Microsoft

Deal with the SecureBoot isn't configured correctly watermark in Windows 8.1

A pair of very simple PowerShell commands will help you determine why the SecureBoot isn't configured correctly watermark is appearing on your desktop.

internet_lock_iStock.jpg
Are you one of the many Windows 8.1 upgraders who ended up with the SecureBoot isn't configured correctly watermark on your desktop, as shown in Figure A? If so, you know that changing the wallpaper doesn't make it go away. It's a watermark that is embedded on the desktop and there is only one way to make it go away. However, there are several reasons why it could be appearing there. And, until you know why it is appearing on your computer's desktop, you're better off not attempting the solution to remove it. Fortunately, there are a pair of very simple PowerShell commands that you can use to determine why the SecureBoot isn't configured correctly watermark is appearing on your desktop.

Figure A

Fig A 11-1.png

The SecureBoot isn't configured correctly watermark is embedded on the desktop.

In this article, I'll show you how to use those PowerShell commands and how to interpret the results. Then, I'll show you how to remove the watermark by changing a setting in your computer's BIOS.

The cause

The Windows SecureBoot feature is designed to increase the security of your Windows 8.1 system by preventing unauthorized, malicious software from running on your system at boot time. More specifically, SecureBoot is designed to make sure that your computer only boots using the firmware that is trusted by the computer's manufacturer. If you see a SecureBoot isn't configured correctly watermark on your desktop, that means that Secure Boot has either been turned off or hasn't been correctly configured on your computer.

The PowerShell commands

As I mentioned, there are a pair of very simple PowerShell commands that you can use to determine why the SecureBoot isn't configured correctly watermark is appearing on your desktop. To begin, launch File Explorer and navigate to the root folder of drive C. Then, pull down the File menu in File Explorer and select Open Windows PowerShell | Open Windows PowerShell as administrator, as shown in Figure B. Of course, you'll have to deal with the UAC prompt.

Figure B

Fig B 11-1.png

You'll need to open PowerShell as an administrator.

Once you are at the PowerShell prompt, you can enter the commands. To see if SecureBoot is disabled, use the PowerShell command:

Confirm-SecureBootUEFI

If SecureBoot is disabled, the result of the command will be False, as shown in Figure C. (Just so you know, If SecureBoot is enabled, the result of the command will be True.)

Figure C

Fig C 11-1.png

If SecureBoot is disabled, the command's result will be False.

Now of course, you know by now that the watermark is appearing on the desktop because SecureBoot is disabled, but why is it disabled? Well, there are two possibilities: First the SecureBoot setting was never enabled or inadvertently disabled. Second, the computer could have inadvertently shipped with firmware that has a non-production SecureBoot Policy. To check for the latter possibility, you will use the PowerShell command:

Get-SecureBootPolicy

If the correct SecureBoot policy is present, the result will be the following GUID

{77fa9abd-0359-4d32-bd60-28f4e78f784b}

This is shown in Figure D. Now, if you receive anything other than that specific GUID, then a non-production SecureBoot policy is present.

Figure D

Fig D 11-1.png

If you see this specific GUID, then the correct SecureBoot policy is present.

Fixing the problem

If you discover that a non-production SecureBoot policy is present on your system, then you will need to contact your computer manufacturer and ask about their system specific solution, which will typically be a firmware update. If so, it will be imperative that you follow the manufacturer's instructions to the letter.

If you discover that SecureBoot is disabled, you can enable it. To do so, you have to first discover what special keystroke you use to access the firmware Setup Utility on your particular system. Sometimes a keystroke prompt will appear on the screen when you first turn on the computer. However, on some systems, a splash screen will appear and you won't see the keystroke prompt.

For instance, on my example Dell system, a splash screen appears, but a trip to the Dell web site and a little research revealed that you hold down the F2 key as soon as you see the splash screen, which will reveal the Setup Utility. On this Dell laptop, I found the SecureBoot setting on the Boot tab, as shown in Figure E. To enable/disable the SecureBoot setting was simply a matter of selecting the setting and pressing F5.

