Windows 11 23H2 boots up successfully even with "Secure Boot->Disabled" in my BIOS - Is this normal?

JaQuille · Oct 28, 2024

I've been trying to boot up into a Linux Mint distro off my old USB 2.0 flash drive which I created with YUMI so I could boot up into 1 of several LIVE Linux distros. It's not working so I got the idea that, maybe, I need to disable "Secure Boot" in my BIOS to get this to work. Well, I did that and I still can't seem to get my BIOS to boot up off the USB 2.0 flash drive. The surprising thing, to me anyway, is that Windows 11 23H2 still boots up successfully even with "Secure Boot" disabled in my mainboard's BIOS.

And to add even more fuel to the fire, Windows does not alert the user to this at all anywhere before, during or after the entire boot up into Windows 11. And that's what surprises me more than anything because Windows has a habit of being a little whiny nag about security issues when they are encountered.

So, I guess I just wanna learn in more detail about how all this works. If anybody can elucidate my understanding of this situation that would be great.

Thanks for reading!

antspants · Oct 28, 2024

Hi, Welcome.

Booting with secure boot helps prevent sophisticated attacks that could inject malicious code into the boot process. Disabling Secure Boot can be useful if you want to dual-boot Windows 11 with certain Linux distributions, but some of the most popular ones actually support it, so keeping it enabled if it works with your distro’s (which it isn’t) is generally better regardless.

Disabling/enabling SecureBoot doesn't affect already installed operating systems in any way.

The only thing SecureBoot (if enabled) does is to verify that the Operating Systems bootloader has a valid security certificate and it refuses to boot it it doesn't have one.

With SecureBoot disabled that check is simply skipped and the UEFI bios will happily load any operating system, regardless of whether or not it has a certificate.

JaQuille · Oct 28, 2024

I honestly don't know that "Secure Boot" is interfering with my ability to boot off of my old USB 2.0 flash drive or not. Because I just upgrade my motherboard to the Gigabyte mainboard. I've never successfully booted up off of this flash drive on this system. On my old ASRock mainboard it worked just fine but I wonder if my new motherboard has dropped support of booting up of a flash drive.
I'm just not sure right now.

antspants · Oct 28, 2024

I am not sure if recent updates might contribute?

Reminder: Changes to Windows Boot Manager revocations for Secure Boot effective April 9, 2024

Windows Message Center: Windows updates released July 11, 2023 and later include security measures which protect against a Secure Boot bypass vulnerability disclosed in CVE-2023-24932. Secure Boot is a Windows security feature designed to protect devices from bootkit malware. Administrators...

www.elevenforum.com

antspants · Oct 28, 2024

There are members that know far more than I do about these things, I am a noob. I am sure someone will comment.

Spunk · Oct 28, 2024

JaQuille said:
I've never successfully booted up off of this flash drive on this system

How do you try and boot off of the Flash Drive?
Start the computer and press F12 constantly. You should see a one time boot menu.
If the USB is bootable, it should be listed as one of the boot options. Select it and the computer will restart and boot off of the flash drive.
If the Linux Distro is not listed as a bootable partition, it may be because your Distros are pre UEFI Bios.

Under the Boot tab of the Bios, you have to include Legacy/CSM in addition to UEFI Bios to recognize an older Linux Distro
If you can boot to the Yumi Boot Loader, you can select the other partitions to boot from on the flash drive.

It is just easier to have a Flash Drive for each Distro you want to load

antspants · Oct 28, 2024

Has a Linux Distro on it if I read correctly.

antspants · Oct 28, 2024

JaQuille said:
I honestly don't know that "Secure Boot" is interfering with my ability to boot off of my old USB 2.0 flash drive or not. Because I just upgrade my motherboard to the Gigabyte mainboard. I've never successfully booted up off of this flash drive on this system. On my old ASRock mainboard it worked just fine but I wonder if my new motherboard has dropped support of booting up of a flash drive.
I'm just not sure right now.

