3 ms·
Would this work with Secure Boot enabled - doesn't everything have to be signed Microsoft ?
by Jaruzel 10y ago
Would this work with Secure Boot enabled - doesn't everything have to be signed Microsoft ?
- i336_ 10y agoOoooh. Good point - and I don't actually know. [EDIT: See comment below, XP doesn't do Secure Boot, the following is moot for this context.] So... BOOTMGR (Win10) is chaining through to NTLDR to load WinXP. And either Win10 comes with a copy of NTLDR, or pokes around to find the one on the XP system. By my reasoning, Secure Boot should say "okay" and happily start the machine when it decides BOOTMGR is okay, on the basis that BOOTMGR will verify whatever it loads. The question is whether BOOTMGR actually does that, and seeing as if it doesn't then there isn't really a boot trust chain, well, it probably does verify what it loads. I fear this is something only Microsoft would be able to fix properly for users who want/need Secure Boot. Slightly ironic. But thinking about it, Secure Boot on XP is kind of like deadbolting your front door when your walls have completely disappeared (picture a door sitting in the middle of nowhere), because XP is officially EOL now.
- ComputerGuru 10y agoBootmgr won't chainload other bootloaders in UEFI mode, secure boot enabled or not, unfortunately. Not even other signed and verified uefi bootloaders.
- i336_ 10y agoAh, that answers that question then.
- laborat 10y agoSecure Boot is UEFI only (can't be enabled unless you disable CSM support) so if you want to boot XP you won't have access to Secure Boot anyway
- i336_ 10y agoAh, I see. I was getting Secure Boot confused with Trusted Boot, which was available in the XP era.