Ubuntu 16.04 - how can I disable Secure Boot?

Question

I have Ubuntu 16.04 installed on a Dell 5470. I want to reinstall it due to some reasons. I want to boot from USB to reinstall Ubuntu. The problem is, I cannot access the BIOS and the boot menu due to Secure Boot. When I press F2 or F12 during startup the computer still boots into Ubuntu.

I tried systemctl reboot --firmware-setup but I receive Cannot indicate to EFI to boot into setup mode: Operation not supported How can I boot from USB and reinstall Ubuntu?

Answer 1

There are several ways to boot into the firmware setup utility, some of which you seem to be aware of:

• Using a keypress at power-on time -- Unfortunately, there's next to no standardization as to what keypress will enter the setup tool. It's usually Esc, Enter, or a function key (but which one varies wildly -- it's often F2, F8, or F10, but can be something else). Setting the firmware's "fast start" feature sometimes disables this method of entry to the setup tool because that leaves USB ports uninitialized. If the computer has a PS/2 port, you may be able to work around this limitation by using a PS/2 keyboard.
• Using systemctl -- The command you presented earlier, sudo systemctl reboot --firmware-setup, works on some computers; but it clearly isn't working for you. Windows 8 and later offers a similar feature, so if you can boot into Windows, you could try it, on the off chance that it would work better.
• Using a boot manager's reboot-to-setup feature -- Some boot managers offer a feature to reboot into the setup utility. GRUB does (although it may not be active by default), as does my rEFInd boot manager (it's active by default but can be disabled; and it will not appear if the computer lacks the necessary support), as well as gummiboot/systemd-boot (I don't recall if it's active by default). I'm not positive, but I suspect that this feature would work on precisely those computers on which the preceding method would work, so I wouldn't hold out much hope of it working for you.
• Remove all other boot options -- If an EFI-based computer can't find any other boot loader, it will normally launch its setup utility. The best way to take advantage of this is usually to unplug all your hard disks (and your network cables, if your network supports network booting). Alternatively, you could delete your EFI System Partition (ESP) or delete or move all the boot loader files on it so that the firmware can't find them. The trouble with this method is that restoring the system to its original state might not render it bootable again, since many EFIs delete their NVRAM-based references to boot options that become invalid. Thus, you might need to use Boot Repair, efibootmgr, or some other tool to re-install GRUB or re-create its NVRAM entry once you're done.

BTW, chances are it's not Secure Boot per se that's preventing you from entering your firmware setup utility. (Although it could be that Dell linked Secure Boot to making it harder to enter the firmware, this type of linkage is not required of Secure Boot, and I've never encountered it myself.) It's more likely that it's the firmware's "fast start" feature leaving the USB ports uninitialized that's at the root of the problem. Another likely possibility is that you're trying the wrong key or that you're hitting it outside of the (often very narrow) window in which it will work. Ask on a Dell forum or check your documentation to learn what key to press, and try it several times, hitting it repeatedly as the computer starts up.

Answer 2

Use efibootmgr to change and set boot manager timeout waiting for user input - an example :

$ sudo efibootmgr
BootCurrent: 0001
Timeout: 1 seconds
BootOrder: 0001,0000,0002
Boot0000* fedora
Boot0001* ubuntu
Boot0002* UEFI OS  

Currently boot manager timeout (on my PC) is set to 1 second, now we change it to 10 seconds :

sudo efibootmgr --timeout 10
BootCurrent: 0001
Timeout: 10 seconds
BootOrder: 0001,0000,0002
Boot0000* fedora
Boot0001* ubuntu
Boot0002* UEFI OS  

Reboot and press F2 or F12 in order to access BIOS and disable Secure Boot in UEFI settings.

Answer 3

Long story short, to defeat Fast Boot, what always works for me. Is to hold down F12 and Delete, then power up the system. If you don't hear that beep. Power it down quickly, (if you are dual booting Windows) and repeat. This always works for me on the second try.