Windows 8 Secure Boot firmware policy inconsistency blocks predictable dual‑boot Linux support

Compatibility boundary

Windows 8 requires UEFI firmware with Secure Boot enabled by default, allowing only signed bootloaders to execute. Microsoft's logo program permits OEMs to provide a firmware option to disable Secure Boot, but this option is not mandatory and may be hidden or absent on some devices.

Unresolved behavior

When Secure Boot remains active, unsigned Linux kernels or bootloaders such as GRUB2 without a Microsoft signature are blocked. The inconsistency of the disable‑Secure‑Boot option across hardware creates an unpredictable boundary: administrators cannot determine in advance whether a given Windows 8 system will support dual‑boot Linux without vendor‑specific firmware changes or key enrollment.

Which Windows 8 hardware families reliably expose a Secure Boot toggle in firmware? Does a firmware update consistently add the disable option across OEM platforms? Can the Secure Boot state reported by msinfo32 be trusted to predict unsigned bootloader execution after the toggle is flipped?