Secure Boot and Windows 11

[kolumuani12]

Hello everyone,

I was looking if I could download windows 11 on my PC and apparently I don't have a secure boot, it seems to be a simple thing to do but first of all I wanted to make sure it will not break anything.

I have a gigabyte ga-a320m-s2h rev1.1 (first version of the motherboard) and I updated BIOS to its latest version yesterday in order to make my new CPU (ryzen 5 5500) work, does that update have anything to do with my secure boot not enabled ? Will I encounter any issues if I enable it ?

Also what are your thoughts on Windows 11, I am planning to update to it because I like to have the latest update on any program I have. I grew up with the idea that an up to date program is a secure program, don't know if it's true tho, maybe not so true. But if windows 11 is very bad I will not update it.

Thank you.

[plat]

I just installed and ran my Windows 11 drive like an hour ago to update itself so it's fresh in my mind.

Basically, people's experiences with Windows 11 run the spectrum of great to really bad. My one-year experience with it to be honest is "great"--in that it's extremely stable and runs cleanly and quietly. I just simply don't like it.

Secure boot does not hinder the system whatsoever. Unless you have a rootkit or some other funky malware, do not worry about Secure Boot messing with your system. In order to run Windows 11, I have Secure Boot enabled in Windows 10, along with my Infineon tpm chip. No problems.

No one can guarantee you Windows 11 will be perfect for you. Only you can make that determination.

[kolumuani12]

Oprindeligt skrevet af plat:

I just installed and ran my Windows 11 drive like an hour ago to update itself so it's fresh in my mind.

Basically, people's experiences with Windows 11 run the spectrum of great to really bad. My one-year experience with it to be honest is "great"--in that it's extremely stable and runs cleanly and quietly. I just simply don't like it.

Secure boot does not hinder the system whatsoever. Unless you have a rootkit or some other funky malware, do not worry about Secure Boot messing with your system. In order to run Windows 11, I have Secure Boot enabled in Windows 10, along with my Infineon tpm chip. No problems.

No one can guarantee you Windows 11 will be perfect for you. Only you can make that determination.

Ok thank you for the quick response, I just wanted to make sure I will not have to buy a new motherboard ahah

[Azza ☠]

Step 1) You have already done, update the BIOS. There was a major vulnerability update before version F54. You should be running BIOS F55b

Step 2) Reboot system and press Del repeatedly at system start to enter the BIOS

Step 3) Go to Boot section, check that "Boot Mode" is set to UEFI? If not, you will have to change it, but be careful here as the Operating System might not boot in the new mode. Save as UEFI, exit BIOS and you can try it. Any issues, just go back under the BIOS and set it back. If you need help with this step, ask before continuing.

(If it's already on UEFI mode, you can step the 2nd reboot and just set Secure Boot)

Step 4) After another reboot and ensuring the Operating System is running fine. Go back to BIOS once more, under the Boot section set "Secure Boot" to Enabled. Save and exit.

Windows 11 is ideal if your hardware supports it for security sake. It was created when Win 10 was originally meant to be the last OS and a services (using OS Builds and versions) as it was discovered possible to rootkit infect between the boot process and OS of previous versions of Windows. This means certain malware can even hide from an anti-virus scanner and the OS. Windows 11 isolates the booting process into hardware to prevent that, then an anti-virus scanner can still detect viruses over the top of that. Win 11 also can isolate memory in the same way. Offers Auto-HDR and Direct Storage, among other things. You might hate the centered start menu, but honestly it grows on you or you can manually tweak it. Other than that, it's almost the same as Win 10.

It's not worthwhile faking/bypassing it's hardware requirement. Yet your hardware should be able to support it fine.

Once secure boot is enabled, I would highly recommend using the "Windows 11 Installation Assistant" tool: https://www.microsoft.com/software-download/windows11

That will check all your hardware for compatibility support. Also any issues or dislike of Win 11, you can go under Start > Settings (Gear Icon) > System (tab) > Recovery > Go Back. It will keep all of your previous OS as a backup (until at least 10 days or drive space required).

Some might have slow down issues with games, yet that can be fixed by disabling the core isolation, if your hardware is too slow for that. Apart from that, performance will be the same, if not better. Search/Run "windows security" > Device Security > Core Isolation > Memory Integrity. If your PC runs fine with it enabled, keep it enabled for even more additional malware and anti-snoop protection.

Those Win 11 hardware isolation features reduce old malware infections by 76%, making most of them not function and able to steal data or inject as they once could on the previous OS. Ideally you would still want an anti-virus scanner on top, such as Bit Defender, MalwareBytes, or Kaspersky, but it helps a lot cover the ground level. Due to people working remotely and a major increase in ransomware around Covid lockdowns, it was critical Win 11 was created to help prevent this.

Make sure to reinstall the latest motherboard (Win 11) drivers after upgrading the OS:
https://www.gigabyte.com/Motherboard/GA-A320M-S2H-rev-1x/support#support-dl-driver

Do the same for your graphics card drivers and done!

[plat]

Pls. do not forget to enable the firmware Trusted Platform Module (TPM) v.2.0 prior to updating. That is also a requirement. There are plenty of guides on how to do this viz: your mainboard. It seems simple and straightforward enough.

[kolumuani12]

Oprindeligt skrevet af Azza ☠:

Step 1) You have already done, update the BIOS. There was a major vulnerability update before version F54. You should be running BIOS F55b

Step 2) Reboot system and press Del repeatedly at system start to enter the BIOS

Step 3) Go to Boot section, check that "Boot Mode" is set to UEFI? If not, you will have to change it, but be careful here as the Operating System might not boot in the new mode. Save as UEFI, exit BIOS and you can try it. Any issues, just go back under the BIOS and set it back. If you need help with this step, ask before continuing.

(If it's already on UEFI mode, you can step the 2nd reboot and just set Secure Boot)

Step 4) After another reboot and ensuring the Operating System is running fine. Go back to BIOS once more, under the Boot section set "Secure Boot" to Enabled. Save and exit.

Windows 11 is ideal if your hardware supports it for security sake. It was created when Win 10 was originally meant to be the last OS and a services (using OS Builds and versions) as it was discovered possible to rootkit infect between the boot process and OS of previous versions of Windows. This means certain malware can even hide from an anti-virus scanner and the OS. Windows 11 isolates the booting process into hardware to prevent that, then an anti-virus scanner can still detect viruses over the top of that. Win 11 also can isolate memory in the same way. Offers Auto-HDR and Direct Storage, among other things. You might hate the centered start menu, but honestly it grows on you or you can manually tweak it. Other than that, it's almost the same as Win 10.

It's not worthwhile faking/bypassing it's hardware requirement. Yet your hardware should be able to support it fine.

Once secure boot is enabled, I would highly recommend using the "Windows 11 Installation Assistant" tool: https://www.microsoft.com/software-download/windows11

That will check all your hardware for compatibility support. Also any issues or dislike of Win 11, you can go under Start > Settings (Gear Icon) > System (tab) > Recovery > Go Back. It will keep all of your previous OS as a backup (until at least 10 days or drive space required).

Some might have slow down issues with games, yet that can be fixed by disabling the core isolation, if your hardware is too slow for that. Apart from that, performance will be the same, if not better. Search/Run "windows security" > Device Security > Core Isolation > Memory Integrity. If your PC runs fine with it enabled, keep it enabled for even more additional malware and anti-snoop protection.

Those Win 11 hardware isolation features reduce old malware infections by 76%, making most of them not function and able to steal data or inject as they once could on the previous OS. Ideally you would still want an anti-virus scanner on top, such as Bit Defender, MalwareBytes, or Kaspersky, but it helps a lot cover the ground level. Due to people working remotely and a major increase in ransomware around Covid lockdowns, it was critical Win 11 was created to help prevent this.

Make sure to reinstall the latest motherboard (Win 11) drivers after upgrading the OS:
https://www.gigabyte.com/Motherboard/GA-A320M-S2H-rev-1x/support#support-dl-driver

Do the same for your graphics card drivers and done!

Unfortunately I can't boot on UEFI as my SSD doesn't have the right format, I need to formate it again in order to boot on UEFI :/

[kolumuani12]

Oprindeligt skrevet af plat:

Pls. do not forget to enable the firmware Trusted Platform Module (TPM) v.2.0 prior to updating. That is also a requirement. There are plenty of guides on how to do this viz: your mainboard. It seems simple and straightforward enough.

It seems to be enabled but thank you !

[Electric Cupcake]

You can bypass those restrictions on the install media, but it'll still threaten that you might be denied future updates if you proceed without TPM.

https://arstechnica.com/gadgets/2022/06/usb-installer-tool-removes-windows-11s-microsoft-account-requirements-and-more/

I'm going to stick with 10 until end-of-life and then switch completely to Linux with proton.

[Azza ☠]

Oprindeligt skrevet af Electric Cupcake:

You can bypass those restrictions on the install media, but it'll still threaten that you might be denied future updates if you proceed without TPM.

I don't recommend using any bypass, as it defeats the entire purpose of Win 11 secure boot and you might as well stick with Win 10 instead.

