How to Disable Secure Boot and Fast Startup for Linux (2026)?

So you are ready to install Linux alongside Windows and join the dual-boot club. You have your bootable USB ready, your partitions planned, and your favorite distro downloaded. But before you boot into that installer, there are three Windows and firmware settings that can quietly sabotage the entire process: Secure Boot, Fast Startup, and Fast Boot.

I have seen it happen countless times on help forums. Someone boots their Linux USB, starts the installer, and hits a wall. Either the USB will not boot at all, Windows partitions show up as locked or read-only, or GRUB refuses to install properly. In most of these cases, the fix is simply disabling those three settings before you begin.

This guide walks you through disabling Secure Boot and Fast Startup before installing Linux alongside Windows, step by step. I will also cover Fast Boot (a separate but equally important setting), the BitLocker trap that catches many Windows Pro users, and what to do when your machine refuses to cooperate.

Fast Startup vs Fast Boot vs Secure Boot: What Is the Difference?

These three terms get confused constantly, and it is easy to see why. They all have “boot” in the name and they all live near each other in your system settings. But they are completely different features that control completely different things.

Here is the simple breakdown:

Fast Startup is a Windows power-saving feature. When you shut down Windows, it does not fully shut down. Instead, it saves the kernel session to a hibernation file and loads it on the next boot. This makes Windows start faster, but it leaves your NTFS partitions in a locked, hibernated state.

Fast Boot is a UEFI or BIOS firmware setting. It tells your motherboard to skip certain hardware checks during the Power-On Self-Test (POST) to reach the bootloader faster. This can cause your system to skip USB initialization entirely, meaning your Linux installer USB never gets detected.

Secure Boot is a UEFI security feature that verifies digital signatures on bootloaders before allowing them to run. It is designed to stop bootkits and rootkits. The problem is that many Linux bootloaders are not signed with Microsoft-approved keys, so Secure Boot blocks them from loading.

The key distinction forum users keep rediscovering: Fast Startup lives in Windows, Fast Boot lives in your motherboard firmware, and Secure Boot also lives in firmware but controls an entirely different security function. You need to disable all three for a smooth dual-boot setup.

Why You Need to Disable These Settings for Dual Booting?

Each of these three settings interferes with Linux in a specific way. Understanding the mechanics helps you troubleshoot later.

Fast Startup is the most common cause of the “Windows partition is hibernated” error in Linux. When Windows hibernates instead of shutting down, the NTFS filesystem is left in an inconsistent state. Most Linux distributions will refuse to mount the Windows partition to avoid corrupting it. You will see an error telling you that Windows is hibernated and you need to shut it down fully.

Fast Boot causes a different problem. By skipping USB initialization during POST, your motherboard may never detect the Linux installer USB at all. You press F12 to open the boot menu, and the USB is simply not listed. Disabling Fast Boot forces the motherboard to check all connected devices properly.

Secure Boot is the most obvious blocker. When enabled, it validates the bootloader signature before execution. Unsigned Linux bootloaders are rejected outright, and you will typically see a message like “Secure Boot Violation” or “Invalid Signature Detected.” Some distributions like Ubuntu and Fedora ship with signed bootloaders that can work with Secure Boot, but many others do not.

If you use BitLocker encryption on your Windows drive, there is an additional concern. Changing Secure Boot status can trigger a BitLocker recovery key prompt at the next Windows boot. I cover how to handle this in a dedicated section below.

How to Disable Fast Startup in Windows?

Disabling Fast Startup is the easiest step and should be done first while you are still booted into Windows. There are two methods: the graphical Control Panel approach and the faster PowerShell command.

Method 1: Disable Fast Startup via Control Panel

Step 1: Press the Windows key, type “Control Panel,” and open it.

Step 2: Change the view to Large Icons (top-right corner) and click on “Power Options.”

Step 3: On the left side, click “Choose what the power buttons do.”

Step 4: Click the blue text that says “Change settings that are currently unavailable.” This requires administrator privileges.

Step 5: Under “Shutdown settings,” uncheck the box labeled “Turn on fast startup (recommended).”

Step 6: Click “Save changes” at the bottom.

If you do not see the Fast Startup option at all, it means hibernation is already disabled on your system, which also means Fast Startup is off.

Method 2: Disable Fast Startup via PowerShell (Fastest)

This is the method I prefer because it takes about five seconds. Open PowerShell as Administrator (right-click the Start button and select “Terminal (Admin)” or “Windows PowerShell (Admin)”), then run this single command:

powercfg /h off

This disables hibernation entirely, which also disables Fast Startup as a side effect. Hibernation and Fast Startup both rely on the same hibernation file, so turning off hibernation kills both features at once.

The trade-off is that you also lose the ability to hibernate Windows. For a dual-boot machine, that is usually a fair trade since hibernation causes partition-locking issues anyway.

How to Access Your UEFI/BIOS Settings?

Before you can disable Fast Boot and Secure Boot, you need to get into your UEFI firmware settings. The method depends on your computer’s manufacturer and age.

The Modern Way: Through Windows Settings (Windows 10 and 11)

If you are running Windows 10 or 11 on a UEFI system, you can restart directly into firmware settings without mashing keyboard keys.

Step 1: Open Settings and go to Update and Security (Windows 10) or System (Windows 11).

Step 2: Click “Recovery” on the left or in the main panel.

Step 3: Under “Advanced startup,” click “Restart now.”

Step 4: When the blue menu appears, click “Troubleshoot,” then “Advanced options,” then “UEFI Firmware Settings.”

Step 5: Click “Restart” and your computer will boot into the UEFI interface.

The Traditional Way: Keyboard Keys at Boot

If you are on an older system or prefer the classic method, you need to press a specific key immediately after powering on. The key varies by manufacturer. Here is a quick reference I have compiled from forum data and manufacturer documentation:

Dell: Press F2 for BIOS/UEFI settings, F12 for the one-time boot menu.

HP: Press F10 for BIOS/UEFI settings, F9 for the boot menu. On some models, press Esc first to open the startup menu, then select the appropriate function key.

Lenovo: Press F1 or F2 for BIOS/UEFI. On many modern Lenovo laptops, press the Novo button (a small physical button or pinhole next to the power port) to access the Novo Button Menu.

ASUS: Press F2 for BIOS/UEFI settings, Esc or F8 for the boot menu.

Acer: Press F2 or Del for BIOS/UEFI settings, F12 for the boot menu.

MSI: Press Del for BIOS/UEFI settings, F11 for the boot menu.

Gigabyte / AORUS: Press Del for BIOS/UEFI settings, F12 for the boot menu.

The timing matters. Start pressing the key repeatedly the instant you press the power button. If you see the Windows logo, you waited too long and need to try again.

How to Disable Fast Boot in UEFI/BIOS?

Once you are in the UEFI/BIOS interface, disabling Fast Boot is straightforward but the exact menu path varies by manufacturer.

Step 1: Navigate to the “Boot” or “Advanced” tab using your arrow keys or mouse (most modern UEFI interfaces support both).

Step 2: Look for an option called “Fast Boot,” “Ultra Fast Boot,” or simply “Fast Boot Mode.”

Step 3: Set it to “Disabled.”

Step 4: Some manufacturers split this into sub-options. If you see separate settings for “Fast Boot” and “Ultra Fast Boot,” disable both.

Step 5: Do not exit yet. You still need to disable Secure Boot in the next step.

On some ASUS motherboards, Fast Boot is hidden under the “Boot” section in “EZ Mode” but may require switching to “Advanced Mode” (F7) to see all options. On Dell systems, look under “Settings” then “General” then “Advanced Boot Options.”

If you cannot find a Fast Boot option at all, your firmware may not include this feature. Older BIOS systems and some minimal UEFI implementations skip it entirely. In that case, move on to disabling Secure Boot.

How to Disable Secure Boot in UEFI/BIOS?

Secure Boot is the setting most people come looking for, and it is usually located in the same general area as Fast Boot but under a different subsection.

Step 1: In your UEFI/BIOS, navigate to the “Security,” “Authentication,” or “Boot” tab.

Step 2: Look for “Secure Boot” and select it. You may need to open a sub-menu.

Step 3: Set “Secure Boot” to “Disabled.” On some systems, you need to first set “Secure Boot” to “Custom” before you can disable it fully.

Step 4: On many Dell systems, you need to go to “Secure Boot,” then “Secure Boot Enable,” uncheck the box, and then apply the change.

Step 5: On HP systems, the path is typically “Security” then “Secure Boot Configuration.” You may need to select “Legacy Support Disable and Secure Boot Disable” or a similar combined option.

Step 6: On ASUS boards, look under the “Boot” tab for “Secure Boot.” You may need to set “OS Type” to “Other OS” to reveal the option to disable Secure Boot.

Step 7: On Lenovo ThinkPads, navigate to the “Security” tab, select “Secure Boot,” and set it to “Disabled.”

Step 8: Once disabled, save and exit. Most UEFI systems use F10 to save and exit. Confirm when prompted.

Your system will restart. You should now see a confirmation message on some machines saying that Secure Boot has been disabled and boot times may be affected. This is normal.

BitLocker: Suspend Before Changing Secure Boot

This is the step that catches more people off guard than any other. If you use BitLocker to encrypt your Windows drive (common on Windows Pro and Enterprise editions), changing the Secure Boot state can lock you out of Windows.

Here is what happens: BitLocker uses the TPM and Secure Boot configuration as part of its measurement. When you disable Secure Boot, the TPM measurement changes, and BitLocker treats this as a potential tampering attempt. On your next Windows boot, you will be asked for a 48-digit recovery key.

If you do not have that recovery key saved, you could lose access to your Windows installation entirely. This is why you must suspend BitLocker before changing firmware settings.

How to Suspend BitLocker Before Disabling Secure Boot

Step 1: In Windows, open the Start menu and type “Manage BitLocker,” then open the result.

Step 2: Click “Suspend protection” on your system drive (usually C:).

Step 3: Confirm when prompted. BitLocker is now temporarily suspended and will not trigger a recovery key prompt when you change firmware settings.

