2

I have to disable secure boot on my Mac to install Windows on a external drive. I don't have any idea what boot, recovery mode, etc. is. According to the steps which I follow, I have to disable secure boot. After doing this, does my MacBook have a security problem?

6
  • Windows doesn't like being booted from an external, btw. There used to be Windows to Go but Microsoft abandoned it because it was so problematic.
    – Tetsujin
    Sep 27 at 12:30
  • @Tetsujin Can you explain in more detail? I am running Windows on an external 250GB SSD with basically no problems at all. Sometimes it does not boot so I have to restart but this usually happens one out of 20 times.
    – X_841
    Sep 27 at 12:48
  • @X_841 - see this, from OWC - eshop.macsales.com/blog/… or from EaseUS - easeus.com/partition-master/…
    – Tetsujin
    Sep 27 at 12:57
  • @X_841: Windows 10 has no problems booting from USB drives as long as there is support in the firmware (which is true for newer Intel Macs). The GUI Windows installer (Setup.exe) does not support the installation to external drives. However, the is nothing stopping an user from pressing the Shift+F10 key combination to open "Command Prompt" window. From there, the dism command can be used to install the Windows image to an external drive. Also, the diskpart command can be used to edit the partitions, when the GUI Windows installer prohibits desired configurations. Sep 27 at 18:59
  • @Tetsujin: Your references seem to be outdated or not applicable. The reference using Virtual Box installs a BIOS booting Windows. However, no Macs with secure boot have a BIOS in the firmware. The OP's Mac would not be able to boot Windows installed this way. Another references using EaseUS to clone from the internal drive. Most users desire a clean install to the external drive. The reference suggesting "Windows to Go" requires Windows 10 Enterprise or Educational editions. Most users install Home or Pro editions. Sep 27 at 19:44
6

Here is the Startup Security Utility's dialog

enter image description here

which shows and clearly describes the options and what they do.

The security problem with "allow booting from external media" is that your Mac can be booted by any external drive. Someone with physical access to your Mac could plug-in their own USB drive, boot it, and possibly read or copy files on your internal drive.

The use of FileVault mitigates against this, of course.

As pointed out, Allow/Disallow External Boot is different from Secure Boot settings, which control the status of the OSes that can boot.

Full Security only allows OSes that have a valid signed security certificate from Apple can run. The risks from reducing this security mostly involve downloading an OS that you think is from Apple but which has been compromised in some way. Apple can 'turn off' security certificate (and they can also expire), which would prevent old OSes from running.

1
3

You should not have to disable Secure Boot to install and operate Windows on an external drive. I have installed Windows 10 to both Thunderbolt 3 and USB drives on a 2018 Mac mini. The instructions for installing to a USB drive are given here

The Intel Mac Startup Security Utility settings for operating systems installed on external drives are given below.

macOS Windows Linux
Secure boot Full, Medium or No Security Full, Medium or No Security No Security
External boot Allow Allow Allow

You should not need to turn off Secure Boot unless you desired an operation system other than macOS or Windows 10.

Setting Secure Boot set No Security increases the possibility of your Mac booting nefarious software. For example, while running Windows on the external drive, bad software could instruct the firmware to execute the nefarious software on the next boot instead of macOS or Windows.

Allowing external booting would permit the possibility someone could boot an installer or operating system from an external drive and access or erase your data. With external booting, you can still protect someone from reading your data by using encryption. However your Mac only has hardware support for encryption for macOS. Windows and other operating system may offer software only based encryption.

6
  • Most common desktop Linux distros are compatible with Secure Boot (I'm writing this from a laptop running Ubuntu 20.04 with Secure Boot on).
    – Vikki
    Sep 28 at 0:24
  • @Vikki: Is your laptop a Mac? Sep 28 at 0:41
  • 2
    Well, you are wrong. The Apple Secure Boot is in reference to the T2 chip. This is not the same secure boot used on machines that are not made by Apple. Sep 28 at 0:44
  • 1
    What is it with Apple refusing to adopt preexisting standards that everyone else uses?
    – Vikki
    Sep 28 at 0:46
  • 1
    For the most part, Apple's macOS been out in front leading ahead of the new standards. Microsoft is just starting to catch up with Windows 11, which is one reason Windows 11 will not be compatible with the older machines. Why would you expect Apple to adopt the standards everyone else uses when the new (and future) M1 Macs use the Apple Silicon processor, which does not use the x64 (AMD64) instruction set. In other words, Apple is going off in a different direction and leaving the PC compatible world behind. Sep 28 at 0:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .