Secure Boot

Tasmania Green · Feb 21, 2026

I was having problems installing CachyOS when @pseymour suggested I turn off Secure Boot. That worked and I’m now proceeding with installing CachyOS.

Before this I hadn’t heard of Secure Boot. I read on the Windows website that it’s an important feature to have turned on.

But is it important to have Secure Boot turned on?

garlin · Feb 21, 2026

Secure Boot is a security feature on UEFI-based motherboards to prevent attackers from replacing legitimate boot files with hacked files. When enabled, each boot file must be verified by a digital certificate. UEFI then checks its list of allowed and banned Secure Boot certs, and decides if that file is permitted to load.

If Secure Boot is disabled, no enforcement is performed. You can boot anything that runs off UEFI. Older versions of Windows, any Linux. But you may not be able to trust the running OS wasn't hacked at boot time. Bad actors having knowingly exploited this security gap.

If Secure Boot is enabled, the current set of certs will determine which Windows or Linux versions are allowed to boot. Because Windows is a huge part of the PC market, your OEM will include the MS set of certs on every PC or motherboard. That's because of sheer market monopoly. A Linux vendor isn't going to have critical mass to get their certs pre-installed.

So it's easier to initially disable Secure Boot in order to boot most Linuxes. After Linux is installed, there are tools to enable Secure Boot to work with your Linux distro.

Ideally, Secure Boot should be enabled to help protect Windows. But if you're playing around with Linux for the first time, you'll have to disable in the short run until you're more comfortable with Linux.

Tasmania Green · Feb 21, 2026

garlin said:
Secure Boot is a security feature on UEFI-based motherboards to prevent attackers from replacing legitimate boot files with hacked files. When enabled, each boot file must be verified by a digital certificate. UEFI then checks its list of allowed and banned Secure Boot certs, and decides if that file is permitted to load.

If Secure Boot is disabled, no enforcement is performed. You can boot anything that runs off UEFI. Older versions of Windows, any Linux. But you may not be able to trust the running OS wasn't hacked at boot time. Bad actors having knowingly exploited this security gap.

If Secure Boot is enabled, the current set of certs will determine which Windows or Linux versions are allowed to boot. Because Windows is a huge part of the PC market, your OEM will include the MS set of certs on every PC or motherboard. That's because of sheer market monopoly. A Linux vendor isn't going to have critical mass to get their certs pre-installed.

So it's easier to initially disable Secure Boot in order to boot most Linuxes. After Linux is installed, there are tools to enable Secure Boot to work with your Linux distro.

Ideally, Secure Boot should be enabled to help protect Windows. But if you're playing around with Linux for the first time, you'll have to disable in the short run until you're more comfortable with Linux.

I’m okay with installing Linux.

But I couldn’t remember the sizes of my internal M.2 drives, so I decided to go back to Windows to make sure I was installing Linux on the correct drive. I Windows said it couldn’t find my PIN, so I turned Secure Boot back on. Windows still said it couldn’t find my old PIN (which makes sense since I turrned Secure Boot off and then back on again). But now it won’t let me create a new PIN. I sign-in with my passkey (using my iPhone) and Windows asks if I’m sure I want to reset my PIN. I click on Continue. But it says something went wrong and it wasn’t able to set up my PIN. No matter how many times I click on Retry, I can’t get to the next screen.

I restarted my PC with my emergency boot disk. (Which I just created a few days ago. Whew!)_

garlin · Feb 21, 2026

Disabling Secure Boot freaks out TPM if you have a Hello PIN (since it's stored in the TPM).

You need to check the recovery steps, like seeing if you can log into your account with the normal password and then clearing the PIN. I haven't done a recovery before, so can't help you there. But there's a number of online guides for this emergency.

Tasmania Green · Feb 22, 2026

I’ve found a lot of information on how to create a recovery USB but not how to actually use it to enter just a password. I’ll keep looking, but any suggestions?

antspants · Feb 22, 2026

Create Recovery Drive in Windows 11

This tutorial will show you how to create a bootable USB recovery drive that boots to advanced startup (WinRE) to troubleshoot, restore, or recover Windows 11. If your PC won’t start, you can use a recovery drive to restore from a system restore point or recover your PC. It's a good idea to...

www.elevenforum.com

Reset PIN for Account in Windows 11

This tutorial will show you how to reset the PIN for your account in Windows 11. Windows Hello is a more personal, more secure way to get instant access to your Windows 11 devices using a PIN, facial recognition, or fingerprint. You'll need to set up a PIN as part of setting up fingerprint or...

www.elevenforum.com

Fix Something happened and your PIN isn't available on Windows 11

Windows Hello is a more personal, more secure way to get instant access to your Windows 11 devices using a PIN, facial recognition, or fingerprint. You'll need to set up a PIN as part of setting up fingerprint or facial recognition sign-in, but you can also sign in with just your PIN. A PIN is...

www.elevenforum.com

Reset Password for Account in Windows 11

This tutorial will show you how to reset the password of a local account and Microsoft account in Windows 11. If you forgot or lost your account password for Windows 11, you may be able to change or reset it. References: Change or reset your Windows password Reset your Windows local account...

www.elevenforum.com

antspants · Feb 22, 2026

Tasmania Green said:
I’ve found a lot of information on how to create a recovery USB

Recovery USB or Password reset disk?

Create Password Reset Disk for Local Account in Windows 11

This tutorial will show you how to create a password reset disk on a USB flash drive for your local account in Windows 10 and Windows 11. Creating a password reset disk is a precautionary measure that allows you to reset your Windows local account password in case you forget it. The password...

www.elevenforum.com

garlin · Feb 22, 2026

Boot into Recovery mode, or boot from a Windows ISO and get a CMD shell (Shift-F10).

Delete the PIN credentials folder.

Code:

takeown /f C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC /r /d y
icacls C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC /grant administrators:F /t
rd /s /q C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC

Tasmania Green · Feb 22, 2026

Yay! Using my password I reset my PIN and I’m back in. Thanks Sinto!

antspants · Feb 22, 2026

Tasmania Green said:
Yay! Using my password I reset my PIN and I’m back in. Thanks Sinto!

Well done, Mike

Secure Boot

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computers

My Computer

My Computer

My Computers