How To Enable Secure Boot.

In this article, I am gonna show you how to enable secure boot.

What is legacy boot mode?

With newer Windows 8 PCs designed with UEFI support, the BIOS or firmware often has an option that specifies if the computer can boot into regular operating systems and recovery tools or boot exclusively into newer UEFI operating systems and environments. The regular way of booting into software and operating systems is called “Legacy Boot” and must sometimes be explicitly enabled/allowed in the BIOS settings. Legacy boot mode does not normally support partitions greater than 2TB in size and can cause data loss or other problems if you use it normally.

What is UEFI boot mode?

UEFI stands for Unified Extensible Firmware Interface. It does the same job as a BIOS, but with one basic difference: it stores all data about initialization and startup in a .efi file instead of storing it on the firmware.

This .efi file is stored on a special partition called EFI System Partition (ESP) on the hard disk. This ESP partition also contains the bootloader.

UEFI was designed to overcome many limitations of the old BIOS, including:

UEFI supports drive sizes upto 9 zettabytes, whereas BIOS only supports 2.2 terabytes.
UEFI provides faster boot time.
UEFI has discrete driver support, while BIOS drives support is stored in its ROM, so updating BIOS firmware is difficult.
UEFI offers security like "Secure Boot," which prevents the computer from booting from unauthorized/unsigned applications. This helps in preventing rootkits but also hampers dual-booting, as it treats other OS as unsigned applications. Currently, only Windows and Ubuntu have signed OS (let me know if I am wrong).
UEFI runs in 32bit or 64bit mode, whereas BIOS runs in 16bit mode. So UEFI can provide a GUI (navigation with the mouse) instead of BIOS, which allows navigation only using the keyboard.

What is Secure boot?

As the name says, Secure Boot is meant to safeguard to boot process when you start your computer; it’s found on newer PCs that come loaded with UEFI firmware. Secure Boot’s job is to prevent unsigned UEFI drivers and bootloaders from loading during the startup process.

How to Enable Secure Boot?

First, take note of the make and model of the machine that you are going to prepare. Many manufacturers update their device’s UEFI support and update the system settings menu choices with firmware updates, so consider updating to the latest version.
Boot into the system settings by powering the system and using the manufacturer’s method to access the system settings. On an HP device, this is often F10, and for a Dell, it is F2.
Navigate the menu and select UEFI as the boot mode. Many menus present UEFI and Legacy as the choices; others may offer UEFI and BIOS. Some devices may offer three choices, UEFI native, UEFI hybrid (or UEFI + CSM), and Legacy. In each case, choose UEFI or UEFI native. You may also have an option to disable legacy boot methods, and this is recommended.

Next, please navigate to the Secure Boot option and turn it on. You must first reboot on some devices after enabling UEFI and return to the settings menu to enable Secure Boot.
Enable the secure boot
Save the changes and exit the menu. You can now boot to media that supports Secure Boot.

Note: You cannot enable secure boot if you are using the legacy boot.