However, your motherboard can support TPM 2.0 and all it's features required for Win 11 anyways.

Oprindeligt skrevet af Chad:

Unfortunately I can't boot on UEFI as my SSD doesn't have the right format, I need to formate it again in order to boot on UEFI :/

This is your actual problem to address.

Is the boot mode currently on Legacy mode?

You are using Windows 10 right?
Start > run/search > type "winver" (without the quotes)

Ensure your Windows build version is at least 1703 or later. If it is, you can use a conversion tool. Close the "winver" popup box.

Right-click the Start Button > Command Prompt (admin)

Under the admin command prompt you will need to run the commands:

mbr2gpt.exe /validate
mbr2gpt.exe /convert /allowfullOS

Upon the first command it should show "Validation completed successfully", if not stop here. It's not worth risking, if it can't be verified first. Otherwise if all is well, run the next command. Wait till it's done and it should return "Conversion completed successfully". If it fails for any reason, stop here and note down the error. This will rarely fail, if it was validated first.

Note when this conversion is done completely, your old boot mode won't work and your PC will fail to boot if still on it! Don't freak.

You will need to now go under your BIOS and change the boot mode to UEFI. Save and boot.

If done correctly, you can now boot your OS under UEFI without needing to reinstall it. UEFI is more newer, secure and has more advanced features. UEFI runs in 32-bit and 64-bit, allowing support for mouse and touch navigation, so your BIOS interface can look and response better too. Ideal if you wish to upgrade to Win 11, which will be a clean install anyways.

[Electric Cupcake]

Oprindeligt skrevet af Azza ☠:

Oprindeligt skrevet af Chad:

Unfortunately I can't boot on UEFI as my SSD doesn't have the right format, I need to formate it again in order to boot on UEFI :/

Is the boot mode currently on Legacy mode?

You are using Windows 10 right?
Start > run/search > type "winver" (without the quotes)

Ensure your Windows build version is at least 1703 or later. If it is, you can use a conversion tool. Close the "winver" popup box.

Right-click the Start Button > Command Prompt (admin)

Under the admin command prompt you will need to run the command:

mbr2gpt.exe /convert /allowfullOS

Wait till it's done and it should return "Conversion completed successfully". If it fails for any reason, stop here and note down the error.

Note when this conversion is done completely, your old boot mode won't work and your PC will fail to boot if still on it!

You will need to now go under your BIOS and change the boot mode to UEFI. Save and boot.

If done correctly, you can now boot your OS under UEFI without needing to reinstall it. UEFI is more newer, secure and has more advanced features. UEFI runs in 32-bit and 64-bit, allowing support for mouse and touch navigation, so your BIOS interface can look and response better too. Ideal if you wish to upgrade to Win 11, which will be a clean install anyways.

That should be done from a USB recovery disk. Do a full backup first if you're going to try screwing with a disk's partition tables while it's mounted.

[Azza ☠]

Oprindeligt skrevet af Electric Cupcake:

Oprindeligt skrevet af Azza ☠:

Is the boot mode currently on Legacy mode?

You are using Windows 10 right?
Start > run/search > type "winver" (without the quotes)

Ensure your Windows build version is at least 1703 or later. If it is, you can use a conversion tool. Close the "winver" popup box.

Right-click the Start Button > Command Prompt (admin)

Under the admin command prompt you will need to run the command:

mbr2gpt.exe /convert /allowfullOS

Wait till it's done and it should return "Conversion completed successfully". If it fails for any reason, stop here and note down the error.

Note when this conversion is done completely, your old boot mode won't work and your PC will fail to boot if still on it!

You will need to now go under your BIOS and change the boot mode to UEFI. Save and boot.

If done correctly, you can now boot your OS under UEFI without needing to reinstall it. UEFI is more newer, secure and has more advanced features. UEFI runs in 32-bit and 64-bit, allowing support for mouse and touch navigation, so your BIOS interface can look and response better too. Ideal if you wish to upgrade to Win 11, which will be a clean install anyways.

That should be done from a USB recovery disk. Do a full backup first if you're going to try screwing with a disk's partition tables while it's mounted.

I've updated my post to provide some more safety and a check first. However, yes, be careful and consider a backup (yet the tool was designed to avoid requiring backups / reinstalls).

If this fails: mbr2gpt.exe /validate

Avoid trying it at all. It's converting your boot from MBR to GPT when you run the next command. MBR to GPT is a one-way transformation, there is no going back. 32-bit Windows 7 and Vista cannot boot from a GPT drive, it will need to be 64-bit version of Win 7 or Vista, else Win 8/8.1, 10 or 11. Linux also supports GPT.

https://www.youtube.com/watch?v=hfJep4hmg9o

This guy is like a robot, but if you need more info or any concerns clarified.

