsoft do not intend to make changes to Windows Vista and Windows 7 at all. And given the fact that many millions of people use these systems, knowing how to disable Secure Boot is simply necessary in order to fully use the PC.

Disabling Secure Boot is very simple; to do this, you need to restart the PC and at the very beginning of its boot, press the “Del” key on the keyboard several times (other key options are possible, for example, F8 or F2) to launch the BIOS (input-output system).

We will not describe the process of disabling Secure Boot for all BIOSes (meaning software developers). Since this is simply not realistic, and we do not yet have such an opportunity to have desktop and mobile PCs of all manufacturers at hand. Let's use the Pheonix SecureCore Tiano as an example; this BIOS is used on almost all laptops manufactured by Samsung, as well as for UEFI BIOS Utility Asus.

• Disabling Secure Boot in Samsung laptops. Go to BIOS to the Boot section. Find the Secure Boot option and set it to “Disabled”, then set the OS Mode Selection to “UEFI and CSM OS”. Ready. Now you can remove Windows 8 from Samsung laptop and install another OS.
• Disable Secure Boot in Asus laptops. Open the UEFI “Boot” section, then “Secure Boot”, then go to the “Key Management” option and change its value to “Crear Secure Boot Keys”. Done, the intrusive feature is disabled.

CSM is a compatibility support module for the operating system. If your motherboard is equipped with a BIOS (UEFI) different from those described above, then in addition to the steps described, try activating the Legacy BIOS function.

CSM stands for Compatibility Support Module for Operating System. In other BIOS (UEFI), you may need to enable the compatibility option: Legacy BIOS. If you have problems with the installation, you can try switching the SATA controller to AHCI mode. How this is done is written in the article “Enable ACHI support for SATA drives”

A little about UEFI and Secure Boot

• Information Security ,
• UEFI

UEFI

The main differences between UEFI and BIOS:

• GPT (GUID Partition Table) support

• Service support

• Modular architecture

• Built-in download manager

How does booting into UEFI work?

Secure Boot

“I heard that Microsoft is implementing Secure Boot in Windows 8. This technology prevents unauthorized code from executing, such as bootloaders, to protect the user from malware. And there's a campaign from the Free Software Foundation against Secure Boot, and a lot of people were against it. If I buy a computer with Windows 8, can I install Linux or another OS? Or does this technology only allow you to run Windows?”

What does Secure Boot do? It protects against unsigned code execution not only at boot stage, but also at OS runtime, for example, both Windows and Linux check the signatures of drivers/kernel modules, thus malicious code it will not be possible to execute in kernel mode. But this is only true if there is no physical access to the computer, because, in most cases, with physical access, the keys can be replaced with your own.

Secure Boot has 2 modes: Setup and User. The first mode is for configuration, from it you can replace PK (Platform Key, default from OEM), KEK (Key Exchange Keys), db (resolved key database) and dbx (revoked key database). There may not be a KEK, and everything can be signed by PK, but no one does that, it seems. PK is the main key with which KEK is signed, in turn, db and dbx are signed with keys from KEK (there may be several of them). In order to be able to run some signed .efi file from User mode, it must be signed with a key that is in db, and not in dbx.

For Linux there are 2 pre-loaders that support Secure Boot: Shim and PRELoader. They are similar, but there are small nuances.
Shim has 3 types of keys: Secure Boot keys (those in UEFI), Shim keys (which you can generate yourself and specify during compilation), and MOK (Machine Owner Key, stored in NVRAM). Shim does not use a UEFI boot mechanism, so a bootloader that does not support Shim and does not know anything about MOK will not be able to execute the code (thus gummiboot bootloader will not work). PRELoader, on the other hand, builds its authentication mechanisms into UEFI, and there are no problems.
Shim depends on MOK, i.e. binaries must be modified (signed) before they can be executed. PRELoader “remembers” the correct binaries, you tell it whether you trust them or not.
Both pre-bootloaders are available in compiled form with a valid signature from Microsoft, so it is not necessary to change the UEFI keys.

Secure Boot is designed to protect against bootkits and attacks like Evil Maid, and, in my opinion, it does this effectively.
Thank you for your attention!

Happy owners of modern laptops in the operating room Windows system 10 may unexpectedly encounter errors that occur in various applications due to the Secure Boot feature enabled on the device by default. Problems may also arise when trying to boot from installation flash drive or disk. Let's figure out together what this function is and how to disable Secure Boot in Windows 10 if you need to reinstall the pre-installed OS, or if you have problems launching games and programs on the device.

So, at the beginning I will give a little theory so that you understand what we are dealing with.

Secure Boot

The Secure Boot protocol, or “safe boot” in Russian, is part of the UEFI (Unified Extensible Firmware Interface) specification. The meaning of its action is quite simple. The system storage contains signatures of executed UEFI images. When loading the operating system, the signatures are compared with the reference ones and, if they do not match, the loading does not occur. Roughly speaking, UEFI is an intermediate interface between the operating system and special low-level firmware, designed to correctly initialize the hardware when the PC is turned on and then transfer control to the Windows boot loader.

Despite the fact that initially the protocol is not mandatory for implementation by manufacturers, back in 2011, due to the release of Windows 8, Microsoft company included Secure Boot using a Microsoft key in the requirements for certification of computers running its operating systems. Therefore, you shouldn’t be surprised why most modern laptops from Acer, Asus, HP, Lenovo, MSI, etc. I can't just reinstall the system.

Disabling Secure Boot in BIOS UEFI

When you turn on a modern laptop, the operating system usually starts immediately. The black screen, like on old computers, with the invitation to press a button to enter the BIOS does not appear. What to do and how to disable Secure Boot in Windows 10?! That's how!

Open System Settings and go to the section Update and Security >> Recovery. There will be a point here Special download options.

Here you will need to click on the “Restart now” button. After the computer restarts, a blue window will appear with a choice of action options:

We need to select an item Diagnostics >> Advanced options, then click on the tile and agree to reboot. Only after these steps in Windows 10 will you be able to get into the laptop’s BIOS.

Now you will need to open the “Boot” section and find the item there Secure Boot and give it a value Disable.

Note: Despite the fact that the BIOS menu may vary slightly for different laptops, do not be alarmed! The principle of operation is the same everywhere!