Disable Secure Boot for drivers not yet signed by Microsoft

Host drivers not yet signed by Microsoft

If the Pre-Install Checker reports Secure Boot: On, work through the steps below in order.

1. Save your recovery key and suspend BitLocker (if enabled)

   Changing the Secure Boot configuration alters the boot measurements (TPM PCR7). As a result, on the next startup BitLocker will ask for the 48-digit recovery key. Without the key, you lose access to your data. The Checker shows whether BitLocker is enabled on the system drive in the BitLocker on C: item.

2. Boot into the UEFI/BIOS screen

   Use one of the following methods:

   • In the Checker, click Restart to UEFI…, confirm and approve the UAC prompt. The PC restarts directly into UEFI.
   • Settings → System → Recovery → Advanced startup → Restart now → Troubleshoot → Advanced options → UEFI Firmware Settings.
   • Or repeatedly press your manufacturer's BIOS key right after powering on (see the table below).

3. Disable Secure Boot

   1. Find the Secure Boot option, usually under the Security, Boot or Authentication tab. If the UEFI screen is in simple mode, press F7 to switch to Advanced Mode.
   2. Set Secure Boot = Disabled. Some PCs require you to set a Supervisor/Administrator password first, or to choose OS Type = Other OS (ASUS).
   3. Save and exit (usually F10 → Save & Exit). The PC restarts into Windows.

4. Turn off Memory Integrity, Smart App Control and Hyper-V

   These features can block drivers or make virtual machines run much slower:

   Memory Integrity (HVCI)

   Memory Integrity enforces a stricter driver policy and may reject cross-signed drivers. It also forces Hyper-V to run in the background.
   Windows Security → Device security → Core isolation details → Memory integrity = Off → restart.

   Smart App Control

   Smart App Control may block the GPMBoxPlus installer and DLLs.
   Windows Security → App & browser control → Smart App Control settings = Off. Note: once turned off, it can only be turned back on by reinstalling Windows.

   Windows hypervisor (Hyper-V, WSL2, Windows Sandbox)

   While the Windows hypervisor is running, GPMBoxPlus has to use NEM mode, which is significantly slower (the virtual machine shows a green turtle icon). Open Command Prompt (Administrator) and run:

   bcdedit /set hypervisorlaunchtype off

   Alternatively, remove Hyper-V, Windows Sandbox and Virtual Machine Platform in Turn Windows features on or off. To turn it back on, run bcdedit /set hypervisorlaunchtype auto.

5. Verify

   1. Press Win + R and type msinfo32. Under System Summary, the Secure Boot State line must read Off or Unsupported.
   2. Run GPMBoxPlusChecker.exe again and click Check again. Once no red items remain, continue to installing GPMBoxPlus.

BIOS/UEFI keys by manufacturer

The table below lists common keys. The actual key may vary by model. If it doesn't work, use the Settings method in step 2.