Secure boot 'setup mode'


B

BrianInEngland

Well-known member
Pro User
VIP
Local time
6:48 AM
Posts
3,105
OS
Windows 11 Pro 25H2 (RP channel)
I clean installed Windows last week with Secure Boot Disabled in BIOS
I see that it's still in User mode - if I reset it to Setup mode will Windows still boot?
 

My Computer My Computer

At a glance

Windows 11 Pro 25H2 (RP channel)AMD Ryzen 7 9800X3D 8-core64GB Corsair Titanium 6000/CL30MSI Suprim 5080 SOC
OS
Windows 11 Pro 25H2 (RP channel)
Computer type
PC/Desktop
Manufacturer/Model
MSI
CPU
AMD Ryzen 7 9800X3D 8-core
Motherboard
MEG X870E Godlike
Memory
64GB Corsair Titanium 6000/CL30
Graphics Card(s)
MSI Suprim 5080 SOC
Sound Card
Soundblaster AE-9
Monitor(s) Displays
ASUS TUF Gaming VG289Q
Screen Resolution
3840x2160
Hard Drives
Samsung 9100 Pro 4TB (gen 5 x4, system drive/games)
Samsung 990 Pro 2TB
Samsung 980 Pro 2TB
Samsung 870 Evo 4TB
Samsung 870 Evo 2TB
Samsung T9 4TB
PSU
Seasonic PX-2200
Case
Bequiet! Dark Base Pro 901
Cooling
Noctua NH-D15S Chromax black
Keyboard
Logitech G915 X (wired)
Mouse
Logitech G903 with PowerPlay charger
Internet Speed
900Mb/sec
Browser
Microsoft Edge
Antivirus
Windows Defender
Hi, Brian.

This is what I have just learned — If you reset Secure Boot from User Mode to Setup Mode in the BIOS, Windows will still boot — but there are a few caveats to keep in mind:
  • Setup Mode disables Secure Boot checks.
  • User Mode enforces Secure Boot using installed Secure Boot keys (PK, KEK, DB).
  • Resetting to Setup Mode clears the Platform Key (PK), allowing modification of Secure Boot keys.
  • Windows will still boot in Setup Mode because Secure Boot is effectively disabled.

Also
  • Secure Boot Disabled in BIOS:
    If Secure Boot is already off, switching to Setup Mode won’t change its behavior.
  • Trusted Boot / BitLocker:
    If you re-enable Secure Boot while still in Setup Mode (without valid keys), BitLocker might prompt for recovery or show errors.
  • Driver Signing Enforcement:
    Even in Setup Mode, Windows enforces driver signing unless test mode is manually enabled.

It is suggested
  • If you plan to re-enable Secure Boot later:
    Switch back to User Mode with a valid key set.
  • Use Setup Mode only temporarily—for key management or custom key installation.
  • If experimenting or leaving Secure Boot disabled:
    Setup Mode is fine, but don’t re-enable Secure Boot unless you're sure the key configuration is correct.
 
Last edited:

My Computers My Computers

System One System Two Other systems

  • At a glance

    Windows 11 Pro 25H2 Build 26200.8655Intel(R) Core(TM) i7-4770K CPU @ 3.50GHz32.0 GB of I forget and the box is in storage.Gigabyte nVidia GeForce GTX 1660 Super OC 6GB
    OS
    Windows 11 Pro 25H2 Build 26200.8655
    Computer type
    PC/Desktop
    Manufacturer/Model
    Sin-built 2013
    CPU
    Intel(R) Core(TM) i7-4770K CPU @ 3.50GHz
    Motherboard
    ASUS ROG Maximus VI Formula
    Memory
    32.0 GB of I forget and the box is in storage.
    Graphics Card(s)
    Gigabyte nVidia GeForce GTX 1660 Super OC 6GB
    Sound Card
    ROG SupremeFX Formula 8-Channel High Definition Audio
    Monitor(s) Displays
    5 x LG 25MS500-B - 1 x 24MK430H-B - 1 x Wacom Pro 22" Touch Screen Tablet
    Screen Resolution
    All over the place
    Hard Drives
    Too many to list. OS on Samsung 1TB 870 QVO SATA
    PSU
    Silverstone 1500
    Case
    NZXT Phantom 820 Full-Tower Case
    Cooling
    Noctua NH-D15 Elite Class Dual Tower CPU Cooler / 6 x EziDIY 120mm / 2 x Corsair 140mm somethings / 1 x 140mm Thermaltake something / 2 x 200mm Corsair.
    Keyboard
    Corsair K95 / Logitech diNovo Edge Wireless
    Mouse
    Logitech: G402 / G502 / Mx Masters / Mx Air Cordless
    Internet Speed
    2000/500Mbps
    Browser
    All sorts
    Antivirus
    Kaspersky Premium
    Other Info
    ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
    TP-Link BE9300 WiFi 7 Bluetooth 5.4 (Archer TBE550E)
    TP-Link TX201 V1 2.5GB Lan

    Grandstream HT812 - VoIP
    ASUS DSL-AX82U - Mesh
    ASUS RT-AC68U - Mesh
    ASUS RT-BE88U Router

    Brother MFC-L2880DW Printer

    I’m on a horse.

