What happens if I disable Secure Boot: risks, uses, and how to do it right

If you're wondering what happens when you disable Secure Boot, it's probably because you've encountered a warning when trying to boot from a USB drive containing a Linux distribution , Batocera, or another unsigned system. Don't worry: it's a very common question, and there's an explanation. Here you'll find out exactly what this feature is, when it's advisable to disable it, how to do so step by step, and what real implications it has for security, compatibility, and booting.

In addition, you'll see practical examples such as installing Linux, Batocera, or older versions of Windows , as well as what you need to know if you have Windows 11: UEFI, Secure Boot, and TPM 2.0 go hand in hand. We also review typical situations in ASUS BIOS/UEFI and how to fix the "Secure Boot Not Active" status by restoring factory keys.

What is Secure Boot and why does it exist?

Secure Boot is a UEFI firmware feature that allows the computer to run only signed and trusted software during startup , typically using keys backed by manufacturers and, on Windows PCs, by Microsoft. Its purpose is to prevent bootkits, rootkits, or modified bootloaders from loading before the operating system.

With the arrival of UEFI in the Windows 8 era, Secure Boot became a cornerstone of the boot chain . This pre-operating system control has been especially useful against persistent malware that latches onto the startup process, but it came with a consequence: if something isn't signed with the keys accepted by the firmware, it won't boot.

How does this affect Linux and other systems? For years it was a major headache , because many distributions didn't have bootloaders signed by Microsoft. Today, several distributions, such as 64-bit Ubuntu, include signed shim/GRUB and are compatible; even so, not all are, and on some machines, crashes still occur if the keys or firmware mode don't match.

There's another important point: with Windows 10, Microsoft stopped requiring manufacturers to make Secure Boot a deactivatable feature . This means that, depending on the computer, you may be able to turn it off… or you may not. It depends on your motherboard or laptop, and what the OEM has decided in its UEFI settings.

What happens if you disable Secure Boot?

First of all: disabling Secure Boot won't damage your hardware or "break" your system . It's a firmware setting. Removing Secure Boot reduces boot protection, but it doesn't make any physical changes or degrade components. The impact is on security: you lose the barrier that prevents unverified software from booting.

However, disabling it can be necessary and legitimate in several scenarios. For example, to boot unsigned systems (Batocera, some Linux distributions, diagnostic tools) or when trying to use older versions of Windows that are not compatible with Secure Boot.

This happens a lot in the real world: you try to boot Batocera from a USB drive and you get an annoying Secure Boot message. Turning off Secure Boot usually unlocks the USB drive and will allow you to try or install without that prior restriction. However, it's a good idea to re-enable it when you're finished if you're going to use Windows as your main operating system.

It's important to remember that Secure Boot doesn't replace antivirus software or good security practices . It's a boot integrity check. Disabling it doesn't automatically put you at risk, but it does create an opening that low-level malware could exploit if your computer is compromised.

When is it appropriate to keep it activated?

If you use Windows 10 or 11 as your primary operating system and don't need any alternative tools or systems, it's wise to leave Secure Boot enabled . It provides an extra layer of protection against threats that manipulate the boot process, helps stabilize the boot chain, and shouldn't interfere with your daily use.

It is also preferable to keep it active on managed or sensitive equipment (office, work, study) where the priority is to ensure the integrity of the boot process and compliance with the security requirements of the manufacturer or the organization.

How to disable Secure Boot (two ways)

The setting is in the UEFI/BIOS. You can access it from within Windows or by pressing a key at startup . The exact path varies depending on the manufacturer, but there are common patterns.

Direct access to UEFI/BIOS with a key: When you turn on your PC, press the key indicated on the startup screen. This is usually F1, F2, F12, or Esc, and on some older desktops, Delete. If the boot process is fast, try several times or enable POST delay in the settings.

From Windows (Advanced Startup): Go to Settings > Update & Security > Recovery and click Restart now under Advanced Startup. After restarting, choose Troubleshoot > Advanced options > UEFI Firmware Settings . Confirm the restart, and you will enter UEFI.

Once in the UEFI settings, locate Secure Boot. It's usually found in tabs like Security, Boot, or Authentication . Select Secure Boot and change the value from Enabled to Disabled. Save and exit (usually with F10) to apply the changes and restart.

Important note: If you use BitLocker or Device Encryption, changing boot options may require the drive to request the recovery key on the next boot. Have the key ready before making any changes to these settings and consult our boot problem diagnostics to avoid getting stuck.

Specific notes for ASUS motherboards and laptops

On many ASUS computers, you enter the UEFI by pressing F2 during startup. Then, press F7 for Advanced Mode. Look for Security > Secure Boot and enter Secure Boot Control. There you can set it to Enabled or Disabled. Save with F10 and restart for the changes to take effect.

On some ASUS desktops, the option appears as OS Type : Windows UEFI Mode (enables Secure Boot) or Other OS (disables it). If you switch between these modes, the Secure Boot status changes accordingly, so it's advisable to save and exit for the changes to take effect.

If you see "Secure Boot Not Active," enable Secure Boot and restore the factory keys . On laptops and all-in-one PCs, you can go to Key Management, select Reset to Setup Mode, and then Restore Factory Keys. On desktops, you sometimes need to set Secure Boot Mode to Custom, clear the keys, and install the default ones.

In the MyASUS interface under UEFI, the steps are very similar : enable Secure Boot Control, enter Key Management, press Reset to Setup Mode, and then Restore Factory Keys. Save changes with F10 to activate them after reboot.

How to re-enable Secure Boot

If you disabled it to install a graphics card, operating system, or tool, you can re-enable it by following the same path to the Secure Boot setting. Switch it to Enabled and save with F10.

