Hiren BootCD PE Not Booting on UEFI Laptop Secure Boot Fix
You plug in the Hiren USB, choose it in the boot menu — and the laptop either skips it, flashes a security warning, or lands straight back in Windows. On modern UEFI laptops this is normal behaviour, and it is fixable in a few minutes.
✍️ Technical Anshu🪟 UEFI Laptops⏱️ 7 minute read
🎥 Watch the full video — booting Hiren and the new WinPE tools on modern laptops, shown step by step
New laptops ship with Secure Boot switched on and legacy boot switched off — the exact opposite of what rescue sticks grew up with. Hiren's BootCD PE is a UEFI system and can boot on these machines, but Secure Boot's trust check is the wall it hits first. Work through the checks below in order; one of them is your blocker.
The warning a protected laptop shows when it refuses to start the USB stick
1
First Prove the USB Stick Itself Boots
Never debug a laptop with an unproven stick. Plug the same USB into any other computer and boot it once. If Hiren PE starts there, the stick and its files are fine, and every remaining step belongs to the laptop's firmware.
If it fails everywhere, remake the stick — write the ISO again with Rufus, or copy it onto a Ventoy stick — before touching any BIOS setting.
2
Choose the UEFI Boot Entry, Not the Plain One
Open the one-time boot menu with the brand key at power-on — F12 on Dell and Lenovo, F9 on HP, Esc or F8 on many Asus and Acer models. In the list, pick the entry that begins with UEFI: followed by your USB brand.
A plain entry with the same name is the legacy-mode path — on a UEFI-only laptop it leads nowhere.
If no USB entry appears at all, that is a different problem — see our guide on the USB missing from the boot menu entirely.
3
Turn Off Secure Boot for the Rescue Session
This is the step that fixes most cases. Enter BIOS setup (usually F2 or Del at power-on), find Secure Boot under the Security or Boot tab, set it to Disabled, save with F10 and boot the stick.
Turn Secure Boot back on when the repair is finished — it is a real protection for the machine's own Windows.
If Windows has BitLocker switched on, changing boot settings can make it ask for the recovery key at the next start. Keep that key handy before you begin — it is shown in the Microsoft account of the PC's owner.
On company laptops a BIOS administrator password may block the change. That is the organisation's lock, not a fault — the IT department has to open it.
BIOS setup — the two settings that matter
Boot mode — UEFI (not Legacy or CSM) Secure Boot — temporarily Disabled for the rescue session USB Boot — Enabled
The firmware state that lets a rescue stick start on a modern laptop
4
The Alternative — Boot Through Ventoy with Its Secure Boot Support
If you would rather not switch Secure Boot off, put the Hiren ISO on a Ventoy stick created with Ventoy's Secure Boot support enabled. On the first boot on a protected machine, Ventoy asks you to enrol its key — a one-time, on-screen process using the MOK manager — and after that the same stick boots with Secure Boot left on.
The enrolment is per machine, so expect to repeat it on each new laptop once. The full flow is demonstrated in the video above.
5
Still Refused — the Last Three Checks
A few machines stay stubborn. Before blaming Hiren, clear these off the list.
Port — move the stick to a USB 2.0 port if the laptop has one; some firmware is picky about early USB 3 controllers.
Fast Boot — disable it in BIOS so the firmware fully scans devices instead of taking shortcuts.
The machine itself — a small number of brand-new, tightly locked models refuse every third-party stick. For those, a current WinPE build with fresher signatures is the practical route — which is why the two sticks travel together.
🔴 Do not leave Secure Boot off. Disable it, finish the rescue, and switch it back on. A laptop returned to its owner with protection off is a job half done.
🎥 See It Booted Live in the Video
The video boots Hiren and the new WinPE tools on modern hardware and shows the firmware settings on screen, step by step.
No. Windows runs normally with Secure Boot off; you simply lose that one layer of boot protection while it is disabled. Switch it back on after the repair. If BitLocker is active it may ask for its recovery key once, because boot settings changed.
Why does the same Hiren USB boot on my desktop but not my laptop?
Desktops are usually more permissive, and many have Secure Boot off or legacy support available. Laptops — especially recent thin models — ship locked down with Secure Boot on and no legacy mode, so the same stick meets a wall it never meets on the desktop.
Does switching to CSM or Legacy mode fix it?
For the PE edition, no — it is a UEFI system and wants the UEFI entry. CSM and Legacy are what the old 15.2 disc needs. If your BIOS offers CSM and you enable it for Hiren PE, you may actually hide the correct UEFI entry.
This guide is based on the Technical Anshu video — Hiren BootCD vs New WinPE Tools • Stuck on a step — ask in the video comments and you will get an answer there 🙏