disabling secure boot

Hello
These are the instructions I received from the engineers at Asus regarding disabling secure boot. I can do so by clearing keys but that is not advised. I want to use various Linux distros which require that secure boot be disabled. My new board is Asus Tuf z390 Gaming Plus Wifi.
Their directions below did not disable secure boot either. If you have any ideas I would appreciate them. The builder said he felt enabling CSM as Asus did should have disabled secure boot too.

>>BIOS -> Boot -> CSM (Compatibility Support Module) -> Launch CSM -> Enabled

1. Boot mode -> UEFI and Legacy
2. Boot from Network -> Legacy (old drives); or UEFI mode (for NVME/SSD drives)
3. Boot from Storage -> Legacy (old drives); or UEFI mode (for NVME/SSD drives)
4. Boot from PCIE/PCI -> Legacy (old drives); or UEFI mode (for NVME/SSD drives)
5. Go back to Boot -> Secure Boot -> OS Type -> Windows UEFI Mode (Windows 10/8.1/8) and Other OS (for Windows 7)<<

Why are you worried about Secure Boot? It should already be disabled. You can check this in Windows by going to Run, and typing "msinfo" (without quotes). When the System Information panel comes up, look to the right pane for Secure Boot state. If Secure Boot is on, it'll say on. If not it'll say unsupported or something to that effect - How to Check if Secure Boot Is Enabled on Your PC

The simplest way to disable Secure Boot is the go into the BIOS and look for Secure Boot. Disable. Go to CSM. Enable. Save and exit. Done.

Anyway be aware Secure Boot is disabled by default on new boards, so if you got a new Asus motherboard, there's a 99.999.999 percent chance Secure Boot is disabled. It's also disabled by default because it requires CSM to be disabled as well. CSM by default is enabled to insure your graphics card works out the box. The reason for that is because not all cards are UEFI compatible and if CSM was disabled by default, you could run into issues with non-UEFI based cards. And to get it working require a number of BIOS tweaks. Keeping things simple.

Bottom line is Secure Boot should be disabled by default on all new boards. It is enabled by default by most laptop manufactures for security reasons, and could be enabled by a PC vendor if they chose to do so. Outside of that, if you bought a new motherboard, it should be disabled.

Sorry for the long post, just needed you to understand somethings.

To see the status of secure boot before or after making changes you can check by
a) launching msinfo32 > example: Secure Boot State Off
b) running a powershell command:
Confirm-SecureBootUEFI

I started this thread so I thought it appropriate that I give what I think is the answer because I did lean on quite a few people and the thread was quite extensive. In order to disable boot on z 390 ASUS motherboard on my TUF Gaming Plus Wi-Fi set one has to go to firmware> Advanced. From advanced to secure boot and change secure boot mode from UEFI to other, exit and save changes. This disables secure boot. To enable it, the reverse is done. It can be verified through either system information or Security >Device. I hope this helps someone who follows me with this issue who wishes to use some Linux distros.
Unfortunately, ASUS, and the builder did not provide the correct fix nor did any forums I tried including the ASUS forum.

Hi,
Interesting to disable secure boot all that is needed is to manage secure boot keys and delete secure boot keys.

Other meaning OS type to Other OS instead of uefi mode or eufi only ?

sygnus21 said:

Why are you worried about Secure Boot? It should already be disabled. You can check this in Windows by going to Run, and typing "msinfo" (without quotes). When the System Information panel comes up, look to the right pane for Secure Boot state. If Secure Boot is on, it'll say on. If not it'll say unsupported or something to that effect - How to Check if Secure Boot Is Enabled on Your PC

The simplest way to disable Secure Boot is the go into the BIOS and look for Secure Boot. Disable. Go to CSM. Enable. Save and exit. Done.

Anyway be aware Secure Boot is disabled by default on new boards, so if you got a new Asus motherboard, there's a 99.999.999 percent chance Secure Boot is disabled. It's also disabled by default because it requires CSM to be disabled as well. CSM by default is enabled to insure your graphics card works out the box. The reason for that is because not all cards are UEFI compatible and if CSM was disabled by default, you could run into issues with non-UEFI based cards. And to get it working require a number of BIOS tweaks. Keeping things simple.
Bottom line is Secure Boot should be disabled by default on all new boards. It is enabled by default by most laptop manufactures for security reasons, and could be enabled by a PC vendor if they chose to do so. Outside of that, if you bought a new motherboard, it should be disabled.
Sorry for the long post, just needed you to understand somethings.

Hi,
CMS enabled secure boot is still enabled too.

CMS enabled does not disable secure boot on this board but thanks. The builder was surprised too.

Hi,
Maybe CMS disabled that kills all legacy os installing win-7... but still secure boot is a totally different feature
I believe the exact wording is Clear secure boot keys. before secure boot is and shows as disabled.