Secure Boot, board by board

Where the setting hides on each brand, and what to do with it for your build.

On this page

Which setting you need
Read this first
Find your board
If the option is missing

Which setting you need

Both load methods care about Secure Boot, but they want different things from it. Find your method in this table, then use the matching steps under your board below.

Build	What to do	End state
Standard build	Turn Secure Boot off entirely.	Secure Boot State reads Off and stays off.
Intel Edition	Clear its key databases, leaving them empty.	Firmware sits in Setup Mode until the loader enrols its own keys.

Do not mix these up

These are not interchangeable. Simply switching Secure Boot off does not empty the key databases, so the Intel Edition will still stop with Please clear secure boot keys. Clearing the keys when you only needed Secure Boot off leaves your firmware in Setup Mode for no reason. If you are unsure which method you are aiming for, check the requirements page first.

Read this first

Suspend BitLocker, or have your recovery key ready. Both changes affect the boot configuration.
Menu names move between BIOS versions. If a label below does not match exactly, look for the closest wording on the same screen.
Never pick Restore Factory Keys, Install Default Keys or anything similar. That is the opposite of clearing them.
Write down what you change, so you can put it back if you switch builds later.

Find your board

Pick your motherboard or laptop brand. If yours is not listed, the last entry covers generic AMI, Insyde and Phoenix firmware, which is what most other boards use.

ASUS ROG, TUF Gaming, PRIME, ProArt

Press Delete (or F2) repeatedly as the machine powers on, then F7 for Advanced Mode. Secure Boot lives under the Boot tab.

Standard build Turn it off

1

Go to Boot, then Secure Boot.
2

Set OS Type to Other OS. On ASUS boards this is what disables enforcement.
3

Press F10 to save and exit.

Intel Edition Clear the keys

1

Go to Boot, then Secure Boot, and leave OS Type on Windows UEFI mode.
2

Open Key Management.
3

Select Clear Secure Boot Keys and confirm.
4

Go back one screen. Secure Boot State should now read Setup Mode.
5

Press F10 to save and exit.

MSI Click BIOS 5 and 6, MEG, MPG, MAG, PRO

Press Delete repeatedly as the machine powers on, then F7 for Advanced Mode. Look under Settings, then Advanced, then Windows OS Configuration. On some boards it is Settings, then Security.

Standard build Turn it off

1

Open Secure Boot.
2

Set Secure Boot Support to Disabled.
3

Press F10 to save and exit.

Intel Edition Clear the keys

1

Open Secure Boot.
2

Set Secure Boot Support to Enabled and Secure Boot Mode to Custom.
3

Open Key Management.
4

Select Delete all Secure Boot variables. Older BIOS versions call it Reset to Setup Mode.
5

System Mode at the top of the page should now read Setup.
6

Press F10 to save and exit.

Gigabyte AORUS, UD, Gaming X

Press Delete repeatedly as the machine powers on. Press F2 if you land on Easy Mode. Secure Boot is under the Boot tab, or Settings then Boot on newer versions.

Standard build Turn it off

1

Open Secure Boot.
2

Set Secure Boot Enable to Disabled.
3

Press F10 to save and exit.

Intel Edition Clear the keys

1

Make sure CSM Support is Disabled, then open Secure Boot.
2

Set Secure Boot Enable to Enabled and Secure Boot Mode to Custom.
3

Open Key Management.
4

Select Reset To Setup Mode. Older versions call it Clear Secure Boot Keys.
5

Press F10 to save and exit.

ASRock Taichi, Steel Legend, Phantom Gaming

Press F2 or Delete repeatedly as the machine powers on, then switch to Advanced Mode. Secure Boot is under the Security tab.

Standard build Turn it off

1

Open Secure Boot.
2

Set Secure Boot to Disabled.
3

Press F10 to save and exit.

