A pair of very simple PowerShell commands will help you determine why the SecureBoot isn't configured correctly watermark is appearing on your desktop.
Figure A
The SecureBoot isn't configured correctly watermark is embedded on the desktop.
In this article, I'll show you how to use those PowerShell commands and how to interpret the results. Then, I'll show you how to remove the watermark by changing a setting in your computer's BIOS.
The cause
The Windows SecureBoot feature is designed to increase the security of your Windows 8.1 system by preventing unauthorized, malicious software from running on your system at boot time. More specifically, SecureBoot is designed to make sure that your computer only boots using the firmware that is trusted by the computer's manufacturer. If you see a SecureBoot isn't configured correctly watermark on your desktop, that means that Secure Boot has either been turned off or hasn't been correctly configured on your computer.
The PowerShell commands
As I mentioned, there are a pair of very simple PowerShell commands that you can use to determine why the SecureBoot isn't configured correctly watermark is appearing on your desktop. To begin, launch File Explorer and navigate to the root folder of drive C. Then, pull down the File menu in File Explorer and select Open Windows PowerShell | Open Windows PowerShell as administrator, as shown in Figure B. Of course, you'll have to deal with the UAC prompt.
Figure B
You'll need to open PowerShell as an administrator.
Once you are at the PowerShell prompt, you can enter the commands. To see if SecureBoot is disabled, use the PowerShell command:
Confirm-SecureBootUEFI
If SecureBoot is disabled, the result of the command will be False, as shown in Figure C. (Just so you know, If SecureBoot is enabled, the result of the command will be True.)
Figure C
If SecureBoot is disabled, the command's result will be False.
Now of course, you know by now that the watermark is appearing on the desktop because SecureBoot is disabled, but why is it disabled? Well, there are two possibilities: First the SecureBoot setting was never enabled or inadvertently disabled. Second, the computer could have inadvertently shipped with firmware that has a non-production SecureBoot Policy. To check for the latter possibility, you will use the PowerShell command:
Get-SecureBootPolicy
If the correct SecureBoot policy is present, the result will be the following GUID
{77fa9abd-0359-4d32-bd60-28f4e78f784b}
This is shown in Figure D. Now, if you receive anything other than that specific GUID, then a non-production SecureBoot policy is present.
Figure D
If you see this specific GUID, then the correct SecureBoot policy is present.
Fixing the problem
If you discover that a non-production SecureBoot policy is present on your system, then you will need to contact your computer manufacturer and ask about their system specific solution, which will typically be a firmware update. If so, it will be imperative that you follow the manufacturer's instructions to the letter.
If you discover that SecureBoot is disabled, you can enable it. To do so, you have to first discover what special keystroke you use to access the firmware Setup Utility on your particular system. Sometimes a keystroke prompt will appear on the screen when you first turn on the computer. However, on some systems, a splash screen will appear and you won't see the keystroke prompt.
For instance, on my example Dell system, a splash screen appears, but a trip to the Dell web site and a little research revealed that you hold down the F2 key as soon as you see the splash screen, which will reveal the Setup Utility. On this Dell laptop, I found the SecureBoot setting on the Boot tab, as shown in Figure E. To enable/disable the SecureBoot setting was simply a matter of selecting the setting and pressing F5.
Figure E
On my Dell laptop, I found the SecureBoot setting on the Boot tab.
Keep in mind that every computer's firmware Setup Utility will be different and the location of the SecureBoot setting and how you go about enabling it will be different. To find out how and where you change the SecureBoot setting on your particular computer, just visit your computer manufacturer's Web site. Alternatively, you can turn to Google and use the search phrase:
Changing the SecureBoot setting on {your computer brand/model}
What's your take?
Have you encountered the SecureBoot isn't configured correctly watermark on your desktop after you upgraded to Windows 8.1? Were you able to fix it? As always, if you have comments or information to share about this topic, please take a moment to drop by the TechRepublic Community Forums and let us hear from you.
