Solved Do You Use Secure Boot?

Bree · Aug 6, 2026

Buddywh said:
What's VBS again? Is that Intel's equivalent to AMD's SVM (hardware virtualization)?

No, VBS (virtualization-based security) is a Windows security environment.

Virtualization-based security, or VBS, uses hardware virtualization and the Windows hypervisor to create an isolated virtual environment that becomes the root of trust of the OS that assumes the kernel can be compromised. Windows uses this isolated environment to host a number of security solutions, providing them with greatly increased protection from vulnerabilities in the operating system, and preventing the use of malicious exploits which attempt to defeat protections. VBS enforces restrictions to protect vital system and operating system resources, or to protect security assets such as authenticated user credentials.

Virtualization-based Security (VBS)

Provides guidance on what an OEM should do to enable VBS

learn.microsoft.com

gunrunnerjohn · Aug 6, 2026

garlin said:
Secure Boot itself has zero performance impact on Windows.

Enabling Secure Boot allows you to enable VBS and other kernel security features, which will cause some level of performance drag. It's not from Secure Boot doing its job, but having the option for those enhanced security features that can't happen without Secure Boot building a "safe foundation" by being there at boot time.

True, but we were talking about Bitlocker.

PerpetualCycle · Aug 6, 2026

spapakons said:
I also hate UAC, so I always set it to the lowest level so it bothers me only for important actions that might damage my system. Not for everything. This is very important for me because I use a lot of old applications and I have set them to run as Admin for compatibility reasons. I would hate to see the UAC every time I launch one.

I set UAC off. It is pointless. - it doesn't protect anything. You will always be spamming the OK key until it hurts. Then nobody will be to blame but you.

garlin · Aug 6, 2026

gunrunnerjohn said:
True, but we were talking about Bitlocker.

BitLocker has relatively low overhead on a modern CPU. Data encryption is done at the per-block level, not encrypted across the entire disk (which would be massively expensive).

Now if you have full BitLocker (Pro) and not Device Encryption (Home) and select a tougher encryption method, then yeah it'll start to be a drag.

TraderGary · Aug 7, 2026

garlin said:
BitLocker has relatively low overhead on a modern CPU. Data encryption is done at the per-block level, not encrypted across the entire disk (which would be massively expensive).

Now if you have full BitLocker (Pro) and not Device Encryption (Home) and select a tougher encryption method, then yeah it'll start to be a drag.

I just leave it at the lowest level, AES 128-bit encryption. Heck, even that level has never been broken.

Stigg · Aug 30, 2026

PerpetualCycle said:
I set UAC off. It is pointless. - it doesn't protect anything. You will always be spamming the OK key until it hurts. Then nobody will be to blame but you.

Me too.

jimbo45 · Aug 30, 2026

On home (not work) computers all these things are crazy - especially if you want to test other OS'es,. Why also do you need things like bit locker and device encryption etc. -- All good stuff for corporates, work computers etc but for regular home users ??????

Totally unnecessary !!! and good luck if you've got this stuff on and you have problems recovering data etc !!!.

Cheers
jimbo

spapakons · Aug 30, 2026

jimbo45 said:
On home (not work) computers all these things are crazy - especially if you want to test other OS'es,. Why also do you need things like bit locker and device encryption etc. -- All good stuff for corporates, work computers etc but for regular home users ??????

Totally unnecessary !!! and good luck if you've got this stuff on and you have problems recovering data etc !!!.

Cheers
jimbo

That's why I avoid using these, so I can be able to recover data if anything goes wrong. In first years of Windows XP I left the disk in FAT32 when upgrading from 98 or fresh installing XP precisely so I can copy data from DOS if Windows wouldn't boot. I only used NTFS since Vista era. Similarly I will avoid ReFS and stick with NTFS if it becomes standard for regular Windows versions.

Buddywh · Aug 30, 2026

jimbo45 said:
On home (not work) computers all these things are crazy - especially if you want to test other OS'es,. Why also do you need things like bit locker and device encryption etc. -- All good stuff for corporates, work computers etc but for regular home users ??????

Totally unnecessary !!! and good luck if you've got this stuff on and you have problems recovering data etc !!!.

