How to Disable Secure Boot in Hyper-V

Secure Boot is a security feature in Hyper-V that ensures a virtual machine (VM) boots only trusted operating systems and bootloaders. It helps prevent malicious code from loading during startup by verifying digital signatures. While Secure Boot is enabled by default for Generation 2 virtual machines, certain operating systems and custom ISO images may fail to boot if Secure Boot remains active.

If you are installing Linux distributions, older Windows versions, or custom operating systems in Hyper-V, you may encounter boot errors related to Secure Boot. In such cases, disabling Secure Boot for that specific virtual machine allows the OS to boot properly.

Disabling Secure Boot in Hyper-V is a straightforward process, but it can only be done when the virtual machine is powered off. Follow the steps below to disable Secure Boot safely.

How to Disable Secure Boot in Hyper-V

Before proceeding, make sure the virtual machine is completely turned off.

1. Open Hyper-V Manager

You must access the virtual machine settings first.

1. Press Windows + S.
2. Type Hyper-V Manager.
3. Open the application.
4. Select your virtual machine from the list.

Ensure the VM is in an Off state before continuing.

2. Open Virtual Machine Settings

Secure Boot settings are located under firmware options.

1. Right-click the virtual machine.
2. Select Settings.
3. In the left panel, click Security.

The Security section contains Secure Boot configuration options.

3. Disable Secure Boot

You can turn off Secure Boot directly from the Security tab.

1. Locate the Enable Secure Boot checkbox.
2. Uncheck Enable Secure Boot.
3. Click Apply.
4. Click OK to save changes.

Secure Boot is now disabled for that virtual machine.

4. Start the Virtual Machine

After disabling Secure Boot, test the VM.

1. Right-click the virtual machine.
2. Select Start.
3. Open the VM console.
4. Verify that the operating system boots successfully.

If boot errors were caused by Secure Boot restrictions, they should now be resolved.

5. Change Secure Boot Template (Optional)

In some cases, changing the Secure Boot template works instead of disabling it completely.

1. Go back to the VM Settings.
2. Select Security.
3. Keep Secure Boot enabled.
4. Change the template to Microsoft UEFI Certificate Authority.
5. Click Apply and restart the VM.

This is useful when installing Linux distributions that support Microsoft’s UEFI certificate.

6. Confirm VM Generation

Secure Boot is only available for Generation 2 virtual machines.

1. In Hyper-V Manager, right-click the VM.
2. Select Settings.
3. Check if it is listed as Generation 2.

Generation 1 virtual machines do not support Secure Boot.

7. Re-Enable Secure Boot (If Needed)

If you want to restore Secure Boot later:

1. Turn off the VM.
2. Open Settings.
3. Go to Security.
4. Check Enable Secure Boot.
5. Apply changes and restart the VM.

Re-enabling Secure Boot restores enhanced startup security.

Final Thoughts

Secure Boot in Hyper-V protects virtual machines from unauthorized bootloaders and malicious startup code. However, certain operating systems and custom installations may require Secure Boot to be disabled to boot correctly.