Solved Do You Use Secure Boot?

Bree · 2026-08-04T20:31:54-0400

gunrunnerjohn said:
My systems range from around a year old to ten years old. Secure Boot is enabled on all of them because it's easy to do and provides some additional protection. I agree, it's not a panacea, but it is additional protection.

If Secure Boot was being a giant PITA for me, I'd run without it. However, that's not the case for me, so I don't see any good reason to disable it.

My System Two (Dell Latitude E4310) is from 2011. It has a very early implementation of UEFI, but it's a PITA when turned on. Best practice is to use it in Legacy Bios mode.

Windows 8 RTM, Latitude E4310 and UEFI | DELL Technologies

Has anyone tried using Windows 8 RTM on the Latitude range yet? I've recently installed RTM onto an E4310, selecting the UEFI mode rather than traditional BIOS and I'm finding that every time I try...

www.dell.com

All my other UEFI machines have secure boot turned on - I don't even notice it's there.... :thumbsup:

Buddywh · 2026-08-04T20:55:27-0400

spapakons said:
That said, keep in mind that having Secure Boot enabled doesn't make your computer immune to attacks. You have to also keep Windows Defender or third-party Antivirus updated and be careful what you do online.

From all I've learned about this, there is no one thing that makes anybody's computer immune to compromise. Secure Boot is just one part of a layered defense with each added piece decreasing the attack surfaces available to any attacker. And even then it's still not perfect, just more difficult.

Buddywh · 2026-08-04T21:07:24-0400

spapakons said:
... I don't let Bitlocker lock my disk without my permission....

That is the most frighteningly annoying thing I think I've ever run across after an Installation of Windows... and I've been annoyed by a lot of them over the years since Windows 3.11. I mean, locking up your main drive without even asking first and then hardly informing you of it. And saying nothing of the responsible thing you really must do which is print out or copy down the 48 digit recovery key.

Bree · 2026-08-04T21:15:19-0400

Buddywh said:
That is the most frighteningly annoying thing I think I've ever run across after an Installation of Windows... and I've been annoyed by a lot of them over the years since Windows 3.11. I mean, locking up your main drive without even asking first and then hardly informing you of it. And saying nothing of the responsible thing you really must do which is print out or copy down the 48 digit recovery key.

Initially it's only encrypted with Device Encryption turned on, and the disk left unlocked - you wouldn't notice it was there unless you looked for it.

It is only locked and the Bitlocker key generated when you first sign in with your Microsoft account - and doing so will save the key to the MS account.

I don't use my MS account to sign in, just a Local account. So the first thing I do after a clean install is decrypt the drive. It never comes back after that

spapakons · 2026-08-05T00:23:36-0400

One of the advantages of running Windows 11 on unsupported computers. You don't have to worry about Bitlocker and certificates. Also I don't have to worry about modern standby issues. The biggest advantage of course is that you keep your precious PC and not have to buy a new one just because Microsoft says so. As long as I can run latest Windows 11 versions and it serves my needs, I won't replace it. I don't have money to burn and I have spent enough on this all these years.

TraderGary · 2026-08-05T01:32:43-0400

I can certainly appreciate the cost of new hardware. I just purchased two new W11 machines, and my trading account is definitely a bit lighter!

I think about this, when you bypass the requirements on older machines, you do lose key W11 security capabilities.

yastil · 2026-08-05T02:02:55-0400

spapakons · 2026-08-05T02:53:05-0400

TraderGary said:
I can certainly appreciate the cost of new hardware. I just purchased two new W11 machines, and my trading account is definitely a bit lighter!

I think about this, when you bypass the requirements on older machines, you do lose key W11 security capabilities.

You have exactly the same level of security as running Windows 10 64-bit with the same configuration. Like in Windows 10 we can use TPM, if available, but not required, we can also boot either in UEFI mode (standard UEFI installation) or Legacy BIOS mode (Legacy installation). Mine is Legacy because my then SSD was only 120GB and I didn't want to waste any space for the extra GPT partitions, no matter how small they are. We can also enable Secure Boot in UEFI mode, if available.

Tweakfiend · 2026-08-05T04:19:53-0400

Secure Boot can be a Pfaff , but its better on than off.

You can turn off for example, with Rufus boot options if really needed.

My RX9060 graphics card, like many newer AMD cards, will not run without it

Most if not all current usb boot disc software is dual purpose these days and has UEFI and legacy boot options as in Macrium Reflect

TraderGary · 2026-08-05T05:54:01-0400

spapakons said:
You have exactly the same level of security as running Windows 10 64-bit with the same configuration. Like in Windows 10 we can use TPM, if available, but not required, we can also boot either in UEFI mode (standard UEFI installation) or Legacy BIOS mode (Legacy installation). Mine is Legacy because my then SSD was only 120GB and I didn't want to waste any space for the extra GPT partitions, no matter how small they are. We can also enable Secure Boot in UEFI mode, if available.