Figure E

Fig E 11-1.png

On my Dell laptop, I found the SecureBoot setting on the Boot tab.

Keep in mind that every computer's firmware Setup Utility will be different and the location of the SecureBoot setting and how you go about enabling it will be different. To find out how and where you change the SecureBoot setting on your particular computer, just visit your computer manufacturer's Web site. Alternatively, you can turn to Google and use the search phrase:

Changing the SecureBoot setting on {your computer brand/model}

What's your take?

Have you encountered the SecureBoot isn't configured correctly watermark on your desktop after you upgraded to Windows 8.1? Were you able to fix it? As always, if you have comments or information to share about this topic, please take a moment to drop by the TechRepublic Community Forums and let us hear from you.



Also read:

About

Greg Shultz is a freelance Technical Writer. Previously, he has worked as Documentation Specialist in the software industry, a Technical Support Specialist in educational industry, and a Technical Journalist in the computer publishing industry.

7 comments
donjoeski
donjoeski

I had this issue with the SecureBoot watermark appearing on my desktop. I knew very well how to get into my BIOS settings to enable it, which I did. But before my computer even got to the OS, I got a message saying my graphics card was not compatible with SecureBoot, so I could not enable it. That meant that I was stuck with the watermark, which I was not too happy with. I found this question being asked in the Microsoft Community (http://answers.microsoft.com/en-us/windows/forum/windows8_1-windows_install/windows-81-secure-boot-disabled-watermark-how-to/0d663ee6-edcf-407f-8810-ae7a8dfaec2f) by someone who actually wanted SecureBoot off so that he could dual-boot with Linux. And it turns out that there is a Windows Update that removes the watermark (this must be the patch Com Works was referring to). http://support.microsoft.com/kb/2902864

pjunkel-pcmind
pjunkel-pcmind

I got rid of the Watermark simply by downloading some of the free desktop themes available from the Microsoft link in the "Personalize" area of the control panel. As soon as I installed and used one of those, the watermark disappeared. I have not reverted back to the pre-installed themes to see if the mark comes back, but I do not care enough to do so at the moment.

mike0351
mike0351

kevsan, You may own the hardware, but if your operating system is one made by Microsoft, then you do not own it. Microsoft does not sell their software - only a license to use it according to their terms.

Com Works
Com Works

Update. You only need to change EnableLUA to 0.

Com Works
Com Works

The registry fix to remove the watermark is as follows.

1. Start the Registry Editor with Admin rights (C:\Windows\regedit)

2. Navigate to the following path -> HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Policies \ System.

3. There, the two values ​​" ConsentPromptBehaviorAdmin "and" EnableLUA "set to" 0 ".

Also, Microsoft has a patch to fix it, just Google it.

abacrotto
abacrotto

Greg: I like the article. It is simple and clear. I have a question in regard of upgrading Windows 8 to 8.1 in a computer running Windows 8 Enterprise Edition. Is it right to say I can not upgrade from 8 to 8.1 in this conditions ? My home computer had Windows 8 and upgraded itself (I almost did nothing more tan accept the services terms) to Windows 8.1. I have my work computer and wanted it upgraded. Is there a way for me to do it ?

kevsan
kevsan

My point is that Microsoft ort PC manufactures have absolutely no right to determine how I deal with my hardware and what software I put on my PC. i use only legally purchased software, have two firewalls, Anti Virus software modem and software based I don't need any more.

I build my own PCs and I not want secure boot activated nor do I want Microsoft placing a watermark on MY monitor telling me to activate it.

I OWN the hardware lock stock and barrel and I will use it anyway I want

What I and most other users want is for Microsoft to issue a patch to get rid of this obtrusive message and keep their noses out of my hardware

Editor's Picks