Cheers
jimbo

It depends on how you use your computer I suppose.

I came to realize there is ton of personal information I keep on my system that's really, really important for me to have readily available. I even keep it on a portable drive so I can take it to any of the four systems I commonly use, including a laptop I travel with. It would really only take a half-smart person to get to it all since it's on documents, pdf's, saved emails, etc. for MY CONVENIENCE. They don't have to do crazy stuff like pull it out of caches, temp files and memory locations that haven't been cleared.

I was concerned about losing the portable or laptop (in particular) or a thief getting them, only a half smart thief or fence they sell to is needed to look through drives and find interesting files. That's, really quite elementary.

So how do I protect it without adding a metric ****-ton of work for myself installing, keeping it updated and checking on it? Simple and easy: bitlocker and bitlocker-to-go encryption. But it's only EASY if the system unlocks it at startup so that means saving the key for unlocking the portable drive on the system drive: have to encrypt that with bitlocker too. And then protect the boot environment against the many easy/quick/available hacks at startup with secure boot to make it far more difficult, meaning a full-smart person is needed now. Microsoft keeps everything updated with security updates and it works consistently across all my Win11 systems -- it truly is fully transparent to me what's going on behind the scenes.

Secure boot, Bitlocker on system and portable drives is just as transparent as it gets. There is one thing only I have to remember, that's where I have a printout of the recovery keys if I ever need them, but I've never had a problem. It's extremely effective at raising the bar for any thief trying to hack into it, to a point even a really smart one used to doing this sort of thing would just format it and sell it on. Which is OK since the data is safe at least.

Scannerman · Aug 30, 2026

Marie SWE said:
No... Legacy and MBR is king with multiboot systems.

True, but not nearly as secure. (Sadly.) What bothered me the longest time with secure boot was that I couldn't multi-boot back to Linux when I wanted. I always had to disable secure boot first. Perhaps I should not have pointed that out lol Now MS might "fix" it.

Buddywh · Aug 30, 2026

Scannerman said:
True, but not nearly as secure. (Sadly.) What bothered me the longest time with secure boot was that I couldn't multi-boot back to Linux when I wanted. I always had to disable secure boot first. Perhaps I should not have pointed that out lol Now MS might "fix" it.

There is...it's called a linux shim. The way it works is doubtless specific to the Linux distro, but a shim is a Microsoft signed binary (therefore passes secure boot validation) that passes the secure boot process to Linux or Windows depending on your choice during startup.

If your distro doesn't come with a shim you can make one yourself using code you get from GITHub, then sign it using keys you get from GITHub or your own keys.

It works well with Windows but how, or if, this all works with Linux and Bitlocker isn't something I'm aware of.

Scannerman · Aug 30, 2026

Buddywh said:
There is...it's called a linux shim. The way it works is doubtless specific to the Linux distro, but a shim is a Microsoft signed binary (therefore passes secure boot validation) that passes the secure boot process to Linux or Windows depending on your choice during startup.

If your distro doesn't come with a shim you can make one yourself using code you get from GITHub, then sign it using keys you get from GITHub or your own keys.

It works well with Windows but how, or if, this all works with Linux and Bitlocker isn't something I'm aware of.

Yes, I have it working now but there was a time when I couldn't use secure boot with Linux and other OS. I always had to switch to "Other OS" in the BIOS.

SlicEnDicE · Aug 30, 2026

TraderGary said:
I just leave it at the lowest level, AES 128-bit encryption. Heck, even that level has never been broken.

No, but it can easily be bypassed completely, revealing the decryption key. Only thing you need to read the whole dive.

spapakons · Aug 30, 2026

Buddywh said:
It depends on how you use your computer I suppose.

I came to realize there is ton of personal information I keep on my system that's really, really important for me to have readily available. I even keep it on a portable drive so I can take it to any of the four systems I commonly use, including a laptop I travel with. It would really only take a half-smart person to get to it all since it's on documents, pdf's, saved emails, etc. for MY CONVENIENCE. They don't have to do crazy stuff like pull it out of caches, temp files and memory locations that haven't been cleared.