On some devices, to reactivate it you'll need to select Custom mode and load the manufacturer's built-in keys. If you can't enable it, try resetting the UEFI to factory settings and repeat the activation process.

If the computer fails to boot after enabling Secure Boot, return to the UEFI and temporarily disable it . This usually indicates that the system you're trying to boot is not signed or that a trusted key is missing from the UEFI database. If the problem persists, see how to repair the boot process using Bootrec.

Linux, dual booting, and the Batocera case

With Linux, the situation has improved: some modern distributions support Secure Boot and boot without any modifications (for example, Ubuntu 64-bit with a signed shim). However, other distributions or unsigned tools remain locked, and that's where disabling Secure Boot makes things much easier.

Batocera, focused on retro gaming, usually boots from USB . If you see a Secure Boot message and error screen when trying to start it, disabling this feature will allow you to try or install it. This isn't unusual or bad: it simply means the bootloader isn't signed with keys that your UEFI recognizes.

Lasting consequences? There are no permanent effects on the hardware or software . It's a boot policy switch. However, remember to re-enable it if you return to your usual Windows installation and want to restore that pre-boot protection layer.

On devices where the manufacturer does not allow disabling it, consider using distributions compatible with Secure Boot or check if the OEM offers firmware updates with updated keys that add support for more bootloaders.

Windows 7: nostalgia yes, but with nuances

Many people try to install Windows 7 out of nostalgia and encounter blue screens or restarts. If you need to boot into Safe Mode , this guide can help, but disabling Secure Boot is almost essential to attempt it, because Windows 7 was designed for BIOS/Legacy and not for modern Secure Boot. However, disabling the boot lock doesn't guarantee that you'll avoid blue screens.

Why? Drivers and support . Windows 7 reached its end of support in January 2020. Modern hardware lacks native drivers (USB 3.0, NVMe, recent chipsets), which can lead to installation errors or instability. Furthermore, security is inferior and it no longer receives patches.

If you still try, you might have to enable CSM/legacy compatibility , prepare a USB drive with injected drivers, or even format the disk to MBR . None of this is recommended on a primary computer: it complicates booting and compromises modern security features.

Therefore, the reasonable recommendation is to use Windows 10 or 11. If your goal is simply to run classic software, consider a virtual machine or compatibility mode on a supported system.

Windows 11: UEFI, Secure Boot and TPM 2.0

Windows 11 requires UEFI, TPM 2.0, and Secure Boot support. After updating or resetting your BIOS, UEFI, Secure Boot, or fTPM/AMD PSP TPM may be disabled , requiring manual re-enablement. It's not uncommon for these features to be disabled by default, even in BIOS versions that support Windows 11.

Will Windows 11 boot if these features are disabled? It might boot if it was already installed , but you'll be left without the required security features and could have problems with some updates or validations. Ideally, you should re-enable UEFI (booting without CSM), Secure Boot, and TPM 2.0 in the UEFI settings.

If you switch to pure UEFI and the computer stops finding Windows, Your disk might still be in MBR format.You can convert it to GPT without formatting using the Microsoft tool mbr2gpt. First, verify it as follows: mbr2gpt /validate /disk:0 /allowfullOSIf the validation is successful, perform the conversion using the corresponding command and reboot into UEFI mode. For boot conversion and repair instructions, see how. analyze and repair the startup.

Keep in mind that enabling CSM often disables Secure Boot and may require MBR and a reinstallation. Avoid mixing CSM with Windows 11: rely on UEFI, GPT, and TPM to maintain compatibility and security.

BitLocker and other warnings when touching the UEFI

If your disk is encrypted, modifying boot options may trigger the BitLocker or Device Encryption recovery screen . Make sure you have your key located in your Microsoft account or on the corporate portal before making any changes.

Some manufacturers update the trusted key base with new firmware versions. Keep your UEFI up to date to expand compatibility and reduce Secure Boot warnings with legitimate, signed software.

Solution: Secure Boot appears as Not Active

If you see the status "Not active" even though it's enabled, restore the Secure Boot keys from the UEFI. The typical procedure is to go to Security > Secure Boot > Key Management and use "Reset to Setup Mode" followed by "Restore Factory Keys." Save and restart.

On a desktop with advanced options, use Custom mode to clear and install the default keys : Clear Secure Boot Keys and then Install Default Secure Boot Keys. After that, revert to Standard mode if available, enable Secure Boot, and save the changes.

What if I can't find the option or it won't let me disable it?

As we mentioned, some devices don't display the switch to disable Secure Boot or hide it depending on the firmware mode. Try switching between Simple/Advanced modes (F7 on many ASUS devices) and check Security/Boot/Authentication.

If it doesn't appear at all, the manufacturer may have blocked it . In that case, you'll only be able to use compatible systems signed with the keys present; contact OEM support to confirm if there's an alternative firmware that allows it.

Compatibility with graphics cards and other devices

There are scenarios where installing certain GPUs or hardware can temporarily disable Secure Boot . If your computer doesn't boot with Secure Boot enabled after the change, try disabling it, installing the device, and then re-enabling it to see if everything works.

Keep in mind that some third-party diagnostic or installation utilities are also unsigned and will be blocked by Secure Boot. Booting from USB with these tools usually requires temporarily disabling Secure Boot.

Good practices to avoid confusion

Before touching anything, note the current state of UEFI/CSM, Secure Boot, and TPM . Take photos of the configuration with your phone if necessary; this will help you revert changes if something doesn't go as planned.

If your goal is to dual-boot with Linux, start with a distribution that supports Secure Boot and only disable it if absolutely necessary. This reduces conflicts with Windows 10/11 and prevents you from losing pre-boot protection.

When the Secure Boot status doesn't match what you see, restoring keys is usually the solution . And remember to save changes with F10 or from the Save and Exit menu so that UEFI applies the new policy.