Questions tagged [secure-boot]

For questions on “Secure Boot” and “Restricted Boot” the new bios feature that is in computers with the “Windows 8” logo.

101 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5 votes
0 answers
3k views

Kernel lockdown disallows loading of an self-compiled and self-signed in-tree kernel module

I'm having difficulties loading a kernel module that I myself compiled and signed for Secure Boot. The module in question is ec_sys, located within drivers/acpi directory of the kernel tree. I'm using ...
mdx's user avatar
  • 161
4 votes
0 answers
530 views

If TPM owner password set in linux, how to enter owner password in windows to enable bitlocker?

I have successfully taken ownership of, and used various features of, my tpm in linux, using tpm_takeownership and related applications. Now when I try to enter the owner password in windows to ...
bobjandal's user avatar
  • 141
3 votes
0 answers
400 views

Is it safe to keep the default MOK.priv on after a fresh install of Ubuntu 18.04.2 with secure boot enabled?

I'm new to secure boot strategy. I found there is a default paris, MOK.der and MOK.priv, inside shim folder after a fresh installation of Ubuntu 18.04.2. If I understand correctly, they're there to ...
Dadi Gao's user avatar
3 votes
0 answers
5k views

How can I reset the Secure Boot keys on my Surface Pro 4?

I have a Surface Pro 4 and I guess my secure boot keys got messed up somehow. On Surface Pro 3 this fix is as easy as going into the UEFI and resetting to the default keys, but there's no such option ...
Thomas Boxley's user avatar
3 votes
1 answer
2k views

Can Windows 10 on BitLocker dual-boot with Ubuntu on LUKS?

Good afternoon all, I would like to ask if having a dual boot system of Windows 10 and Ubuntu is possible with the features below activated. Secure boot UEFI TPM BitLocker Hyper-V with the security ...
Lodonnell's user avatar
3 votes
0 answers
147 views

Secure Golden Boot Key - am I vulnerable?

I'm an Arch Linux user. I'd like to protect myself from the live-usb hack by using SecureBoot: Create my own Platform Key and sign the kernel with my own key. Delete the Microsoft PKs Enable ...
marmistrz's user avatar
  • 525
2 votes
0 answers
276 views

How does PCIe card vendors sign option ROMs?

If secure boot is enabled UEFI system would permit to run only signed Option ROMs. I presume PCIe card vendors want their devices to work even if Secure Boot is enabled. Therefore how does PCIe card ...
kostr22's user avatar
  • 163
2 votes
0 answers
748 views

Windows 11 no sound in secure boot

I have Windows 11, but I have no sound in secure boot. WHen it's enabled, I went to Device Manager, and all the sound drivers said: "Windows cannot verify the digital signature for this device.&...
user1457337's user avatar
2 votes
0 answers
658 views

How more secure is using Shim/PreLoader than having Secure Boot disabled?

I have my doubts on how secure is using Shim/PreLoader to allow booting Linux with Secure Boot enabled. My doubt comes from the fact that it seems to me Shim's MokManager and PreLoader's HashTool can ...
Robert Kusznier's user avatar
2 votes
0 answers
88 views

Can I use my own driver on Windows without having to ask MS for permission while keeping Secure Boot on?

As per the subject : I want to write my own kernel mode driver I want to be able to use it with Secure Boot on I don't want to ask for permission to use it (no WHQL testing or attestation signing) ...
NovHak's user avatar
  • 133
2 votes
0 answers
655 views

Time Authenticated EFI Variable

I'm setting up custom secure boot keys on an Asus Z87I-Deluxe motherboard. On other computers I've setup with secure boot, I've been able to either write the PK, KEK, and DB keys into the EFI ...
Huckle's user avatar
  • 568
2 votes
0 answers
1k views

secureboot with parrotOS - not able to sign custom kernel

I've installed Parrot OS on my surface and built the custom kernel for the surface from jakeday repo. I'm currently trying to sign my custom kernel that I can turn on secureboot again. I've followed ...
lama1234's user avatar
2 votes
0 answers
2k views