One other thing, if you have encrypted your drive or are using Bitlocker, avoid converting unless that has been disabled first!

[kolumuani12]

Oprindeligt skrevet af Azza ☠:

Oprindeligt skrevet af Electric Cupcake:

You can bypass those restrictions on the install media, but it'll still threaten that you might be denied future updates if you proceed without TPM.

I don't recommend using any bypass, as it defeats the entire purpose of Win 11 secure boot and you might as well stick with Win 10 instead.

However, your motherboard can support TPM 2.0 and all it's features required for Win 11 anyways.

Oprindeligt skrevet af Chad:

Unfortunately I can't boot on UEFI as my SSD doesn't have the right format, I need to formate it again in order to boot on UEFI :/

This is your actual problem to address.

Is the boot mode currently on Legacy mode?

You are using Windows 10 right?
Start > run/search > type "winver" (without the quotes)

Ensure your Windows build version is at least 1703 or later. If it is, you can use a conversion tool. Close the "winver" popup box.

Right-click the Start Button > Command Prompt (admin)

Under the admin command prompt you will need to run the commands:

mbr2gpt.exe /validate
mbr2gpt.exe /convert /allowfullOS

Upon the first command it should show "Validation completed successfully", if not stop here. It's not worth risking, if it can't be verified first. Otherwise if all is well, run the next command. Wait till it's done and it should return "Conversion completed successfully". If it fails for any reason, stop here and note down the error. This will rarely fail, if it was validated first.

Note when this conversion is done completely, your old boot mode won't work and your PC will fail to boot if still on it! Don't freak.

You will need to now go under your BIOS and change the boot mode to UEFI. Save and boot.

If done correctly, you can now boot your OS under UEFI without needing to reinstall it. UEFI is more newer, secure and has more advanced features. UEFI runs in 32-bit and 64-bit, allowing support for mouse and touch navigation, so your BIOS interface can look and response better too. Ideal if you wish to upgrade to Win 11, which will be a clean install anyways.

Boot mode was on UEFI mode for some reason but now I had to put it on standard mode (or something like that ?) because UEFI won't boot anymore, not on Legacy tho.

I think I am just going to change my SSD has it is too little anyway but thanks for the info ! Might use it if I need it ahah

[Agent]

Oprindeligt skrevet af plat:

I just installed and ran my Windows 11 drive like an hour ago to update itself so it's fresh in my mind.

Basically, people's experiences with Windows 11 run the spectrum of great to really bad. My one-year experience with it to be honest is "great"--in that it's extremely stable and runs cleanly and quietly. I just simply don't like it.

Secure boot does not hinder the system whatsoever. Unless you have a rootkit or some other funky malware, do not worry about Secure Boot messing with your system. In order to run Windows 11, I have Secure Boot enabled in Windows 10, along with my Infineon tpm chip. No problems.

No one can guarantee you Windows 11 will be perfect for you. Only you can make that determination.

I still seem to be getting graphical bugs and crashing on file explorer with Windows 11. Wasn't this supposed to be fixed?

[plat]

Is something called "csm support" enabled in your BIOS? This is for backward compatibility with so-called legacy devices. Changing this setting will alter other BIOS settings. For some, disabling csm will allow UEFI.

Since you've already changed some settings in your BIOS, I would not mess with the csm setting as this can change your disk's format from gpt to mbr--resulting in a non-Windows-booting computer or one that only boots into the BIOS.

When your machine is in the UEFI state, you can enable Secure Boot. When you're ready to install your new SSD, then perhaps you can alter the csm setting if needed and ensure you have UEFI (not legacy BIOS) prior to installing Windows.

https://www.partitionwizard.com/partitionmanager/csm-support-bios.html

[kolumuani12]

Oprindeligt skrevet af plat:

Is something called "csm support" enabled in your BIOS? This is for backward compatibility with so-called legacy devices. Changing this setting will alter other BIOS settings. For some, disabling csm will allow UEFI.

Since you've already changed some settings in your BIOS, I would not mess with the csm setting as this can change your disk's format from gpt to mbr--resulting in a non-Windows-booting computer or one that only boots into the BIOS.

When your machine is in the UEFI state, you can enable Secure Boot. When you're ready to install your new SSD, then perhaps you can alter the csm setting if needed and ensure you have UEFI (not legacy BIOS) prior to installing Windows.

https://www.partitionwizard.com/partitionmanager/csm-support-bios.html

Yeah you have to disable that in order to acces secure boot, but secure boot only works with UEFI boots which is not compatible with my current SSD format unfortunately.