Is there any way to install Garuda in a secure boot enabled machine?
Not out of the box, but in theory, yes.
An online search for "linux secure boot shim" returns some promising results, e.g.
Unified Extensible Firmware Interface/Secure Boot - ArchWiki
Managing EFI Boot Loaders for Linux: Dealing with Secure Boot
That said, it would be some work, and one better know what he's doing (I wouldn't, so I'm unable to help you do it).
4 Likes
Just disable secure boot.
3 Likes
Disabling secure boot won't result in lost functionality unless you use Bitlocker or have Win11 and play Valorant.
3 Likes
You should have no problem re-enabling Secure Boot after successfully installing Garuda Linux. I would, however, disable Fast Boot from within Windows.
5 Likes
I run M$ 11 without secure boot, but I only use it to keep my BIOS up to date anyway. 
4 Likes
Unless something has changed in the last year, I do not think it is possible without using 3rd party software. I have done it with Arch using Systemd-boot and sbctl. There is other 3rd party software out there but I have never tried them. 
2 Likes
I would keep Secure Boot disabled, disable CMS or whatever your board maker calls it, and disable Fast Boot from within windows.
2 Likes
Thanks. I asked it for installing garuda in one of my friend's laptop as dual boot alongside windows. In my laptop I only use Garuda as main OS so I have disabled secure boot but his windows doesn't work when I disable secure boot.
My bad on that actually. If I remember correctly for you to be able to use Windows without Secure Boot it must be off before Windows is installed. That said I know Linux can now be installed while using Secure Boot, or tweaking the OS after install and then enabling Secure Boot. That however is for others that have more experience than I.
1 Like
I disabled mine after windows was install. A month later after getting Secure Boot working with Arch I turned it back on, been over a year now.
3 Likes
It can be done, but it is not trivial to set up. Take a read through and you’ll see what I mean:
https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot
You can set up shim to sign your regular bootloader, which appears a bit complicated for Grub but is described here: Unified Extensible Firmware Interface/Secure Boot - ArchWiki
The rEFInd boot manager has simplified shim setup tremendously, requiring running only a simple command (refind-install --shim /usr/share/shim-signed/shim.efi for hash only and refind-install --shim /usr/share/shim-signed/shim.efi --localkeys for hash and keys), but obviously you’ll have to switch to rEFInd to take advantage of that.
It also sounds like shim 15.3+ may have complicated this setup, see the discussion here: rEFInd / Discussion / General Discussion: SBAT
I honestly have no idea what determines the version of shim that gets run, or if you can opt for a lesser version/how you would do that, et cetera.
If you are going to set this up for a friend…well, I hope it is a friend you really like. 
9 Likes
Hey thanks for all those links. I somehow managed to install it with secure boot enabled and both Windows and Garuda is working finely on my friend's machine. Yeah the person is my good friend. I am just trying to write a script that automates the process. If I am successful, I will definitely like to share it with the garuda devs. Maybe, they will eventually find a way to integrate it in the installer so that it would be easier for other users. By the way if you enable secure boot you will have to go through the hassle of signing any new kernel modules you install manually.
3 Likes
I'm not sure why you would need to have secureboot enabled.
These default instructions should work universally:
- Enable secureboot
- Install Microsoft Windows 11, boot into it, use the included partition tool to decrease the size of the default NTFS partition (doing this avoids the slower disk resize speed Linux has on NTFS disks)
- Disable secure boot
- Boot the Garuda Linux installer and select "replace partition" and select (read: literally click the visual representation) the empty space you created by shrinking the NTFS partition. Alternatively, select "install alongside" to have the Garuda Linux installer resize it for you.
- Enjoy your dual booted, fully functional system without any secure boot.
2 Likes
Why enable Secureboot at all if you're just going to turn around and disable it? I can't speak to Windows 11 but I know with Win 10 and below you don't have to have Secureboot on to install. As for resizing from within Windows unless something has changed once done it will tell you you need to reboot to finish the process cause you can't resize the OS drive while it's booted.
To install Windows 11.
It will not and yes you can.
On Win 11, is it possible to bypass the secure boot check when installing on bare metal just like on virtual machines? I remember when installing on a VM that I had to disable the RAM, TPM and secure boot checks via regedit before going through the whole install process, because my laptop has a 7th gen Intel CPU and Microsoft thinks it's too old for their shiny new OS.
If it works, then it means you can use Win 11 without secure boot 
I'm not sure about disabling the checks after you've installed it with secure boot enabled though. The issue then becomes other software which check for secure boot before they want to run.
1 Like
yes it is possible, you will have to modify the files in the installation disk before installing. however in my case, the laptop came with preinstalled windows 10 and TPM enabled and he doesn't want to format it. That's the reason I had to do this. But when I buy machines, I always make sure that they come with freedos installed by default so that I can install my favourite linux distro without any problem.
1 Like
I am not sure why but the enable/disable secure boot option in the uefi bios menu was grayed out. So it was not possible to turn it off.
You set BIOS password?