Step 4: Alternatively, you can do this from an Administrator PowerShell or Command Prompt:

manage-bde -protectors -disable C:

This suspends BitLocker protection for one reboot. After you finish your firmware changes and successfully boot back into Windows, BitLocker will automatically resume.

If your machine is managed by an employer and BitLocker is enforced through group policy, you may not have permission to suspend it. In that case, contact your IT department before making any changes.

What to Do If Secure Boot Cannot Be Disabled?

Some users discover that the Secure Boot option is greyed out, locked behind a password, or missing entirely. This happens most often on enterprise or corporate machines, but it can also affect consumer laptops.

If the option is greyed out, look for a setting called “Secure Boot Mode” and switch it from “Standard” to “Custom.” On many systems, you can only modify Secure Boot settings when the mode is set to Custom.

If your UEFI requires a password to change settings and you do not know it, try the default passwords for your manufacturer. Common defaults include the manufacturer name or a blank password. On some Dell machines, you can generate a master password from the service tag using online tools, though this varies by model.

If you are on a corporate machine with Secure Boot locked by your IT department, you generally cannot disable it without admin credentials. Your best option in this case is to choose a Linux distribution that supports Secure Boot out of the box.

Ubuntu, Fedora, openSUSE, and RHEL all ship with Microsoft-signed bootloaders that pass Secure Boot verification. You can install these distributions without disabling Secure Boot. Linux Mint also offers experimental Secure Boot support during installation.

For distros like Arch Linux, Gentoo, or NixOS that do not ship signed bootloaders, you will need full Secure Boot access. On a locked machine, consider using a virtual machine instead of dual-booting, or ask your IT department to provide a Secure Boot unlock.

Re-enabling Secure Boot After Linux Installation

Many security-conscious users want to turn Secure Boot back on after Linux is installed. The good news is that this is possible, but only under certain conditions.

If you installed Ubuntu, Fedora, openSUSE, or another distribution with a signed bootloader, you can re-enable Secure Boot in your UEFI settings. The signed bootloader will pass verification, and your GRUB menu will load normally. Some signed distributions require you to enroll additional keys through a process called MOK (Machine Owner Key) management.

If you installed a distribution with an unsigned bootloader like Arch or Debian with a custom kernel, re-enabling Secure Boot will prevent your system from booting. You would need to either sign your own bootloader and kernel (a complex process) or leave Secure Boot disabled.

To re-enable Secure Boot, simply go back into your UEFI settings and set Secure Boot back to “Enabled.” If you previously suspended BitLocker, boot into Windows first, resume BitLocker protection, and then restart to change the setting.

Always test thoroughly after re-enabling. Boot into both Windows and Linux to confirm everything still works before considering the process complete.

Troubleshooting Common Issues

Even after following all the steps above, you may encounter some common roadblocks. Here are the issues I see reported most frequently and how to fix them.

USB Drive Still Will Not Boot

If your USB is not appearing in the boot menu after disabling Secure Boot and Fast Boot, check the boot mode setting. Your UEFI needs to be set to UEFI mode (not Legacy/CSM mode) if you created a UEFI-bootable USB with tools like Rufus or Etcher. Conversely, if you created a Legacy-bootable USB, you need CSM enabled. Match the USB format to your firmware mode.

Also verify your USB was written correctly. Try re-flashing it with a tool like Ventoy or BalenaEtcher, and test it on another computer if possible.

NTFS Partition Shows as Hibernated or Locked

If Linux reports that your Windows partition is hibernated, Fast Startup is still active. Boot back into Windows and use the PowerShell command powercfg /h off to disable it definitively. Then do a full restart (not shutdown) and try again.

From the Linux side, you can also temporarily force-mount the partition read-only using sudo ntfs-3g /dev/sdX# /mnt/windows -o remove_hiberfile, but this is risky and can corrupt data. Fixing it on the Windows side is safer.

BitLocker Recovery Loop

If you forgot to suspend BitLocker and are now stuck at the recovery screen, you need your 48-digit recovery key. You can find it by logging into your Microsoft account at account.microsoft.com/devices/recoverykey (from another device), or by checking Azure AD or Active Directory if it is a work machine.

Once you have the key, enter it to boot Windows, then suspend BitLocker properly before making further changes.

CSM or Legacy Mode Conflicts

Some older Linux distributions or boot media require Legacy BIOS mode (CSM). If your system is set to UEFI-only and you cannot boot the installer, enable CSM in your UEFI settings. However, mixing UEFI Windows with Legacy Linux installations creates complications with dual-booting because they use different boot managers. Whenever possible, keep everything in UEFI mode.

Frequently Asked Questions

Conclusion

Disabling Secure Boot and Fast Startup before installing Linux alongside Windows comes down to three essential steps. Turn off Fast Startup in Windows using powercfg /h off, disable both Fast Boot and Secure Boot in your UEFI firmware, and suspend BitLocker first if you use encryption. Each setting addresses a different blocker, and skipping any one of them can derail your dual-boot installation.

Once these three settings are disabled and your system boots from the Linux USB without errors, you are ready to proceed with the actual installation. Take your time with each step, and remember that you can always re-enable Secure Boot afterward if your distribution supports it.