Using rEFInd to boot Windows 10 with Secure Boot and Bitlocker encryption enabled

I have a corporate laptop (HP Zbook 15) with two m2.sata drives: nvme0: the one that shipped with the computer, featuring Bitlocker encrypted Windows 10 nvme1: a secondary drive running linux I use ...
Hendy's user avatar
  • 509
2 votes
1 answer
15k views

Cant boot to EFI shell Asus Motherboard

I have an Asus Maximus VIII Impact MotherBoard I just purchased an Intel RS3UC080 RAID card, and notice the firmware was very out of date. I figured I would update it before using the card. To do ...
Josh Young's user avatar
2 votes
0 answers
412 views

VirtualBox 5.1 installation issues Ubuntu 16.04

I am using new to Vagrant. And stuck with VirtualBox installation with Ubuntu 16.04. Executing vagrant up command, gives the following error The vboxdrv kernel module is not loaded. Either there is ...
Nauman Zafar's user avatar
2 votes
1 answer
165 views

Stop Windows 8.1 from removing Grub

I've got a relatively new HP Envy machine running Windows 8.1 that I want to run Ubuntu on. Installation works great and I'm all happy until I boot back into Windows, at which point grub is removed ...
dragonmantank's user avatar
2 votes
1 answer
5k views

Monitor only works if Legacy BIOS (CSM) disabled?

I have an Asus Q550-LF computer running Windows 8.1 Enterprise. It has a MiniDisplayPort output which is connected to a MiniDP to DVI adapter. I discovered that my monitor was not working the same day ...
Kaz Wolfe's user avatar
  • 701
2 votes
3 answers
5k views

turning on secure boot gives only a black screen

I have installed Windows 10 with secure boot off and now I want to install Windows 11. So I turned secure boot back on but, only a black screen shows after computer boots. What I see - I can see POST ...
Nuwan Thisara's user avatar
1 vote
0 answers
95 views

Why the TPM PCRs does not consider a UEFI settings change? If someone resets CMOS, it's undetected

In my laptop I've set up a bios pw when I power on the laptop, and once I enter it the laptop starts my linux distro and decrypts the disk without asking any other password. To do this I've set up TPM ...
Allexj's user avatar
  • 244
1 vote
0 answers
883 views

What does “/EndEntire” followed by “file path: /ACPI(…,…)/PCI(…)/UnknownMessaging(…)/HD(…,…,…,…,…)/File(…)/File(…)/EndEntire” during boot mean?

I use Secure Boot, followed by GRUB2, set up to boot Debian 12 and Windows 11 at the choice of a user. Right after the user chooses Windows and hits ⏎, we see a black screen with two white lines on it ...
user avatar
1 vote
2 answers
4k views

Can't enable secure boot in Windows 11

I am using Windows 11 and can't enable secure boot. I tried to enable it in BIOS, but it still doesn't work, and in system information, it's off.
Szymon's user avatar
  • 11
1 vote
0 answers
1k views

bcdedit.exe command giving strange error

Until yesterday i could use the command bcdedit /set testsigning on, so that i could start kernel mode drivers that are not signed, and then bcdedit /set testsigning off before shutting down, and i ...
User9387425's user avatar
1 vote
0 answers
280 views

Is it possible to allow only a certain secure USB boot media to boot an UEFI system?

I want to restrict all USB boot media from my system, except for a certain USB boot drive that I declare secure via a certain key. Is this possible using UEFI/Secure Boot/TPM? Maybe via TPM? TPM gets ...
JohnnyFromBF's user avatar
  • 4,938
1 vote
0 answers
116 views

USB Windows 11 for TPM/SB created on non-TPM/SB system

What option is needed to install Windows 11 to a live persistent USB on a non-TPM/Secure Boot system, if the USB will be used on a TPM/Secure Boot system. I assume it is the Standard with TPM & ...
unksoldr's user avatar
1 vote
1 answer
398 views

Every time I eneble secure boot for windows 11 my pc doesnt boot and I have to reset bios settings by removing battary. Why is that?