Intel Edition Clear the keys

1

Open Secure Boot.
2

Set Secure Boot to Enabled and Secure Boot Mode to Custom.
3

Open Key Management.
4

Select Clear Secure Boot Keys. Some versions list it as Reset to Setup Mode.
5

Press F10 to save and exit.

Dell XPS, Alienware, Inspiron, OptiPlex

Press F2 repeatedly as the machine powers on. Secure Boot has its own top-level entry in the settings list.

Standard build Turn it off

1

Open Secure Boot, then Secure Boot Enable.
2

Untick Secure Boot Enable.
3

Choose Apply Changes, then Exit.

Intel Edition Clear the keys

1

Open Secure Boot and set Enable Secure Boot to On.
2

Open Expert Key Management and tick Enable Custom Mode.
3

Under Custom Mode Key Management, select PK and choose Delete, then repeat for KEK, db and dbx.
4

Choose Apply Changes, then Exit.

HP OMEN, Victus, Pavilion, EliteDesk

Press Escape repeatedly as the machine powers on, then F10 for BIOS Setup. Look under Security, then Secure Boot Configuration, and accept the warning screen if one appears.

Standard build Turn it off

1

Set Secure Boot to Disable.
2

Press F10 to save. You may be asked to type a four-digit code shown on screen.

Intel Edition Clear the keys

1

Set Secure Boot to Enable and Legacy Support to Disable.
2

Select Clear Secure Boot keys and confirm.
3

Press F10 to save. You may be asked to type a four-digit code shown on screen.

Lenovo Legion, ThinkPad, IdeaPad, ThinkCentre

Press F1 or F2 repeatedly as the machine powers on. On Legion and IdeaPad models you can also use the Novo button. Secure Boot is under the Security tab.

Standard build Turn it off

1

Open Secure Boot.
2

Set Secure Boot to Disabled.
3

Press F10 to save and exit.

Intel Edition Clear the keys

1

Open Secure Boot and set it to Enabled.
2

Select Reset to Setup Mode and confirm. Some models call it Clear All Secure Boot Keys.
3

Press F10 to save and exit.

Several Lenovo laptops hide these options until a supervisor password is set. Set one under Security, then Password, and remember it.

Another brand AMI Aptio, Insyde H2O, Phoenix and anything else

Enter your BIOS. The key is usually Delete, F2, F10 or Escape, and it is shown for a second on the first boot screen. Secure Boot sits under a tab named Security, Boot or Authentication.

Standard build Turn it off

1

Find the Secure Boot entry and set it to Disabled.
2

If it is greyed out, look for a Supervisor or Administrator password option and set one first, then try again.
3

Save and exit, usually with F10.

Intel Edition Clear the keys

1

Set Secure Boot to Enabled, and Secure Boot Mode to Custom if that option exists.
2

Open the sub-menu named Key Management, Expert Key Management or Secure Boot Keys.
3

Choose the entry that mentions Setup Mode, Clear or Delete all, for example Reset to Setup Mode or Delete all Secure Boot variables. Do not choose anything that mentions Restore, Install or Factory Keys, which does the opposite.
4

Save and exit, usually with F10.

If none of that is there, your firmware may not expose these settings at all. See the last section of this page.

If the option is missing

Some prebuilt and laptop firmware hides these settings. Work through these before giving up:

1

Switch the BIOS to its advanced or expert view. Many vendors hide Secure Boot in the basic view.
2

Set a supervisor or administrator password under the Security tab, save, reboot and look again. Lenovo, HP and several OEM boards unlock key management only once one exists.
3

Update your BIOS to the latest version from the vendor. Key management is often added in later releases.
4

Check for a separate OEM or manufacturing mode toggle that hides advanced menus.

If none of that exposes it, your firmware genuinely does not support what you need. On the Intel Edition that is a dead end, and the standard build is the way forward. Post your exact model on Discord and we will tell you whether anyone has got it working.

Previous Prepare Windows for the standard build Next Download and install the loader

This page did not solve it? Ask our staff on Discord.