Old forum posts say dual booting means switching Secure Boot off. For Ubuntu that advice is years out of date — Ubuntu boots happily with Secure Boot on. There is exactly one common catch, and it involves NVIDIA graphics drivers. This page separates the myth from the catch.
Secure Boot is the firmware check that only allows signed bootloaders to run, and it is on by default on every modern Windows PC. Years ago it genuinely blocked Linux installs. Ubuntu solved that long ago — its bootloader arrives signed through Microsoft's own signing programme, so a stock Ubuntu installs and boots with Secure Boot fully enabled. The one place you will still meet friction is the closed-source NVIDIA driver, and it is a five-minute detour, not a wall.
Ubuntu's boot chain starts with a small loader called shim, which carries a Microsoft signature. The firmware trusts that signature out of the box, shim then verifies and starts GRUB, and GRUB starts Ubuntu. No settings changed, no security lowered.
Honest limit: this signed path is a mainstream Ubuntu feature. Tiny hobby distributions and hand-built kernels may not carry signatures, and those are the cases where people still reach for the off switch.
The open-source nouveau driver that Ubuntu uses by default is part of the signed system and works under Secure Boot. The proprietary NVIDIA driver, which gamers and CUDA users want, is built on your machine as unsigned kernel modules — and Secure Boot refuses to load unsigned modules.
When you install the NVIDIA driver through Software and Updates, Ubuntu offers to set a MOK password for exactly this purpose. That password is used once, at the next reboot — remember it until then.
Enroll MOK — Continue — Reboot. Choose Enroll MOK and type the password you set while installing the driver, and the key is trusted from this boot onward.
Restart after the driver install and, before Ubuntu loads, the blue MOK management screen appears. This is the moment most people panic and just press continue — which skips enrollment and leaves the driver unloaded.
nvidia-smi in a terminalMissed the screen or forgot the password? No harm done. Reinstall the driver from Software and Updates, Additional Drivers — Ubuntu will offer to create a fresh MOK and the blue screen returns at the next reboot.
NVIDIA is the famous case, not the only one. Anything that builds its own kernel module on your machine meets the same rule — VirtualBox host drivers are the other common one, and some Wi-Fi and VPN drivers behave the same way.
If a piece of hardware suddenly stops working right after a kernel update, an unsigned module that failed to rebuild is a prime suspect — the fix is reinstalling that driver, not disabling security features.
There are honest cases for the off switch: an old or exotic distribution without signed boot files, development work with self-built kernels, or hardware whose vendor tools demand it. It is your machine and your call — made with eyes open.
For a standard Ubuntu dual boot, though, the answer stands: you do not need the off switch, and the NVIDIA detour is the only toll on the road.
The full dual boot installation from the video works with Secure Boot on — watch it done live, step by step.
▶️ Watch Full VideoNo. Ubuntu ships a bootloader signed through Microsoft's programme specifically so it installs and boots with Secure Boot enabled, and that is the standard supported setup. The old advice to disable it belongs to other distributions and much older guides.
The driver is probably not loaded, because its unsigned modules were blocked by Secure Boot. If you skipped the blue MOK enrollment screen or never saw it, reinstall the driver from Software and Updates, set the MOK password when offered, and choose Enroll MOK at the next reboot. nvidia-smi in a terminal confirms when the driver is really active.
Windows runs normally with Secure Boot off, but the change can make BitLocker demand its recovery key at the next start, because a boot security setting changed. Suspend BitLocker before changing it and keep the key saved. For a normal Ubuntu dual boot you do not need to turn it off at all.