Solved Can't enable secure boot. (Drive already GPT?)

Mr_Padingy · Oct 5, 2021

BunnyJ said:
I would disconnect those when installing 11. Can't hurt.. I didn't have any issues but.. play it safe.

Yea I was thinking of doing that.

Going to give it a go Thursday... Just ordered a new M.2 (1TB, upgrade from my current 256GB one because I thought why not!).. Plus if I break anything I can revert the bios settings and smash the old M.2 back in

BunnyJ · Oct 5, 2021

Mr_Padingy said:
Yea I was thinking of doing that.

Going to give it a go Thursday... Just ordered a new M.2 (1TB, upgrade from my current 256GB one because I thought why not!).. Plus if I break anything I can revert the bios settings and smash the old M.2 back in

Have fun.. and I hope all goes well.

bobkn · Oct 5, 2021

A generic bit of advice:

Good responses are likelier if you provide your system specs. At the very least, the motherboard make and model. That's what "My Computer" is for, but you could just put it in a post.

BunnyJ · Oct 5, 2021

bobkn said:
A generic bit of advice:

Good responses are likelier if you provide your system specs. At the very least, the motherboard make and model. That's what "My Computer" is for, but you could just put it in a post.

That helps and I should ask users to do that.

Mr_Padingy · Oct 5, 2021

bobkn said:
A generic bit of advice:

Good responses are likelier if you provide your system specs. At the very least, the motherboard make and model. That's what "My Computer" is for, but you could just put it in a post.

Apologies didn't see that bit! I'll add it.

bobkn · Oct 5, 2021

Mr_Padingy said:
Apologies didn't see that bit! I'll add it.

Thanks.

If your boot drive is already GPT, you shouldn't need to do anything to it.

Oddly enough, my secondary system uses the similar MSI MPG X570 Gaming Plus board. After coming from mostly Asus boards, I can't say that I like the BIOS settings screens. They don't display most settings; I've had to resort to the search option to find them. I wonder if I'm doing something wrong?

I just did a clean install of 22000.194 on it, mainly because I had some drivers that prevented core isolation from being turned on. Couldn't get rid of the drivers from the Driver Store.

I have the boot set to UEFI. (Legacy + UEFI should be OK, though.).

To allow Secure Boot, the BIOS UEFI/CSM mode must be set to UEFI.

I'm not clear on whether that combination works for you.

Other settings for Windows 11:

SVM (virtualization): enable.

IOMMU: enable.

With those turned on, core isolation will be an option in Win11. (Also Windows 10.) If that is turned on, "device security" will declare that your PC has enhanced hardware security.

Hope this helps.

RJARRRPCGP · Oct 6, 2021

SVM is in the overclocking section on my MSI B450 Tomahawk, LOL! :ROFLMAO:

AddRAM · Oct 6, 2021

Please upload a shot using Partition Wizard.

Mr_Padingy · Oct 6, 2021

AddRAM said:
Please upload a shot using Partition Wizard.

Shows GPT, but the same result - can't boot when disabling CSM/Legacy.
I blurred other drives otherwise it's confusing, got too many drives lol.

Not too bothered about this issue now, I've splashed out and bought a new NVMe which when it arrives I'll just format correctly and install Windows 11 from the start.

AddRAM · Oct 6, 2021

That`s what I`m doing, my 980 Pro came Sunday and I made my USB installer earlier last night, and the X299 is ready to go.

Don`t you have a CSM setting that says UEFI & Legacy, meaning, you don`t have to choose one or the other, that`s how I have mine set.

I have a GPT W10 drive and a MBR W10 drive on the Z170 and I only have to make 1 change in the Bios to use either one.

Mr_Padingy · Oct 6, 2021

AddRAM said:
That`s what I`m doing, my 980 Pro came Sunday and I made my USB installer earlier last night, and the X299 is ready to go.

Don`t you have a CSM setting that says UEFI & Legacy, meaning, you don`t have to choose one or the other, that`s how I have mine set.

I have a GPT W10 drive and a MBR W10 drive on the Z170 and I only have to make 1 change in the Bios to use either one.

I have UEFI & Legacy enabled but I can’t enable secure boot (requirement) without disabling this other option ‘CSM’ which when disabling hides all my drives

very odd. I just hope that when I get the new drive and hopefully install windows 11 okay, my other drives still work…

AddRAM · Oct 6, 2021

Ya it did the same thing to me, CSM has to be left enabled or there are no drives listed, just as you say.

I have it enabled and Boot Device Control set to UEFI only on the X299, but it can be set to UEFI & Legacy OPROM and it boots either way.

And under Boot\Secure Boot I have OS Type set to Windows UEFI mode. Hopefully you can change your settings to this and install Windows on your new drive, then it should boot ok.

lexster · Oct 6, 2021

Mr_Padingy said:
I have UEFI & Legacy enabled but I can’t enable secure boot (requirement) without disabling this other option ‘CSM’ which when disabling hides all my drives very odd. I just hope that when I get the new drive and hopefully install windows 11 okay, my other drives still work…

The problem you're having is that when Windows 10 was installed on your system, it wasn't in the correct configuration for enabling SecureBoot. Trying to set it now will require a complete reset of your system. An upgrade is very unlikely. However If you're willing to do a fresh install, you can set things up the right way and installing Windows 11 will succeed. But if for whatever reason it still doesn't want to take, you can always use a TPM/SecureBoot bypass method, but let's not jump to that option until you've worked everything out.

First, before you begin this process, make sure you backup everything you don't want to lose from your drive and unplug any drives Windows will not be installed to. Also download any drivers for your hardware you might need. Mostly graphics and motherboard. Below is the link to the motherboard you listed.

MPG X570 GAMING EDGE WIFI

Worth buying AMD AM4 X570 ATX gaming motherboard, lightning PCIe 4.0, lightning M.2, lightning M.2, Frozr heatsink, WiFi, USB 3.2 Gen 2, M.2 heatsink, good overclocking, extended heatsink, pre-install I/O, MSI GAMING

www.msi.com

Next, let's get you familiar with your motherboard BIOS. Head over to MSI's site and grab the manual.

MPG X570 GAMING EDGE WIFI

Worth buying AMD AM4 X570 ATX gaming motherboard, lightning PCIe 4.0, lightning M.2, lightning M.2, Frozr heatsink, WiFi, USB 3.2 Gen 2, M.2 heatsink, good overclocking, extended heatsink, pre-install I/O, MSI GAMING

www.msi.com

Open it up and scroll down to the BIOS Setup on page 43. Read through that section and find the settings needed to enable SecureBoot with drives enabled. It should be as simple as going to the Boot section, selecting UEFI only, going to the Trusted Computing section and enabling AMD fTPM, then going to Windows OS section and enabling SecureBoot.

Please note, once you enable these options your current installation of Windows will no longer be accessible. This is an unfortunate side-effect of these settings but is normal.

Next, you should then be able to boot the Windows 11 ISO from a USB drive and install Windows 11. Once into the Setup, you will see a drive select screen during the process. Make sure you delete the existing partitions and let Windows create what it needs. Then you can continue with setup.

If you hit a snag or need help, let me know and I'll walk you through it further.

Mr_Padingy · Oct 6, 2021

lexster said:
The problem you're having is that when Windows 10 was installed on your system, it wasn't in the correct configuration for enabling SecureBoot. Trying to set it now will require a complete reset of your system. An upgrade is very unlikely. However If you're willing to do a fresh install, you can set things up the right way and installing Windows 11 will succeed. But if for whatever reason it still doesn't want to take, you can always use a TPM/SecureBoot bypass method, but let's not jump to that option until you've worked everything out.

First, before you begin this process, make sure you backup everything you don't want to lose from your drive and unplug any drives Windows will not be installed to. Also download any drivers for your hardware you might need. Mostly graphics and motherboard. Below is the link to the motherboard you listed.