  • At a glance

    Windows 11 Pro 25H2 Build 26200.8655 (Wifes)13th Generation Intel® Core™ i5-1340P Process...16GB LPDDR5-52001x Intel® Iris® Xe Graphics
    Operating System
    Windows 11 Pro 25H2 Build 26200.8655 (Wifes)
    Computer type
    Laptop
    Manufacturer/Model
    LENOVO Yoga 7 14IRL8 - Type 82YL
    CPU
    13th Generation Intel® Core™ i5-1340P Processor(Core™ i5-1340P)
    Memory
    16GB LPDDR5-5200
    Graphics card(s)
    1x Intel® Iris® Xe Graphics
    Sound Card
    Optimized with Dolby Atmos®
    Screen Resolution
    QHD 2880 x 1800 OLED
    Hard Drives
    M.2 512 GB SSD PCIe
    Mouse
    Logiteck MX Master 3S
    Internet Speed
    2000/500
    Antivirus
    Defender / Malwarebytes
    Other Info
    …still on a horse.


    Wireless Network: Wi-Fi 6E 2x2 AX; Bluetooth® 5.1 or above
    Ports: 1x 1 Novo button; 2 in 1 Audio Combo jack; Micro SD Card Reader; HDMI 1.4b; 2 x USB Type-C (TBT4)
    USB 3.2 Gen 2 DP 1.4a
    PD 3.0); 1 x USB 3.2 Gen1 Type A
    Camera
    1x 1080P FHD IR/RGB Hybrid with Privacy Shutter and Dual Array Microphone
    Graphics
    1x Intel® Iris® Xe Graphics
    Monitor
    14" WUXGA
    Form Factor
    Convertible Notebook
  • Windows 11 Pro 25H2 Build 26200.8655 (Wifes)

    Yoga 7 2-in-1 14IML9 - Type 83DJ

    Processor: Intel® Core™ Ultra 7 155H Processor(Core™ Ultra 7 155H)

    Memory: 32GB LPD5X-7467

    Hard Drive: 1 TB SSD PCIe

    Wireless Network: 1x Wi-Fi 6E 2x2 AX; Bluetooth® 5.1 or above

    Ports: 1 x HDMI 2.1 TMDS; 1 x Novo Button; 1 x Combo Audio Jack
    2 x USB-C (USB 4.0)
    1 x USB-A 3.2 Gen 1

    Camera: 1080P FHD IR Hybrid with Dual Microphone

    Graphics: Intel® Arc™ Graphics

    Monitor: 14" 2.8K

    ...Where's my horse?
antspants said:
Hi, Brian.

This is what I have just learned — If you reset Secure Boot from User Mode to Setup Mode in the BIOS, Windows will still boot — but there are a few caveats to keep in mind:
  • Setup Mode disables Secure Boot checks.
  • User Mode enforces Secure Boot using installed Secure Boot keys (PK, KEK, DB).
  • Resetting to Setup Mode clears the Platform Key (PK), allowing modification of Secure Boot keys.
  • Windows will still boot in Setup Mode because Secure Boot is effectively disabled.

Also
  • Secure Boot Disabled in BIOS:
    If Secure Boot is already off, switching to Setup Mode won’t change its behavior.
  • Trusted Boot / BitLocker:
    If you re-enable Secure Boot while still in Setup Mode (without valid keys), BitLocker might prompt for recovery or show errors.
  • Driver Signing Enforcement:
    Even in Setup Mode, Windows enforces driver signing unless test mode is manually enabled.

It is suggested
  • If you plan to re-enable Secure Boot later:
    Switch back to User Mode with a valid key set.
  • Use Setup Mode only temporarily—for key management or custom key installation.
  • If experimenting or leaving Secure Boot disabled:
    Setup Mode is fine, but don’t re-enable Secure Boot unless you're sure the key configuration is correct.
Click to expand...
This is useful information, thanks!
I've never had the need for SB, it was only enabled when the shop built my PC, I went years without it
I don't use Bitlocker or anything.

Update: I reset to Setup mode and it's fine
I had to leave the SB option as Custom (not Standard) as Standard just loads the default keys at reboot and goes back to User mode. Custom needs the keys to be loaded manually.
 
Last edited:

My Computer My Computer

At a glance

Windows 11 Pro 25H2 (RP channel)AMD Ryzen 7 9800X3D 8-core64GB Corsair Titanium 6000/CL30MSI Suprim 5080 SOC
OS
Windows 11 Pro 25H2 (RP channel)
Computer type
PC/Desktop
Manufacturer/Model
MSI
CPU
AMD Ryzen 7 9800X3D 8-core
Motherboard
MEG X870E Godlike
Memory
64GB Corsair Titanium 6000/CL30
Graphics Card(s)
MSI Suprim 5080 SOC
Sound Card
Soundblaster AE-9
Monitor(s) Displays
ASUS TUF Gaming VG289Q
Screen Resolution
3840x2160
Hard Drives
Samsung 9100 Pro 4TB (gen 5 x4, system drive/games)
Samsung 990 Pro 2TB
Samsung 980 Pro 2TB
Samsung 870 Evo 4TB
Samsung 870 Evo 2TB
Samsung T9 4TB
PSU
Seasonic PX-2200
Case
Bequiet! Dark Base Pro 901
Cooling
Noctua NH-D15S Chromax black
Keyboard
Logitech G915 X (wired)
Mouse
Logitech G903 with PowerPlay charger
Internet Speed
900Mb/sec
Browser
Microsoft Edge
Antivirus
Windows Defender
You must log in or register to reply here.

Similar threads

QUESTIONS regarding SECURE BOOT
Replies
12
Views
563
Lou
Lou
Solved Successful manual update of Secure Boot on Dell XPS8930 with older BIOS that will never update.
Replies
18
Views
504
trabel
T
Acer Secure Boot 2023 Certs
Replies
2
Views
242
betakernel
B
Secure Boot Problem.
2
Replies
34
Views
960
gunrunnerjohn
gunrunnerjohn
Secure boot violation after deleted the secure boot keys
Replies
10
Views
2K
Winback
W

Latest Support Threads

Latest Tutorials

Back
Top Bottom