39 replies to this topic

[Peter1]

finally

[Peter1]

I just got a note from Asus which seems to contradict hat I have been taught by them. I thought I was supposed to clear keys then disable secure boot to boot off a pen drive not compatible. They just wrote and said never clear keys. I think they were referring to a compatible and said - secure boot >instead of UEFI place other >pen drive and boot from there. That could lead to the loop Rich referred to wouldn't it?

 

I thought we resolved this by:

Compatible = F8

Not compatible- clear keys disable secure boot and boot of the pendrive .

 

 

 

This is their quote= If having the USB in the spot one does not work, we would suggest pressing the F8 key and choose the USB stick to boot to Linux.

The only time to clear the keys is when the key is compromised. We suggest to clear the keys and create new one to ensure to protect the system against malicious code being loaded and executed early in the boot process. Just make sure to set Secure Boot --> OS Type --> Other OS and boot the Linux USB drive. 

Edited by Peter1, 08 May 2019 - 11:48 AM.

[Ztruker]

That last part makes a lot more sense to me. Use the one time boot menu key (F8 for you) if you need to boot from other than a HDD (or SSD) which should be your default boot device or boot from a device that is not secure boot or UEFI  compatible.

 

Clear keys if there is a problem with them makes sense though I've never seen the option before, must be available on newer board.

[Peter1]

@ Rich & Tom

 

 

Rich, I know Tom had a question about placement of the pen drive in boot order. Every article or video I have watched shows the stick in # 1 position too.

I know you mentioned the chance of a boot loop this way. I can actually just tap the stick regardless of its position and it boots as it should when using F8 before POST.  That is either new or odd.

 

I thought you would find this link interesting as it does what one tech told me to do to disable secure boot. I know of no other way as that selection does not appear in my BIOS.  Another tech said to never clear keys unless there is corruption.

 

 

This just for learnings sake as I boot of off F8 successfully. I cannot find a way to disable secure boot if necessary and don't like clearing keys for incompatible sticks. So enjoy.

 

Different boards!!

[Ztruker]

Interesting, but what a terrible design. What is wrong with a Enable/Disable Secure boot selection like other UEFI systems have. It's clear and easy to understand.

 

Oh well, hopefully you'll never need to mess with it.

[Peter1]

If someone comes across a way to disable secure boot without clearing keys, or if I do, it would be nice to have it posted here. Not holding breath though.

My board is Asus TUF Plus z390 Gaming WIFI but a similar newer board might suffice.

I will ask elsewhere although we should not double post s I need advertising on this one.

[Peter1]

@ Rich I wrote to the builder and here is my email and his reply.  He seems not to know what to do. Also I have an attachment of the point at which he directed me to disable secure boot with four drop downs choices.

What is your take on his reply?

 

On Sat, May 18, 2019 at 7:32 AM Peter Nowell <prime26@live.com> wrote:

Sorry to bother on weekend but I wanted to show you the attachment you would find interesting so when I come up next week with the machine you would have had something to think about. 

As you can see when in boot mode,  and when you click on enable CSM,  there are drop downs to set up.

 

Obviously, at my level,  I have no idea what to do.  Also  there is a big white box message/warning  about Windows which means nothing to me. It occurs when you return to the original CSM with no changes made.

 

I assume the goal of enabling CSM is to disable secure keys so I can boot off of a non compatible stick without having to clear keys.

 

I think when you have the pc in your hands you will have a better idea what to do.

 

>>

Peter,

So basically, CSM just allows you to boot into any bootable usb devices, where uefi with secure boot enabled will only allow the certain uefi boot that works with the secure boot list. unless you have no idea where you are getting the bootable stick from or if it is legit you are going to be ok with booting it from csm. most old o/s or custom o/s will not support secure boot. for example, windows 7 doesn't work with uefi. so hence why they are calling it legacy boot. I can boot with windows 10 usb with secure boot enabled without any problem, since it pass the test. we will chat when you are here, and see why you are going through all these problems.

Secure boot is a security standard developed by members of the PC industry to help make sure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM). When the PC starts, the firmware checks the signature of each piece of boot software, including UEFI firmware drivers (also known as Option ROMs), EFI applications, and the operating system. If the signatures are valid, the PC boots, and the firmware gives control to the operating system.

The OEM can use instructions from the firmware manufacturer to create Secure boot keys and to store them in the PC firmware. When you add UEFI drivers, you'll also need to make sure these are signed and included in the Secure Boot database.

 

 

Attached Thumbnails

• 

[Ztruker]

Sorry Peter, this is all getting old.

 

You've been beating on it for a month or more but I don't understand what you are trying to accomplish.

You have perfectly good Windows 10 installation USB flash drives and know how to create more if needed. What else do you need? Why the hang up on enabling/disabling secure boot?

 

To test this you need to find something that requires you to disable secure boot. I don't know what that would be. Until you have that there is no point in continuing to beat your head against the invisible wall. Once you have that then you can try things and see what the results are.

[Peter1]

I have sticks I used to use like Zorin. I would like to continue that but some sticks I used to use are not signed.

When one buys a new pc they want to be sure it has the features they paid for and most new pcs have a simple disable secure boot feature.Once I have been shown the finish Wednesday, this will be over. I do agree it appears obsessive on the surface but if one's pc coud not disable secure boot they too would try to find out why. Believe me I am not the only Asus  complainer re: this weird board.  Post # 37 shows that even at the end, multiple choices are to be made. The average user cannot just guess at it and cause a problem. I could have  taken the ez way out and dropped everything months ago, and maybe I should have not kept posting, but I concluded I owed it to myself to see it through  and will be glad when I do. I apologize for burning up the forum with the posts; it won't happen again. I did notice a post by Tom where the position of the stick being booted was in question so some little good came out of the pursuit. 

The builder is walking me through the disabling of secure boot on Wednesday. He too was puzzled by this board that is why his answers were like clues and not real answers.  I shall always be appreciative of your help and have learned a lesson in protocol.. Peace.

[Peter1]

I started this thread so I thought it appropriate that I give what I think is the answer because I did lean on quite a few people and the thread was quite extensive. In order to disable boot on z 390 ASUS motherboard on my TUF Gaming Plus Wi-Fi set one has to go to firmware> Advanced. From advanced to secure boot and change secure boot mode from UEFI to other, exit and save changes. This disables secure boot. To enable it, the reverse is done. It can be verified through either system information or Security >Device.  I hope this helps someone who follows me with this issue who wishes to use some Linux distros.

Unfortunately, ASUS, and the builder did not provide the correct fix nor did any forums I tried including the ASUS forum.