So basically I want to update to windows 11 and I have to eneble 2 security settings TPM and secure boot I succesfully enebled Tpm but each time I try to do the same with secure boot my screen, ...
John160's user avatar
  • 11
1 vote
0 answers
41 views

Unable to easily switch os after dual booting

I got a new laptop ((Asus vivobook 14)https://www.flipkart.com/asus-vivobook-14-ryzen-5-hexa-core-4500u-8-gb-512-gb-ssd-windows-10-home-m413ia-ek582t-thin-light-laptop/p/itm8d1c44556be49?pid=...
Shashank Sharma's user avatar
1 vote
0 answers
797 views

Signature verification fails for secure boot kernel

I'm trying to setup secure boot with using custom keys exclusively following the guide from rodsbooks. I created and enrolled keys for db, KEK and PK and signed grub and the kernel image accordingly (...
fiscblog's user avatar
  • 111
1 vote
0 answers
540 views

How to disable HDD lock in BIOS?

I have an Acer Spin 3 laptop with Secure Boot. I was messing around in BIOS and now the laptop asks for a HDD password upon boot. It is annoying, how do I disable it again? The BIOS is Insyde H20 rev ...
posfan12's user avatar
  • 662
1 vote
0 answers
792 views

Kali Linux Boot Image Authentication

I recently discovered Kali Linux and decided to make a live USB so that I could boot it on any available (64-bit) machine. In the process, I also discovered the common "Selected boot image did not ...
LRitzdorf's user avatar
1 vote
0 answers
216 views

HP Wifi not working in Ubuntu 19.04 in Secure Boot

Output of lspci: 00:00.0 Host bridge: Intel Corporation Xeon E3-1200 v6/7th Gen Core Processor Host Bridge/DRAM Registers (rev 08) 00:02.0 VGA compatible controller: Intel Corporation UHD Graphics 620 ...
Harshvardhan's user avatar
1 vote
0 answers
30 views

Rollback protection for network booting

I am interested in secure network booting. UEFI Secure Boot, combined with a signing key I control, ensures that no unauthorized code can run. However, it doesn’t provide rollback protection: an ...
Demi's user avatar
  • 818
1 vote
0 answers
193 views

How can i change my BIOS password?

I have tried everything, backdoor passwords, flashing the bios and bios reset tools made by my manufacturer (which is HP). All fail to work. I'm trying to install Kali Linux but I have secure boot on ...
Sully DeVries's user avatar
1 vote
0 answers
58 views

USB Devices arn't working while Computer has Secure Boot enabled

I have a problem that seems to stem from activating Secure Boot. I have several customers with Dell desktops running Windows 10 Enterprise, that require Secure Boot to be enabled. When they ...
user986103's user avatar
1 vote
1 answer
7k views

Lenovo Ideapad 320-15IAP Secure Boot option not available in BIOS setup

I recently bought a Lenovo IdeaPad 320-15IAP (running Windows 10, with an Intel Pentium N4200 quad-core processor). Upon trying to install Ubuntu alongside my Windows partition, I kept getting a GRUB ...
Jeff's user avatar
  • 183
1 vote
0 answers
1k views

Installing a Linux kernel in the UEFI BIOS of the Xiaomi Mi Air 13

My post is about the UEFI BIOS of the Xiaomi Mi Air 13. It is a very interesting laptop, light and tough. His BIOS seems an InsydeH20 One, and I can't clear Secure Boot keys. I'm in the process to ...
Rafael'in's user avatar
1 vote
0 answers
140 views

Windows 10 Education Failing to Boot

I have been in a bit of a loop for a while now, so hear me out please. I have an HP Probook 4540s that has been with me for about 5 years now. I have an original Windows 10 Education installed on it. ...
user1910524's user avatar
1 vote
3 answers
9k views

After disabling Secure Boot in Lenovo Yoga 14 I cannot boot into Windows 10

To test a bootable USB flash drive, I disabled Secure Boot on my Lenovo Yoga 14. When I want to restore my BIOS setting back, I found every time I did it and restarted the PC, the setting with ...
microbit's user avatar
1 vote
1 answer
2k views

Installing Ubuntu with secure boot on and no way to disable it?