Can you create the USB again, maybe has something to do with it?
Have a read of that link I posted above. Who knows?
Not sure if relevant to 23H2 or just 24H2.

antspants · Oct 28, 2024

Can you boot to another flash drive, like windows ISO or rescue media?

glasskuter · Oct 28, 2024

Here's the way I see it. Any revocations from MS do not apply at all to a system if secure boot is off. However, If any revocations were applied by MS prior to turning SB off, and then the user enables SB again, those revocations are applied during the boot process as well as any others that MS chooses to download.. In other words once any/all revocations are applied, they are permanently stored in the UEFI chip memory forever , but only come into play with the boot process when SB is on.

I'm old school. I Keep my SB off as I want no part of MS EVER applying any revocation to my machine. I turned it off the day I got my PC. I know it's a security risk but one I am willing to take. So far I have not encountered any detrimental effect from it.

Having secure boot available is a compatibility requirement for Windows10 and 11. However, one does not have to use it. Dumb way to handle a requirement.

Spunk · Oct 28, 2024

I reread the OP again and edited my post #6

antspants · Oct 28, 2024

Spunk said:
it may be because your Distros are pre UEFI Bios.

Very possibly

NavyLCDR · Oct 28, 2024

I will answer the "headline" question:

Windows 11 23H2 boots up successfully even with "Secure Boot->Disabled" in my BIOS - Is this normal?

Yes, that is completely normal. The Windows 11 for Secure Boot is only that it is available - not that it is enabled.

JaQuille · Oct 28, 2024

antspants said:
Can you boot to another flash drive, like windows ISO or rescue media?

I just tried this. Yes, it was successful. I booted up into a Windows setup environment off my 32GB USB 3.0 flash drive plugged into the exact same USB port on my mini-pc. So, maybe my old USB 2.0 flash drive is not right somehow. Although, when I load YUMI to look at the distros it shows them properly.
Both flash drives are formatted as FAT32 volumes.

JaQuille · Oct 28, 2024

Spunk said:
How do you try and boot off of the Flash Drive?
Start the computer and press F12 constantly. You should see a one time boot menu.
If the USB is bootable, it should be listed as one of the boot options. Select it and the computer will restart and boot off of the flash drive.
If the Linux Distro is not listed as a bootable partition, it may be because your Distros are pre UEFI Bios.

Under the Boot tab of the Bios, you have to include Legacy/CSM in addition to UEFI Bios to recognize an older Linux Distro
If you can boot to the Yumi Boot Loader, you can select the other partitions to boot from on the flash drive.

It is just easier to have a Flash Drive for each Distro you want to load

I'm sorry my BIOS doesn't offer this mode anywhere that I can see. My PC that I am trying to do this on is the ASUS PN-50 with Ryzen 5 4500U I believe. I do have 2 systems and I may have stated that wrong in the beginning. This failure to boot off flash (USB 2.0 only made with YUMI) is failing on the ASUS PN-50 system.
Booting up into a Windows 10/11 setup environment off a flash drive which has nothing but Windows install created with Media Creation Tool from Microsoft boots up off the USB 3.0 flash drive without issues.

XxXxX · Oct 29, 2024

in the BIOS you can set, or should be able to, the boot order so that USB is first in the boot order.
that should see YUMI boot manager and allow the boot menu to appear.

Linux Mint is based on Ubuntu which has the SB shim so will boot if SB is enabled.
best of luck, Steve ..

JaQuille · Oct 29, 2024

Spunk said:
How do you try and boot off of the Flash Drive?
Start the computer and press F12 constantly. You should see a one time boot menu.
If the USB is bootable, it should be listed as one of the boot options. Select it and the computer will restart and boot off of the flash drive.
If the Linux Distro is not listed as a bootable partition, it may be because your Distros are pre UEFI Bios.

Under the Boot tab of the Bios, you have to include Legacy/CSM in addition to UEFI Bios to recognize an older Linux Distro
If you can boot to the Yumi Boot Loader, you can select the other partitions to boot from on the flash drive.

