Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suggest I have a PC with either a BIOS with the commonly available options or a UEFI. Is there any way to change the settings so NO Windows NT based System will boot anymore (not even Windows PE including the windows install DVDs). This should be achieved without affecting GNU/Linux live cds or installed GNU/Linux systems.

Thanks for your answers.

PS: This is kind of an idealist question and I hope this is not off topic.

PPS: I don't want to do this, it is just a proof of concept question.

share|improve this question

closed as off topic by Canadian Luke, Dennis, Tog, CharlieRB, oKtosiTe Mar 26 '13 at 18:39

Questions on Super User are expected to relate to computer software or computer hardware within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

No, this is a very bad idea. – Frank Thomas Mar 26 '13 at 14:48
@FrankThomas Suggest I want to give someone a computer and want him to be able to do anything he likes to but not to install windows (achieving this by a BIOS password). – FSMaxB Mar 26 '13 at 14:49
Just as I think it's bad MS trying to make it difficult for Linux to run I think this is a bad idea. Users should be allowed to install whatever software they want on their PC! – Brad Patton Mar 26 '13 at 14:49
you can password protect the bios, disable boot from external media and put a padlock on the case, but in the end, remember, "Physical access is root access. period." – Frank Thomas Mar 26 '13 at 14:51
Anything you can do to the computer, anyone else can undo. This certainly would be possible, for the hardware manufacturer, but obviously none of them would ever dream of doing this. Voting to close since You should only ask practical, answerable questions based on actual problems that you face.. – Dennis Mar 26 '13 at 15:34
up vote 3 down vote accepted

To elaborate on option #1 by FSMaxB, I've written a page with (mostly) step-by-step instructions for replacing your Secure Boot keys here. Note, however, that some of the details of what to select in the firmware's own user interface will be system-specific. There are also other ways to accomplish this goal. Adding new keys (as described shortly) will require steps not documented on that page.

This approach works to limit what the computer can boot, but it goes a little too far, in terms of FSMaxB's requirements. Specifically, it not only prevents Windows from booting, but it also prevents most Linux live CDs from booting. I can think of a number of ways to minimize this problem, but some of them are awkward and most of them work only on distributions that are Secure Boot-enabled:

  • Add distributions' public keys to the Secure Boot keys in the computer and adjust their boot processes to bypass shim and to boot GRUB or some other boot loader directly. This requires altering files on the live CDs, though, which is a tedious task for technically unsavvy end users.
  • Place a copy of rEFInd on the hard disk. This should enable redirecting the boot process to GRUB on a live CD, bypassing its copy of shim. In theory this should work for anything that uses shim, provided that the distribution's key is in the Secure Boot key list you've created.
  • Place a copy of rEFInd on the hard disk, launched via the Linux Foundation's PreBootloader. This will enable users to add hashes for any boot loader to the firmware, enabling them to launch any version of Linux, even if its boot loader and kernels are unsigned. This would probably also enable them to boot Windows, too, but at least they'd have to explicitly approve of this action.
  • Place a copy of rEFInd on the hard disk, launched via shim. This has no advantage over the basic setup except that it makes it easier for users to add keys (via shim's MOK list). It's conceivable that the presence of shim would help with some boot loaders, though.
  • Include in the set of keys you add to the Secure Boot list the public key that's paired with the one that Microsoft uses to sign third-party binaries. Since Microsoft signs its own products with a different key, this will enable the firmware to launch third-party tools, such as Ubuntu 12.10 or Fedora 18, but not to launch Microsoft's own version of Windows. Third-party Windows-based products, though, might be signed with the Microsoft third-party key and so would launch. Note that some plug-in cards have firmware that's signed with this key, too, so this action might be necessary to use such cards' firmware.

As to the suggestion that this is a bad idea, I disagree, provided it's what the machine's owner actually wants. In the days of DOS, it was common for computers to become infected by accidentally booting a floppy disk that contained a boot-sector virus. In principle, the same thing could happen today via a USB flash drive or CD-R. Shutting off that avenue of attack, even if it's not a common one today, is worthwhile. That said, I wouldn't recommend gifting or selling such a computer without making it clear to the recipient what's been done to it and providing instructions on how to undo the changes, if desired.

share|improve this answer

I have asked this question so that people can have fun with the discussion that follows.

As I post this text as an answer, here are three possible ways to achieve this:

  1. Having UEFI Secure Boot deleting the Microsoft key and adding keys used by GNU/Linux bootloaders (As of Frank Thomas' comment)
  2. Using another processor architecture than x86 or windows 8 compatible ARM that is supported by the linux kernel (As of winfreak's answer).
  3. Using a custom coreboot ( that prevents Windows from booting.
share|improve this answer

Not the answer you're looking for? Browse other questions tagged .