Formatting disc and Secure Boot - new Win 10 installation.

Well so what about my mobo? Is necessary have CSM disabled for secure boot? Manual here: https://dlcdnets.asus.com/pub/ASUS/m..._ug_v2_WEB.pdf

TheOwner said:

Well so what about my mobo? Is necessary have CSM disabled for secure boot? Manual here: https://dlcdnets.asus.com/pub/ASUS/m..._ug_v2_WEB.pdf

Well on page 3-47 it says, "Microsoft Secure Boot only supports Windows UEFI Mode."



Secure Boot is strictly, 100%, a UEFI function. You cannot enable secure boot and boot in legacy BIOS or CSM mode. No motherboard will do that.

And if anybody thinks they are booting in legacy BIOS (CSM) mode with secure boot enabled, they need to run msinfo32....

So i have to set CSM to disabled right? I am still little confused...if i boot from UEFI win installer, it creates GPT partition for me even with CSM enabled, so windows will check during post both options legacy and uefi or not?

steve108 said:

Do you have a reason to keep CSM enabled (which will mean secure boot is disabled)?

CSM for compatibility if i want boot from USB (linux live CD, recovery media etc....). In this case i have to each time enable CSM. Now i have CSM enabled and my UEFI says Secure boot enabled, pk keys loaded. I am on Win 7 now MBR/legacy. You probably dont understand me. I think CSM is independend on secure boot, i can boot from UEFI even with CSM! I tried some UEFI USB linux. I just press F8 during post and i can choose legacy or UEFI boot. If i disable CSM, only UEFI are offered.

In order for secure boot to be enabled, you must boot in UEFI mode. I have never seen a BIOS that would even let you enable Secure Boot with CSM enabled. But, even if it did allow you to enable both, in order for Secure Boot to be used when booting, it must be booting in UEFI mode.

For our ThinkPad, enabling secure boot removes CSM supports (greydout): Unselectable for secure boot.

It is not all distros that support secure boot. Ubuntu's does even for a fresh install or dual boot. Arch Linux doesn't and it must be disabled, otherwise it won't boot. Also, it is not all Windows 10/11 builds that support secure boot when doing a clean install.

All dev builds support secure boot and usually the first build of a series will support it during installation. As soon as a CU(s) is added, you must disable secure boot for a clean install. Example, the first Windows 11 ISO 22000.1 supports secure boot during installation, all subsequent build numbers (CU added) won't. You will have to disable it and re-enable it after.

For all Ubuntu flavors or LTS distros, it is possible to bypass at boot secure boot momentarily for unsigned Kernels with the help of Mok Utility.This is for adventurous-enthusiast only:

Code:

sudo mokutil --disable-validation

Despite the fact that it is recommended to turn it off during the install, we tend to keep secure boot on as much as we can, except for Arch and other distros using its mainframe.

All the best,

All Windows 10/11 ISOs will support Secure Boot during/after installation as long as the USB flash drive is created properly.