Windows 8 Secureboot: How do you bootup from another device such as cd/dvd drive or usb flash etc.?

Question

On PC's and laptops running an older OS, this is just a simple matter of going into the BIOS and setting the boot sequence and putting the boot cd/dvd in the drive. In many cases you can even just hit one of the F* function keys to bring up the boot sequence menu on-the-fly during POST.

The main problem I'm running into is that other devices besides the primary HD is disabled when SecureBoot is enabled. So far the only way I've gotten it to work is to disable SecureBoot and enable something called legacy mode.

Needless to say this make it difficult to boot things like OS recovery tools, PartitionHD backups, Linux LiveCD's and a bunch of others. Is there another procedure for doing this since it seems to mess up the Windows 8 install? By mess up I mean that after re-enabling SecureBoot and starting Windows 8 normally, the OS goes into a 'preping repair phase' for some reason that takes forever to complete before getting into a usable desktop.

Answer 1

At the moment the only way to boot non-Secure-Boot media I know of is what you've discovered: Disable Secure Boot. You could just leave it disabled, but of course that slightly increases your vulnerability to security threats. (I don't happen to know offhand how many existing pieces of malware might be stopped by Secure Boot. The current threat could be anywhere from nonexistent to significant for all I know, but of course there's the potential for significant future threats.)

In the future the situation should improve, since Microsoft is allowing third parties to sign their boot loaders via Verisign. Thus, future tools should be capable of booting with Secure Boot enabled. Fedora plans to have Fedora 18 bootable in this way, for instance. Also, the Linux Foundation has announced what it calls a pre-bootloader, which is a signed EFI boot loader that will enable disabling Secure Boot on a boot-by-boot basis. This isn't yet available, though, and as a practical matter it would require integration into the boot medium you want to use, so it might not be of much practical help unless you're prepared to modify the media you want to boot.

One more point: I don't know why Windows 8 is entering that "repair phase" that you mention. It might not be related to Secure Boot at all; in fact, I suspect not. Windows 8 employs a quick shutdown feature that doesn't play well with other OSes. As I understand it, this feature works more like suspend-to-disk, so it leaves all mounted disks in an inconsistent state. If another OS boots and accesses those disks, there are likely to be disk-related problems as a result, and one or both OSes will have to clean up the mess. According to this page, typing powercfg /h off in an Administrator Command Prompt will disable the relevant feature and prevent the problem from recurring; however, this is likely to slow down the shutdown/startup process.