MPG X570 GAMING EDGE WIFI

Worth buying AMD AM4 X570 ATX gaming motherboard, lightning PCIe 4.0, lightning M.2, lightning M.2, Frozr heatsink, WiFi, USB 3.2 Gen 2, M.2 heatsink, good overclocking, extended heatsink, pre-install I/O, MSI GAMING

www.msi.com

Next, let's get you familiar with your motherboard BIOS. Head over to MSI's site and grab the manual.

MPG X570 GAMING EDGE WIFI

Worth buying AMD AM4 X570 ATX gaming motherboard, lightning PCIe 4.0, lightning M.2, lightning M.2, Frozr heatsink, WiFi, USB 3.2 Gen 2, M.2 heatsink, good overclocking, extended heatsink, pre-install I/O, MSI GAMING

www.msi.com

Open it up and scroll down to the BIOS Setup on page 43. Read through that section and find the settings needed to enable SecureBoot with drives enabled. It should be as simple as going to the Boot section, selecting UEFI only, going to the Trusted Computing section and enabling AMD fTPM, then going to Windows OS section and enabling SecureBoot.

Please note, once you enable these options your current installation of Windows will no longer be accessible. This is an unfortunate side-effect of these settings but is normal.

Next, you should then be able to boot the Windows 11 ISO from a USB drive and install Windows 11. Once into the Setup, you will see a drive select screen during the process. Make sure you delete the existing partitions and let Windows create what it needs. Then you can continue with setup.

If you hit a snag or need help, let me know and I'll walk you through it further.

Thank you very much for all this. I'm going to give it a go tomorrow when my new drive arrives.

I'll let you know how I get on.

NavyLCDR · Oct 6, 2021

Mr_Padingy said:
Shows GPT, but the same result - can't boot when disabling CSM/Legacy.
I blurred other drives otherwise it's confusing, got too many drives lol.

Not too bothered about this issue now, I've splashed out and bought a new NVMe which when it arrives I'll just format correctly and install Windows 11 from the start.

View attachment 9083

Your real problem is that you do not have an EFI System Partition to boot from in UEFI mode.

lexster · Oct 6, 2021

Mr_Padingy said:
I'm going to give it a go tomorrow when my new drive arrives.

Ah so ok, you got a fresh drive coming! This will be much easier for you. Just unplug your existing drives, plug in the new one, change the BIOS settings, boot the Win11 USB ISO(if you need help creating that, ask about it, it's also simple) and install Windows 11. You will be able to use your existing Windows 10 CD key to install so have it ready.

After the install is complete you'll be able to shut-down your system plug your older drives back in and then access your files as normal.

lexster · Oct 6, 2021

NavyLCDR said:
Your real problem is that you do not have an EFI System Partition to boot from in UEFI mode.

Yes, correct. When Windows 10 was setup on that system it was not configured for UEFI boot, thus this problem. With a fresh drive to install onto they'll be able to let setup configure as it needs to.

Mr_Padingy · Oct 6, 2021

lexster said:
Ah so ok, you got a fresh drive coming! This will be much easier for you. Just unplug your existing drives, plug in the new on, change the BIOS settings, boot the Win11 USB ISO(if you need help creating that, ask about it, it's also simple) and install Windows 11. You will be able to use your existing Windows 10 CD key to install so have it ready.

After the install is complete you'll be able to shut-down your system plug your older drives back in and then access your files as normal.

Perfect thanks! Yep just going to create a Windows 11 USB now from the media creation tool.

Thanks everyone for the help and replies! I'll update you on how I get on...

bobkn · Oct 6, 2021

NavyLCDR said:
Your real problem is that you do not have an EFI System Partition to boot from in UEFI mode.

Aha. That's probably it.

I believe that my Windows 10 install have always been clean, in UEFI mode, and that I let the installer automatically partition and format the drive. That always creates the small FAT32 UEFI boot partition.

I suppose there must be a way to create that post facto, but I don't know how to do that.

A clean install of 11 ought to give the best result, anyway.