Unable to enable Secure Boot

[tapioca2]

I am trying to make my laptop upgrade-able to Win 11.  But it is complaining about not having Secure Boot enable.  I believe this is related to UEFI.  

I have the latest BIOS from 2023.  I do not see the "Secure Boot Configuration" option as shown in the "Secure Boot setting in the Commercial notebook and workstation" https://support.hp.com/us-en/document/ish_6930187-6931079-16  So I can't set it.

I have also tried to follow this https://support.microsoft.com/en-us/windows/windows-11-and-secure-boot-a8ff1202-c0d9-42f5-940f-843ab...  on the Windows 10 and gone to the Settings > Update & Security > Recovery and select Restart now under Advanced startup and then Troubleshoot > Advanced options > UEFI Firmware Settings.  But I do not see the UEFI Firmware settings either.

I do have TPM 2.0 because I don't see the complaint from PC Health.  It is also saying my CPU doesn't qualified.  This also doesn't make sense.  It's an i7 with 2.8 GHz.   If this can't do Windows 11, I don't know what can.

Any assistance is appreciated.

[Paul_Tikkanen]

Run the Windows System information report.

Look at the BIOS Mode line.

In order to enable secure boot the BIOS Mode must indicate UEFI.

If it indicates Legacy, you cannot enable secure boot unless you reinstall W10 by booting from the EFI USB boot source,

If the BIOS Mode indicates UEFI, see if this works:

Step 1. Go into the BIOS and Load HP Factory Default Keys and see if Secure Boot becomes available.

Step 2. If it does not than go into the operating system and disable “Fast Boot” (Steps below).

How to Disable Windows 10 Fast Startup (lifewire.com)

Step 3. go back into your BIOS and try to the Load HP Factory Default Keys setting again

Step 4. enable Secure Boot at this point.

Refer to this document, page 34 for the location of the secure boot setting.

It would be under the Advanced menu in the BIOS.

c06399361.pdf (hp.com)

Also, even with TPM 2.0 and secure boot enabled, your notebook still does not meet Microsoft's minimum processor requirements of an Intel 8th generation core processor or newer.

If you are interested in installing W11 on your PC as is, you can read this discussion for how I upgraded several HP and Dell notebook and desktop PC's that did not meet the W11 hardware requirements to W11 22H2/22H3.

You have to use the version of the Rufus utility that I zipped up and attached in the discussion (v3.18).

Re: Issues upgrading to windows 11 - HP Support Community - 8517912

If the in-place upgrade fails, you should be able to clean install W11 using the bootable W11 installation flash drive you made with Rufus.

[tapioca2]

Thanks, Paul.

The BIOS mode indicated Legacy.  😕

How do I do a clean W11 installation?  Will it stop me from installing W11 due to it not being qualified?

Will this https://www.youtube.com/watch?v=02mgrA51974   work?  Is it going to use UEFI or still use Legacy with W11?

MS asking for 8th gen processor makes no sense at all.  Unless it is telling people that W11 is a horrible OS that requires super fast CPU in order to work.   There will be literally billions of PC and laptop out there that will not meet that CPU requirements. 

[Paul_Tikkanen]

You're very welcome.

If your PC is one of those with an Intel 7th gen core processor, it will not get support from Microsoft to automatically get the upgrade to W11.

But if your G2 has an Intel 8th gen core processor, if you install Windows in UEFI mode, you will be able to turn Secure boot on and update to W11 with no problem.

To clean install Windows in UEFI mode so you can enable secure boot, you boot the Windows installation media from the EFI USB flash drive, not the legacy one.

I think the method I used to update to W11 is easier than the one in the video.

If you want to enable secure boot you will have to clean install W11.

Just make the bootable USB W11 installation flash drive with Rufus v3.18.

My take on why Microsoft did this was because they didn't want to open the floodgates for anyone that was running a PC with W10 to be able to upgrade to W11 because they would be required to provide support for old PC's.

I think they regretted allowing any PC that was running W7 to upgrade to W10.

So, they drew a line at some point...Intel 8th gen core processors and newer, AMD Ryzen 2700 processors and newer.

Now look at the huge amount of older PC's that they don't have to support.

For example, I am running W11 Pro on an ancient HP 6910p notebook with an Intel Pentium T7500 processor.

It runs W11 just fine. Just as good as it ran W10, if not better.

Microsoft doesn't want to have to provide support to me for such an old PC, and now they don't have to.

That's my 2 cents.

[tapioca2]

Mine is i7 7th gen.  This means that doesn't matter if I use UEFI to clean install W11 or not, it won't get automatic updates anyway?  Will I be able to get updates manually or will it still won't let me?

For the clean W11 install, I can just use the Rufus that you mentioned and it will do it with Secure Boot?

[Paul_Tikkanen]

OK, so here's your options:

Make the bootable W11 installation flash drive with Rufus v3.18 following the guidance I posted in that discussion.

If you want to do an in-place upgrade as is, after Rufus creates the drive, open it in Windows explorer and double-click on the setup application to upgrade to W11.

If you want the secure boot option enabled you will need to clean install W11 using the bootable Rufus flash drive you created and boot it from the (U)EFI USB flash drive, not the legacy one.

Your PC will get every cumulative and security update and the almost daily Windows defender antivirus definitions, just like a fully qualified W11 PC would get.

What it will not get is the next feature update to W11 (which would be 24H2).

So, what you need to do is to use the trusty Rufus utility to make a bootable W11 24H2 installation flash drive when the ISO file is available for download (probably in late October - early November), and you can do an in-place upgrade to the next version of W11.

A once-a-year drill.   Not a big deal.

[tapioca2]

For the second option, how do one "boot it from the (U) EFI USB flash drive, not the legacy one."?    I have to use Rufus to create an EFI USB flash drive?  Anything I need to do to the laptop before I do this?  Sorry, I am a newbie to this UEFI thing like most people.

[Paul_Tikkanen · Accepted solution]

Yes, you have to use Rufus v3.18 that I attached in that discussion, (reposted below).

Re: Issues upgrading to windows 11 - HP Support Community - 8517912

Set it up exactly as you see it in my first screenshot.

To boot from the (U)EFI flash drive, have it plugged into the notebook's USB port.

Turn on or restart the PC.

Immediately tap the ESC key to get the menu of options.

Select the F9 boot options menu.

In that menu there should be two lists of bootable devices (U)EFI and legacy.

The Rufus-created flash drive should be showing up under the (U)EFI boot options list.

Select it and press the Enter key and the notebook should boot from the USB flash drive and install W11.