It is just easier to have a Flash Drive for each Distro you want to load

I have a crappy non-GUI American Megatrends BIOS for this mini-PC. F2 or Delete key gets you into this crappy non-GUI BIOS. There is no F12 option to select a boot-device. It's actually doable once in the BIOS, though.
There is no option to select Legacy/CSM. Obviously my BIOS supports the UEFI BIOS since I am able to boot up off of the USB 3.0 flash drives into a Windows 10/11 install screen. I don't think this has anything to do with the USB version though since both are formatted as FAT32 volumes.

The Linux Distros on the flash drive themselves wouldn't be part of the success or failure since the YUMI customized boot menu doesn't even come up. But I think you're onto the right idea. Because I went to the YUMI website and they offer 3 different versions depending. YUMI Legacy version says this: "

BIOS USB boot only (no UEFI boot support).

"
So, if I created this flash drive using the legacy version of YUMI (and that's probably true since it's been a few years) there is no UEFI support and having UEFI support in my BIOS apparently is not sufficient in itself.

I guess I will format this flash drive (or just use a new one) and setup a new multiboot device using the YUMI UEFI utility that supports UEFI booting.

JaQuille · Oct 29, 2024

Success!!! I created a new bootable thumb drive using a version of YUMI that supports UEFI with the latest version of Linux Mint 22 with Cinnamon desktop.
The attempt was stopped because "Secure Boot" was enabled in my BIOS. I had to turn that off and then it booted up to the YUMI customized menu where I could select my Linux Mint 22 distro.
So, that's all it was in the end. Thanks for all who helped me to get this figured out.

**EDIT**:

If anyone happens to know, though, is there a way I can generate and add a key to my BIOS that tells it this customized boot device is "Safe" because I know it is. And that allows me to turn "Secure Boot" back on in the BIOS?

Why doesn't the BIOS asks ME, the owner of the PC whether or not I wanna take a risk on a boot device or not? That would seem to be the ideal situation.

hdmi · Oct 29, 2024

This article applies to Windows 10, but overall, it still applies to Windows 11: Understanding Windows 10 UEFI Secure Boot Secure Pre-Boot
The differences are the additional requirements and stricter policies of Windows 11.

Compared to Windows 10, Windows 11 has more stringent system requirements, including the need for a TPM 2.0 chip and UEFI firmware with Secure Boot capability. Besides this, there are a few other differences.

Windows 11 ensures Secure Boot is enabled by default on compatible systems, whereas Windows 10 may have Secure Boot disabled by default depending on the manufacturer's settings.
Windows 11 has stricter driver signature enforcement policies, requiring all drivers to be signed by Microsoft or a trusted authority. This is to enhance security and prevent malicious drivers from being loaded.
Windows 11 benefits from newer UEFI firmware versions that offer improved security features and better integration with Secure Boot.
While not directly related to Secure Boot, the TPM 2.0 requirement in Windows 11 complements Secure Boot by providing a more secure boot environment and protecting against firmware attacks.

hdmi · Oct 29, 2024

JaQuille said:
Why doesn't the BIOS asks ME, the owner of the PC whether or not I wanna take a risk on a boot device or not? That would seem to be the ideal situation.

It's because the human factor is always a primary threat (some would actually even argue that it is the biggest threat of them all, but I would say it depends...) and added convenience almost certainly comes at the sacrifice of security.

Windows 11 23H2 boots up successfully even with "Secure Boot->Disabled" in my BIOS - Is this normal?

Member

My Computer

Like a rolling drone.

My Computers

Member

My Computer

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computer

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

aka Mama Glass

My Computers

Well-known member

My Computer

Like a rolling drone.

My Computers

Well-known member

Windows 11 23H2 boots up successfully even with "Secure Boot->Disabled" in my BIOS - Is this normal?​

My Computers

Member

My Computer

Member

My Computer

Well-known member

My Computers

Member

My Computer

Member

My Computer

Jack of all trades – master of none

My Computers

Jack of all trades – master of none

My Computers

Similar threads

Windows 11 23H2 boots up successfully even with "Secure Boot->Disabled" in my BIOS - Is this normal?