I don't have any OS installed. I wanted to install Win10 but it failed with error code 0x80070570 during install. Now, I want to go back to Ubuntu but I am not able to (Only Unetbootin screen shows ...
Radu Gancea's user avatar
1 vote
0 answers
813 views

Virtualization with UEFI'secure boot feature

I'm interested in the notion of emulating digital signature checks in virtual machines—the host can be booted without hardware-based digital signature checks, which can be moved to the VM, and the ...
Melab's user avatar
  • 1,101
1 vote
0 answers
43 views

Windows 8 can't override Ubuntu

I had Windows 8 installed on my Asus X5551M, then I installed Ubuntu 14.04 over it. Now I want to go back to Windows 8 to sell the computer. I created a Windows 8 USB using the exe from the Windows ...
Nickflyer's user avatar
1 vote
0 answers
275 views

UEFI multi-factor authentication on admin password?

Many UEFI vendors offer boot and Admin passwords for a local machine. For a normal cold boot or reset, I would like the UEFI system to simply pick the properly signed bootloader and proceed. Having ...
ErnieE's user avatar
  • 101
1 vote
1 answer
3k views

Questions about using Clonezilla to create and restore image on Windows 8.1 secure boot system

I'd like to use clonezilla to create a disk image of a Windows 8.1 system with secure boot enabled and some third-party software installed, so that I can at a later time restore the system from that ...
Chris's user avatar
  • 11
1 vote
1 answer
1k views

Secure Boot is not compatible on my PC; will I be able to install Windows 8 on it?

Yesterday, I ran Windows 8 upgrade assistant on my PC, Only problem it gave is that Secure Boot isn't compatible with your PC Your PC's firmware doesn't support Secure Boot so you won't be able to ...
ganesh's user avatar
  • 131
0 votes
1 answer
87 views

Delete PK key from terminal when secure boot is disabled

When secure boot is disabled, is it possible to delete the PK key from terminal? I know that to change the keys, you need to enter setup mode. And to enter setup mode, you need to delete the PK key. ...
astroboy's user avatar
  • 101
0 votes
0 answers
85 views

How to get minimal vendor information about the TPM chip installed in my laptop

How do I get some minimal information about the TPM chip in my Linux laptop? Information such as the manufacturer, manufacturer id, manufacturer version. So far I have tried the tpm2_getcap command to ...
a001's user avatar
  • 1
0 votes
0 answers
12 views

How does the SPK ID provide security in Xilinx secure boot

My understanding of the Xilinx ultra scale secure boot process is that the CSU validates the SPK with the PPK. If the SPK is authenticated, the CSU checks to see if the SPK ID that’s associated with ...
Spencer Work's user avatar
0 votes
0 answers
199 views

Does the Microsoft update for BlackLotus mitigation SKUSiPolicy.p7b require Memory Integrity to be on and working in the Security Center?

In other words is the "Code Integrity feature" on this Microsoft kb5025885 page: The Code Integrity Boot Policy (SKUSiPolicy.p7b) uses the Code Integrity feature of Windows to prevent ...
Eric's user avatar
  • 87
0 votes
0 answers
1k views

Gigabyte b650 DS3H secure boot won't boot from USB

Gigabyte b650 DS3H secure boot won't boot from USB. I'm trying to run clean install for win 11 from USB drive system running on gigabyte b650 DS3H. I've made sure that TMP 2.0 is enabled and CSM is ...
pinegulf's user avatar
  • 101
0 votes
0 answers
391 views

Cannot enable Secure boot on Gigabyte H61M-DS2

Trying to help a friend do a fresh install of Windows, but the bootable USB isn't even listed in the BIOS. I realized that Secure Boot is currently disabled, and assume this is the issue. However ...
Ryan's user avatar
  • 1
0 votes
0 answers
547 views

Cannot change my secure boot configuration in BIOS

Device: ASUS Vivobook pro 15 OS: Windows 11 Pro 22H2 As in the image above, the configuration for secure boot has been disabled in my BIOS configuration. How can I change my secure boot configuration?...
임영찬's user avatar