I was concerned about losing the portable or laptop (in particular) or a thief getting them, only a half smart thief or fence they sell to is needed to look through drives and find interesting files. That's, really quite elementary.

So how do I protect it without adding a metric ****-ton of work for myself installing, keeping it updated and checking on it? Simple and easy: bitlocker and bitlocker-to-go encryption. But it's only EASY if the system unlocks it at startup so that means saving the key for unlocking the portable drive on the system drive: have to encrypt that with bitlocker too. And then protect the boot environment against the many easy/quick/available hacks at startup with secure boot to make it far more difficult, meaning a full-smart person is needed now. Microsoft keeps everything updated with security updates and it works consistently across all my Win11 systems -- it truly is fully transparent to me what's going on behind the scenes.

Secure boot, Bitlocker on system and portable drives is just as transparent as it gets. There is one thing only I have to remember, that's where I have a printout of the recovery keys if I ever need them, but I've never had a problem. It's extremely effective at raising the bar for any thief trying to hack into it, to a point even a really smart one used to doing this sort of thing would just format it and sell it on. Which is OK since the data is safe at least.

Most would not care about your data if they stole the laptop, they would just format the drive and sell the laptop. Using BitLocker you make it much more difficult as they would have to wipe the drive or in worst case replace it before selling.

spapakons · Aug 30, 2026

Buddywh said:
There is...it's called a linux shim. The way it works is doubtless specific to the Linux distro, but a shim is a Microsoft signed binary (therefore passes secure boot validation) that passes the secure boot process to Linux or Windows depending on your choice during startup.

If your distro doesn't come with a shim you can make one yourself using code you get from GITHub, then sign it using keys you get from GITHub or your own keys.

It works well with Windows but how, or if, this all works with Linux and Bitlocker isn't something I'm aware of.

Yet more advanced stuff to mess with for those running Linux. One more reason to make Linux less user friendly and less desirable for me. I stick with Windows for my convenience and my sanity.

SlicEnDicE · Aug 30, 2026

spapakons said:
Yet more advanced stuff to mess with for those running Linux. One more reason to make Linux less user friendly and less desirable for me. I stick with Windows for my convenience and my sanity.

There is nothing to mess with. SB is a Windows thing...so plop up BIOS and disable it. Problem gone.

garlin · Aug 30, 2026

spapakons said:
Most would not care about your data if they stole the laptop, they would just format the drive and sell the laptop. Using BitLocker you make it much more difficult as they would have to wipe the drive or in worst case replace it before selling.

Do identity thieves not exist in Greece? You're assuming someone is stealing the PC just to resell. If I knew someone was wealthy, I would try scamming them or their associates using stolen personal data.

garlin · Aug 30, 2026

Scannerman said:
Yes, I have it working now but there was a time when I couldn't use secure boot with Linux and other OS. I always had to switch to "Other OS" in the BIOS.

Here's a dirty secret. In BIOS'es that old, it really means "Secure Boot is off".

Because they didn't provide a way for manual key enrollment. Back in the day, older BIOS'es were less consistent in how they supported Secure Boot and for some implementations it was "use the default MS keys provided in the BIOS" or "trust anything to boot" (no cert enforcement).

Scannerman · Aug 30, 2026

garlin said:
Here's a dirty secret. In BIOS'es that old, it really means "Secure Boot is off".

Because they didn't provide a way for manual key enrollment. Back in the day, older BIOS'es were less consistent in how they supported Secure Boot and for some implementations it was "use the default MS keys provided in the BIOS" or "trust anything to boot" (no cert enforcement).

Yes, I wondered about that. I'm not worried about it now that the problem is fixed. I just don't know how long it will remain that way.

Buddywh · Aug 30, 2026

spapakons said:
Most....

It's the one who does that concerns me. For free and easy, why sweat even that.

Solved Do You Use Secure Boot?

Do You Use Secure Boot?

Yes

No

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Syzygy

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Stock Market Wizard

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Similar threads

My Computers

My Computers

My Computers

My Computer

My Computers

My Computers

My Computer

My Computers

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computers

My Computers

My Computer

My Computer

My Computer

My Computers