I just made a potentially costly mistake: nuked and repaved a brand new Lenovo Yoga 500 with Linux... without booting into Windows to disable SecureBoot explicitly. User didn't want to accept the EULA; and we successfully booted into USB key (Ubuntu MATE 15.10, Ubuntu w/Unity 15.04) so we thought we would just go ahead.

I imagine I would need to go through a system that has SecureBoot signature - that is, find such a distro, install it, disable SB there, then re-install our preferred system.

Is this the correct way? Which distros would work? We tried installing and booting into Ubuntu Unity 15.04 (which is supposed to have the appropriate signature) but after install and reboot, I get a screen with just boot options, of which the HDD. If I select it, it just re-prompts me at the same screen.

boot options enter image description here

Given that Windows has been obliterated at this point, what options do I have?

  • The screenshot is very blurry could you make a better one plz! – Stackcraft_noob Jan 17 '16 at 18:09
  • 1
    Truly disabling Secureboot is disabled in the BIOS not in Windows – cybernard Jan 17 '16 at 20:36
  • As long as the laptop has a 7,8,or 8.1, or 10 windows product key you can go to microsoft.com and download the media creator tool. Make a Windows 10 install disc and reload windows 10 for free, if the need arises. I read Windows 10 has started accepting the old keys. – cybernard Jan 17 '16 at 20:39
  • @cybernard good points both. I have found on the two previous instances of doing this that I had to enable EFI/bios menus through Windows. In this case, that step was not needed. I should have been more attentive. – taifwa Jan 18 '16 at 13:08

My suspicion is that your problem is not related to Secure Boot. Ubuntu, which you say you installed, supports Secure Boot. So do Fedora, OpenSUSE, ALT, and several others. That said, there are known problems, mostly with flaky EFIs; but these problems would normally prevent the installation medium from booting, so you wouldn't have gotten as far as you have if Secure Boot were the problem.

Your boot options screen doesn't show an entry for Ubuntu, which suggests another problem: Something went wrong with your boot loader installation. You should be able to launch the Ubuntu installer, but select the "try before installing" option, in order to investigate. The Linux efibootmgr command lets you set boot loader options. There are several tutorials and references on this command on the Internet, but I know of none that's really ideal for your circumstances. Still, you might want to read:

Also, keep in mind that your boot loader is probably already installed to the EFI System Partition (ESP), which is a FAT partition that's probably the first or second one on your disk. The Ubuntu boot loader should be EFI/ubuntu/grubx64.efi on that partition; however, to work with Secure Boot, GRUB must be launched by a program called Shim (shimx64.efi, normally). Thus, to create an entry for GRUB with efibootmgr, you'd refer to Shim, as in:

sudo efibootmgr -c -d /dev/sda -p 1 -l \\EFI\\ubuntu\\shimx64.efi -L "ubuntu"

This should create an entry, although you may need to adjust some details. Several things can go wrong with this, though, and one of them may explain your problem:

  • If the installer couldn't write the files to the ESP, the entry created by efibootmgr will be useless. Such a problem could happen because of improper partitioning (particularly if you manually partitioned and didn't know you had to create an ESP), because of a random disk error, etc. If this is the source of your problem, you'll need to use something like Boot Repair to re-install GRUB.
  • Some EFIs have bugs that cause them to "forget" or ignore the entries created by efibootmgr. If this happens, you may be able to create an entry, but there will be no trace of it when you reboot. This problem is best dealt with by replacing the faulty computer, but awkward workarounds involving renaming the boot loader will work if this isn't possible. Lenovos don't normally suffer from this problem, fortunately.
  • Removing a disk and powering on the computer sometimes causes NVRAM entries for no-longer-valid entries to disappear. This is probably intended as a helpful feature, but it's a pain if you regularly unplug your disks for any reason. This is unlikely to be a factor for your laptop, but I thought I'd mention it anyhow.

To more directly answer your question, Secure Boot is disabled in the firmware, not in Windows. (In fact, if you could disable it from Windows, that would defeat the point of it, since malware would just do it that way.) Details vary greatly from one computer to another, so it's hard to provide step-by-step instructions. Nonetheless, I provide such instructions for four systems on this page. With any luck, your system will be similar to one of them, should you actually need to do this.

| improve this answer | |
  • EFI it was. Many thanks. Given that this was a fresh install, I've opted for now to simply reinstall using default options, as time is of the essence in this particular instance. As you surmised I did do custom partitions and did not know I needed a special EFI partition; thanks for the links, I will read assiduously. – taifwa Jan 18 '16 at 13:02
  • As for secureboot.... I might be confusing this with the EFI process. Previously I've had to go through Windows to enable the EFI menu, to enable legacy mode - in this instance it was not necessary, and now I wonder whether going through Windows was ever necessary at all. – taifwa Jan 18 '16 at 13:10
  • Windows 8 and later provide tools to reboot into the firmware setup utility. This task has traditionally been done by hitting a function key as the computer powers on, and this method also usually continues to work -- but some computers have "fast boot" features (not to be confused with the Windows Fast Startup feature, which is entirely different) that make it hard to use a function key to enter the firmware. In any event, once in the firmware you can enable or disable Secure Boot (if it's supported); but no matter how you get there, that's an EFI feature, not a Windows feature. – Rod Smith Jan 18 '16 at 15:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.