What Is Secure Boot and When Should You Turn It Off
Specific cases (installing Linux, old hardware), not a setting to touch routinely.
Secure Boot is a UEFI security feature almost nobody touches — and in most cases, you shouldn't have to.
Simple explanation
Secure Boot checks that the operating system you're starting has a verified digital "signature" before letting it start up. This stops malicious software from loading at the earliest stages of boot, even before Windows (or any antivirus) has a chance to detect it.
When is it worth leaving it on?
Almost always. It's real protection, turned on by default on practically every modern machine, and it doesn't interfere with normal Windows use.
The specific cases where you do need to turn it off
- Installing certain Linux distributions that don't have a compatible signature — though the most popular ones (Ubuntu, Fedora) usually work fine with Secure Boot on.
- Using very old hardware whose driver isn't digitally signed.
- Booting from an installation USB that won't start with Secure Boot active — also mentioned in our guide on dual booting Linux and Windows.
Warning: turning off Secure Boot permanently "just in case" reduces your machine's protection with no real need. Turn it back on as soon as you finish the specific task that required it.
How to turn it off (and back on)
Enter the BIOS/UEFI (usually Delete or F2
on power-on) → look for the "Security" or "Boot" tab → find "Secure
Boot" → switch between "Enabled" and "Disabled". The exact location
varies by motherboard or laptop manufacturer.
Note: BitLocker (Windows' disk encryption) may ask for the recovery key if you turn off Secure Boot on a machine that already had the disk encrypted — that's expected security behaviour, not an error.
Frequently asked questions
Do I need to turn off Secure Boot to install Linux?
Not always — the most popular distributions (Ubuntu, Fedora, Linux Mint) usually work fine with Secure Boot on. Only turn it off if the specific installer doesn't manage to start with it active.
Does turning off Secure Boot make my PC vulnerable right away?
Not immediately, but it does reduce a real layer of protection against malware that acts at the earliest stages of boot. It's recommended to turn it back on as soon as you finish the task that required turning it off.
Why does it ask for my BitLocker key when I touch Secure Boot?
If your disk is encrypted with BitLocker, changing the Secure Boot setting can trigger a security check that asks for the recovery key, as a protection measure against changes to the system's boot process.