You’re right that an older machine running a bypassed Windows 11 install can only deliver the same security posture as Windows 10 — but that’s exactly why bypassing the requirements matters. Windows 11’s security model isn’t just “TPM and Secure Boot if available.” It assumes a hardware baseline that older systems simply don’t have: MBEC for reliable HVCI, modern CPU instruction sets for memory integrity, firmware designed for VBS always‑on, and a driver stack validated for the platform. When you bypass the checks, Windows 11 will run, but it falls back to the Windows 10 security level because the hardware can’t provide the protections Windows 11 is built around. Supported hardware gives you the full Windows 11 security architecture; unsupported hardware gives you Windows 10 security with a Windows 11 UI. That’s the real difference.

jimbo45 · 2026-08-05T05:56:55-0400

No - not on home / private machines - it's a pain if you want to test things as other OS'es / VM's etc -- I don't run bitlocker or device encryption either -- if I want stuff private I don't have it online.

I'm not anti-security / secure OS'es but some of the modern security is just bonkers -- like some of this 2 or is it 202 steps of security when you want tp pay for something online etc where you might even need 2 devices concurrently -- I just get so fed up and say if the alleged hacker" wants to take €7 or even €70 out of my bank account -- let them have it for all I care. !!!

N.Korean etc hackers have far more interesting pickings such as huge businesses, infrastructure frailties e.g energy etc) these days than a typical individuals laptop.

Pet hate -- Banks logging on where you have to give various letters of a memorable word - usually the long ones -- e.g you need to 6 characters but it asks for enter say letters 7, 9, 15, 21 etc from your memorable word, -- and if you need a bit of time counting to get say the correct 21'st character the wretched app times out grhh !!!! !and if you gert over that hurdle then it says we'll send you a code which you are expected to enter -- and often doesn't arrive or if it sends by email then sometimes multi-tasking on a mobile phone just loses the app - and the whole sorry business needs to start again.

Cheers
jimbo

thinker · 2026-08-05T06:29:45-0400

My second machine is a Dell 5050 sff with Intel 6th Gen i7 and Windows 10 is setup in legacy BIOS mode

I use MBRfilter.sys service from Cisco Talos to lock-up the MBR

Bree · 2026-08-05T07:48:24-0400

spapakons said:
You have exactly the same level of security as running Windows 10 64-bit with the same configuration. Like in Windows 10 we can use TPM, if available, but not required....

TraderGary said:
You’re right that an older machine running a bypassed Windows 11 install can only deliver the same security posture as Windows 10 — but that’s exactly why bypassing the requirements matters. Windows 11’s security model isn’t just “TPM and Secure Boot if available.” It assumes a hardware baseline that older systems simply don’t have...

As you both probably realise by now, the majority of my machines are fully supported devices. My unsupported devices run Windows 11 so that I can investigate and support potential issues. My System Two is one such device and has been running Windows 11 since the launch in 2021.

Almost all of the security of Windows 11 is there in Windows 10 too. The difference is that in 11 they are enabled by default, and in 10 they are disabled by default. The MS system requirements for W11 were chosen mainly so that 'enabled by default' could be the case.

How much of Windows 11's security can be enabled on an unsupported device depends on how far below the requirement it falls. If it meets all of them except for the processor generation then all of them can be enabled.

TPM: Windows 11 is designed to work with TPM 2.0. If TPM 1.2 is present then 11 will just ignore it. Windows 10 will use TPM 1.2 if present, in this respect it could be said to be more secure than 11.

Core Isolation/Memory Integrity: The older an unsupported device is, the more likely it is to have incompatible drivers that will never be updated to meet Memory Integrity requirements.

CPU: The requirement for '8th gen or higher' processors is because they natively support instructions required for VBS. Older processors can run VBS, but the instructions are emulated in microcode. MS decided that for an improved 'user experience' they would excluded these older processors.

I have Windows 11 on a machine that only fails by having a 6th gen i7. All Windows 11 security is enabled. The only issue it has is that its bios will never be updated to contain the CA 2023 certificates required to support secure boot after the 2011 certificates are revoked. Garlin's scripts can take care of that when the time comes.

spapakons · 2026-08-05T08:05:35-0400

TraderGary said:
You’re right that an older machine running a bypassed Windows 11 install can only deliver the same security posture as Windows 10 — but that’s exactly why bypassing the requirements matters. Windows 11’s security model isn’t just “TPM and Secure Boot if available.” It assumes a hardware baseline that older systems simply don’t have: MBEC for reliable HVCI, modern CPU instruction sets for memory integrity, firmware designed for VBS always‑on, and a driver stack validated for the platform. When you bypass the checks, Windows 11 will run, but it falls back to the Windows 10 security level because the hardware can’t provide the protections Windows 11 is built around. Supported hardware gives you the full Windows 11 security architecture; unsupported hardware gives you Windows 10 security with a Windows 11 UI. That’s the real difference.

Windows 11 has the interface of Windows 10X and version number 10.0.2xxxx.xxxx so it is basically Windows 10 with new skin and new features. Regarding Memory Isolation, this feature protects RAM data from virtual machine exploits. If you don't run a virtual machine is best disabled because it is a severe performance penalty.

