How To Disable Uefi Secure Boot In Windows 10

To disable UEFI Secure Boot on a Windows 10 PC, restart into the UEFI firmware settings, find Secure Boot under a menu such as Security or Boot, set it to Disabled, then save and restart. The change happens in the firmware, not in Windows Security.

When disabling Secure Boot is necessary

Secure Boot checks the digital signatures of boot software against the firmware's trusted certificates before allowing it to run. This helps stop unauthorised bootloaders from starting before Windows. Turning it off removes that check, so leave it enabled unless the software or hardware you need has a specific incompatibility.

You may need to disable it temporarily to boot an unsigned recovery tool, install an operating system with an untrusted bootloader, or investigate a documented hardware compatibility problem. Installing Linux or setting up dual boot does not automatically require this change: compatible signed bootloaders can work with Secure Boot enabled, as explained in Microsoft's guide to the Windows boot process.

Check the tool or operating system's installation instructions first. For a hardware issue, look for the manufacturer's supported driver or firmware update before changing the boot configuration.

Prepare before changing firmware settings

Save your work and back up important files. Record the current Secure Boot setting so you can restore it afterwards. On a work or school computer, ask the administrator to handle settings controlled by the organisation.

If BitLocker or device encryption protects your Windows drive, make sure you can retrieve its recovery key from another device or an offline copy. Firmware changes can trigger a recovery prompt. Where available, temporarily suspend BitLocker protection before the change and resume it afterwards. Microsoft's BitLocker recovery guidance explains why suspension helps with planned firmware changes.

To find BitLocker controls where available, open Control Panel and choose System and Security, then BitLocker Drive Encryption. If you need help locating that category, see where to find System and Security in Windows 10.

Open the UEFI firmware settings

Use Windows 10 Advanced startup

1. Press Windows + I to open Settings.
2. Select Update & Security, then Recovery.
3. Under Advanced startup, select Restart now.
4. On the recovery screen, select Troubleshoot, then Advanced options.
5. Select UEFI Firmware Settings, then Restart.

You can also reach the recovery screen by holding Shift while selecting Restart from the Start menu's power options. Both routes open the same firmware interface; the recovery screen does not disable Secure Boot itself.

Use the manufacturer's startup key

If Windows will not start or UEFI Firmware Settings is missing, use the setup key specified for your computer or motherboard. Common examples include F2, Delete, F10 and Esc, but the correct key and timing depend on the model.

1. Restart the computer.
2. Press the firmware setup key as the manufacturer's logo appears.
3. If a startup menu opens, choose the firmware or BIOS setup option.

Use your model's manual to identify the setup key. If you were searching for the Windows Security button on a Lenovo ThinkPad, check Lenovo's model-specific startup instructions before treating a security button as a firmware shortcut.

Turn Secure Boot off and save the change

Once the firmware interface opens, follow these steps. Menu names vary; Microsoft's Secure Boot disabling instructions identify Security, Boot and Authentication as common locations.

1. Open the menu containing Secure Boot.
2. Select the editable Secure Boot control and change it to Disabled or Off.
3. Choose the firmware's Save Changes and Exit option, then confirm the change.
4. Allow the computer to restart.

Keep the existing UEFI boot mode. Switching to Legacy or enabling the Compatibility Support Module (CSM) is a separate change and can prevent an existing Windows installation from starting. Only alter those settings when your device manufacturer's instructions specifically require it.

Do not clear the TPM, delete Secure Boot keys or reset all firmware settings as part of this procedure. Those actions go beyond turning Secure Boot off.

Verify that Secure Boot is disabled

1. After Windows starts, press Windows + R.
2. Type msinfo32 and press Enter.
3. In System Information, select System Summary.
4. Find Secure Boot State and check that it reads Off.

System Information is also the status-checking method described in Microsoft's Secure Boot guidance. If the state still reads On, return to the firmware and confirm that your change was saved.

Resolve missing or locked settings

If Secure Boot is absent or greyed out, consult the manufacturer's instructions for your exact model. Some firmware interfaces show a read-only status separately from the editable control. A firmware administrator password or organisational restriction may also prevent changes.

If System Information shows BIOS Mode as Legacy, Secure Boot is not active for that boot mode. Do not switch modes merely to find a setting to disable. If the PC stops starting after your changes, restore the settings you recorded; if BitLocker requests recovery, use the saved key.

Re-enable Secure Boot after the task

Once the installation or troubleshooting is complete, check that the boot software you intend to keep supports Secure Boot before restoring it.

1. Return to the UEFI firmware settings, suspending BitLocker protection again if applicable.
2. Set Secure Boot to Enabled, save the change and restart.
3. Open System Information and confirm that Secure Boot State reads On.
4. Resume BitLocker protection if it remains suspended.

For related settings, browse the Windows security guides. Start by checking your current Secure Boot State in System Information before making any firmware changes.