Windows 10X - Wikipedia

en.wikipedia.org

spapakons · 2026-08-05T08:15:04-0400

Bree said:
As you both probably realise by now, the majority of my machines are fully supported devices. My unsupported devices run Windows 11 so that I can investigate and support potential issues. My System Two is one such device and has been running Windows 11 since the launch in 2021.

Almost all of the security of Windows 11 is there in Windows 10 too. The difference is that in 11 they are enabled by default, and in 10 they are disabled by default. The MS system requirements for W11 were chosen mainly so that 'enabled by default' could be the case.

How much of Windows 11's security can be enabled on an unsupported device depends on how far below the requirement it falls. If it meets all of them except for the processor generation then all of them can be enabled.

TPM: Windows 11 is designed to work with TPM 2.0. If TPM 1.2 is present then 11 will just ignore it. Windows 10 will use TPM 1.2 if present, in this respect it could be said to be more secure than 11.

Core Isolation/Memory Integrity: The older an unsupported device is, the more likely it is to have incompatible drivers that will never be updated to meet Memory Integrity requirements.

CPU: The requirement for '8th gen or higher' processors is because they natively support instructions required for VBS. Older processors can run VBS, but the instructions are emulated in microcode. MS decided that for an improved 'user experience' they would excluded these older processors.

I have Windows 11 on a machine that only fails by having a 6th gen i7. All Windows 11 security is enabled. The only issue it has is that its bios will never be updated to contain the CA 2023 certificates required to support secure boot after the 2011 certificates are revoked. Garlin's scripts can take care of that when the time comes.

View attachment 178646

View attachment 178647 View attachment 178650 View attachment 178648

View attachment 178649

This is what Microsoft want us think. That the strict Windows 11 system requirements and the stricter ones for 24H2 and higher are for "security reasons" and for "better user experience". They are trying to push us upgrade our computers, or even better replace them, because they have made some deal with manufacturers to increase their sales. Even current computers have a performance penalty from Memory Integration, but they are too fast to notice. Older computers, mainly AMD systems, struggled when they installed Windows 11 because Memory Integration was enabled by default and was a severe performance penalty. It was a known issue. In the relevant threads they were told to disable it for better Windows 11 experience.

Bree · 2026-08-05T08:18:11-0400

spapakons said:
Regarding Memory Isolation, this feature protects RAM data from virtual machine exploits. If you don't run a virtual machine is best disabled because it is a severe performance penalty.

As I said in post #93, the '8th gen and above' requirement was set for just this reason. It's not a significant performance hit for a supported CPU.

spapakons · 2026-08-05T08:23:41-0400

Bree said:
As I said in post #93, the '8th gen and above' requirement was set for just this reason. It's not a significant performance hit for a supported CPU.

Not significant, but still is. So why keep it enabled if you don't need it?

Buddywh · 2026-08-05T08:25:18-0400

Bree said:
Initially it's only encrypted with Device Encryption turned on, and the disk left unlocked -...

By 'locked' you must mean sealing the key with the TPM, which would be needed to unlock it. So, if something happened to toast your computer and you had to take the drive to another computer to get access to files... or you if simply disable secure boot to test things... you won't be blocked by lack of a recovery key to get files off it?

But if that's expected behavior why bother with default encryption at all?

At first sign on to your Microsoft account does it give you a notification it's locking the encrypted disk? And I presume saving a copy of the recovery key in the account: I've always assumed that I need to do that myself from the control panel app.

spapakons · 2026-08-05T08:39:29-0400

Buddywh said:
So if something happened to toast your computer and you had to take the drive to another computer to recover files... or you simply turned secure boot off to test things... you won't be blocked by lack of a recovery key to get files off it?

But if that's expected behavior why bother with default encryption at all?

At first sign on to your Microsoft account does it give you a notification it's locking the encrypted disk and, I presume at least, saving a copy of the recovery key in the account? I've always assumed that I need to do that myself from the control panel app.

That's a known issue. Using Microsoft account to login has become mandatory since Windows 11 24H2. So most get their disk locked and cannot unlock it! The only solution is to wipe it and reinstall Windows. I am not sure if there is a warning, probably not. My first think to do, before even install drivers, when I clean install Windows 11 on a compliant PC with a Microsoft account is to check Bitlocker status. Make sure the drive is not encrypted and disable Bitlocker, just in case.

Buddywh · 2026-08-05T08:45:17-0400

spapakons said:
My first think to do, before even install drivers, when I clean install Windows 11 on a compliant PC with a Microsoft account is to check Bitlocker status.

Yeah... but you're a smart guy about these things. Even a half-smart guy like me... or especially a DIY naif building their first system... won't always see the potential trap Microsoft laid for them.

Solved Do You Use Secure Boot?

Do You Use Secure Boot?

Yes

No

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Stock Market Wizard

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Stock Market Wizard

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computer

My Computers

My Computers

My Computers

My Computer

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers