USB Boot and Firmware Unlock Cheat Sheet

A manufacturer-by-manufacturer reference to USB boot menus and firmware settings, with notes on Secure Boot, recovery tools, platform differences, and BitLocker recovery risks.

USB Boot and Firmware Unlock Cheat Sheet

Contents

How to Boot From USB on Almost Any Computer

Source policy: Every boot key, boot-menu sequence, firmware entry method, and security-setting procedure in this guide is linked to a manufacturer, platform owner, standards body, or clearly identified community reference. Where a reliable cross-model source could not be found, this guide says so instead of guessing.

Last source verification: October 3, 2026.

Booting from USB is usually straightforward: connect properly prepared boot media, open the computer's one-time boot menu, and select the USB device.

The important modern rule is this:

Do not disable Secure Boot or switch to Legacy/CSM mode just because you want to boot from USB. Try the normal UEFI boot path first. Secure Boot is a UEFI trust mechanism, not a general USB-blocking feature. Microsoft documents Secure Boot as signature verification for trusted pre-OS software, and Ubuntu documents its Microsoft-signed shim / Canonical-signed GRUB path for Secure Boot-capable installs.

Sources: - Microsoft Secure Boot: https://learn.microsoft.com/en-us/windows-hardware/drivers/bringup/secure-boot - Ubuntu UEFI Secure Boot: https://documentation.ubuntu.com/security/security-features/platform-protections/secure-boot/

Before You Change Anything

Prefer the one-time boot menu

A one-time boot menu changes the boot device for the current startup without permanently rewriting the system boot order. Dell, Lenovo, Acer, Gigabyte, ASRock, HPE and other vendors explicitly document this behavior.

BitLocker warning

Changing Secure Boot state, boot configuration, or some firmware measurements can trigger BitLocker recovery because BitLocker can bind protection to TPM Platform Configuration Registers, including Secure Boot state.

Before changing Secure Boot, TPM settings, or UEFI/Legacy mode on a Windows machine, make sure the BitLocker recovery key is available.

Official Microsoft sources: - BitLocker preboot recovery screen: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/preboot-recovery-screen - BitLocker configuration and PCRs: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/configure

General procedure

  1. Shut the computer down completely.
  2. Insert the bootable USB drive.
  3. Power on the computer.
  4. Immediately use the manufacturer's one-time boot-menu key or startup procedure listed below.
  5. Select the USB device.
  6. If both a UEFI and Legacy version of the same USB appear, use the UEFI entry unless the operating system or utility specifically requires Legacy BIOS boot.

Quick Boot-Key Reference

Manufacturer / platform One-time boot selection Firmware setup Source
Dell consumer/business PCs F12 F2 Dell service manuals: https://www.dell.com/support/manuals/en-us/inspiron-14-5410-laptop/inspiron-5410-service-manual/boot-sequence?guid=guid-c50bed7f-226b-4768-ab61-9725153df132&lang=en-us
HP consumer/business PCs Esc, then F9 Esc, then F10 HP: https://support.hp.com/in-en/document/ish_6930187-6931079-16
Lenovo ThinkPad F12 F1 Lenovo: https://download.lenovo.com/pccbbs/pubs/t590_p53s/html_en/en/Change_the_startup_sequence_%28topic%29_T0000683080.html
Lenovo IdeaPad / current consumer systems F12 F2 or Fn+F2 Lenovo: https://support.lenovo.com/hk/en/documentation/sg10252/bios_setup_intro?language=en
Acer notebooks F12 F2 Acer: https://community.acer.com/en/kb/articles/12915-changing-boot-order
Acer desktops F12 Del on many models Acer: https://community.acer.com/en/kb/articles/12915-changing-boot-order
ASUS notebooks hold/tap Esc during power-on F2 ASUS: https://www.asus.com/support/faq/1013017/
ASUS motherboards F8 from UEFI / boot menu Del or F2 ASUS: https://www.asus.com/support/faq/1053205/
Microsoft Surface hold Volume Down, press Power hold Volume Up, press Power Microsoft: https://support.microsoft.com/en-us/surface/drivers-firmware/boot-surface-from-a-usb-device
Framework Laptop F12 F2 Framework community BIOS guide: https://community.frame.work/t/bios-guide/4178
System76 Open Firmware laptop Esc → One Time Boot Esc System76: https://support.system76.com/support/boot-menu/
System76 proprietary-firmware laptop F7 F2 System76: https://support.system76.com/support/boot-menu/
System76 Thelio F8, F11, or F12 depending on model Del / F2 System76: https://support.system76.com/support/boot-menu/
System76 Meerkat F10 F2 System76: https://support.system76.com/support/boot-menu/
MSI F11 Del MSI: https://us.msi.com/support/technical_details/NB_OS_USB_Device_Detection
Gigabyte motherboard/desktop F12 Del Gigabyte manual: https://download.gigabyte.com/FileList/Manual/desktop_pc_manual_ai-top-100-z890_1003_e.pdf?v=2491dd10a46725c03eefd1eaf13abca4
ASRock motherboard F11 F2 ASRock: https://www.asrock.com/support/faq.asp?id=181
Samsung PC F10 model-dependent; commonly F2 Samsung USB boot procedure: https://www.samsung.com/us/support/answer/ANS10002820/
Dynabook / later Toshiba F12 documented on supported models model-dependent Dynabook: https://support.dynabook.com/support/viewContentDetail?contentId=4009420
Intel-era NUC F10 on supported NUC firmware F2 Intel/ASUS NUC documentation: https://www.asus.com/us/support/faq/1052381/
Intel Mac hold Option (⌥) Recovery / Startup Security as applicable Apple: https://support.apple.com/en-ie/102603
Apple silicon Mac hold Power until Startup Options Startup Options → Options Apple: https://support.apple.com/en-ie/102603
Dell PowerEdge F11 Boot Manager F2 Dell: https://www.dell.com/support/kbdoc/en-us/000176910/how-to-boot-into-the-bios-or-the-lifecycle-controller-on-your-poweredge-server
HPE ProLiant Gen10/Gen10+ F11 one-time boot menu System Utilities / platform configuration HPE: https://support.hpe.com/hpesc/public/docDisplay?docId=a00112581en_usen_us&docLocale=en_US&page=GUID-C4023994-3C36-434A-B288-8DD7132A2B50.html
Lenovo ThinkSystem F12 boot menu F1 setup Lenovo: https://pubs.lenovo.com/hs350x-v3/thinksystem_hs350xv3_uefi_user_guide.pdf

Important: Function keys are conventions, not immutable laws. A specific model manual outranks this table.

Major PC Manufacturers

Dell

Inspiron, Latitude, XPS, Vostro, OptiPlex and Precision

One-time boot menu: Power on or restart and press F12 when the Dell logo appears. Select the removable/USB device from the one-time boot menu.

Firmware setup: Press F2 during POST.

Dell documents both operations in current service manuals.

Official Dell source: https://www.dell.com/support/manuals/en-us/inspiron-14-5410-laptop/inspiron-5410-service-manual/boot-sequence?guid=guid-c50bed7f-226b-4768-ab61-9725153df132&lang=en-us

Another current Dell F12 example: https://www.dell.com/support/manuals/en-us/latitude-14-9440-2-in-1-laptop/latitude_9440_2-in-1_sm/f12-one-time-boot-menu?guid=guid-71da763a-3f2f-4021-8ef7-3e50da009c74&lang=en-us

Dell USB-C / Thunderbolt boot caveat

Some older Dell systems require USB/Thunderbolt boot support or different Fastboot behavior before certain USB-C devices appear during preboot. This is model-specific, not a reason to enable Legacy mode on all Dell computers.

Dell source and affected models: https://www.dell.com/support/kbdoc/en-vc/000131221/how-to-boot-to-an-external-device-using-usb-type-c-connection

HP

Pavilion, Envy, Spectre, OmniBook, EliteBook, ProBook and ZBook

HP's documented startup sequence on supported PCs is:

  1. Power on the computer and repeatedly press Esc until the Startup Menu appears.
  2. Press F9 for Boot Device Options.
  3. Select the USB device and press Enter.
  4. Use F10 from the Startup Menu to enter BIOS Setup when firmware configuration is actually required.

Official HP source: https://support.hp.com/in-en/document/ish_6930187-6931079-16

HP also documents Esc → F10 for BIOS Setup on consumer notebooks: https://support.hp.com/rs-en/document/ish_3900499-3190557-16

Legacy Support on HP

HP documents Legacy Support on some older systems, but it should only be used for boot media that actually requires legacy BIOS operation. It is not a normal prerequisite for USB boot.

Source: https://support.hp.com/in-en/document/ish_6930187-6931079-16

Lenovo

ThinkPad

Temporary boot device: Press F12 at the Lenovo logo, select the desired device, and press Enter.

UEFI/BIOS setup: Press F1 at the Lenovo logo.

Official Lenovo ThinkPad documentation: https://download.lenovo.com/pccbbs/pubs/t590_p53s/html_en/en/Change_the_startup_sequence_%28topic%29_T0000683080.html

IdeaPad and current Lenovo consumer systems

Current Lenovo documentation for IdeaPad Slim systems specifies:

  • F12 — open the boot-device menu.
  • F2 — open UEFI/BIOS setup.
  • If Hotkey Mode is enabled, Fn+F2 may be needed for firmware setup.

Official Lenovo source, updated September 2026: https://support.lenovo.com/hk/en/documentation/sg10252/bios_setup_intro?language=en

Lenovo also documents F12 / Fn+F12 for temporary startup-device selection on many earlier IdeaPad generations: https://download.lenovo.com/pccbbs/pubs/v140_15iwl/html_en/EN/change_device_boot_order.html

Novo button

Some IdeaPad-family systems include a recessed Novo button. Lenovo documents the Novo button as a way to reach BIOS setup and the boot menu while the system is off.

Official Lenovo USB-boot article: https://support.lenovo.com/lk/en/solutions/ht500207-how-to-boot-from-usb-disk-in-the-bios-boot-menu-windows-8-windows-10-ideapadlenovo-laptops

Novo button reference: https://support.lenovo.com/il/en/solutions/ht102944

Acer

Aspire, Swift, Nitro, Predator and TravelMate

Acer documents:

  • F12 — one-time Boot Menu.
  • F2 — BIOS on notebooks.
  • Del — BIOS on many Acer desktops.

Official Acer source: https://community.acer.com/en/kb/articles/12915-changing-boot-order

If F12 does nothing

Acer notes that the F12 Boot Menu feature must be enabled on some systems before the key works.

Same official source: https://community.acer.com/en/kb/articles/12915-changing-boot-order

Secure Boot is grayed out

Some Acer systems require a Supervisor Password before the Secure Boot control can be edited. Acer's own knowledge base explicitly documents this behavior and warns users to retain the password.

Notebook source: https://community.acer.com/en/kb/articles/88-enable-or-disable-secure-boot-on-an-acer-notebook

Desktop source: https://community.acer.com/en/kb/articles/87-enable-or-disable-secure-boot-on-an-acer-desktop

ASUS

VivoBook, ZenBook, ExpertBook, TUF, ROG and other ASUS notebooks

ASUS's current USB boot procedure says to start from a fully powered-off state, hold Esc, press Power, and release Esc when the Boot Menu appears. Select the USB device and press Enter.

Official ASUS USB boot guide: https://www.asus.com/support/faq/1013017/

ASUS documents F2 during power-on for BIOS setup on notebooks: https://www.asus.com/us/support/faq/1008829/

ASUS motherboards and desktops

ASUS motherboard documentation shows:

  • Del or F2 — enter BIOS Setup.
  • F8 — Boot Menu from the UEFI interface on supported boards.

Official ASUS sources: https://www.asus.com/support/faq/1053205/ https://www.asus.com/us/support/faq/1044236/

“Other OS” Secure Boot setting

Do not change ASUS OS Type to Other OS simply because you are using USB media. ASUS documents this setting as a troubleshooting/configuration change for certain non-Windows operating systems.

ASUS source: https://www.asus.com/us/support/faq/1057138/

Microsoft Surface

Boot directly from USB

Microsoft's documented procedure is:

  1. Shut Surface down.
  2. Insert the bootable USB device.
  3. Hold Volume Down.
  4. While holding Volume Down, press and release Power.
  5. Continue holding Volume Down until startup proceeds.

Enter Surface UEFI

  1. Shut Surface down.
  2. Hold Volume Up.
  3. Press and release Power.
  4. Continue holding Volume Up until Surface UEFI opens.

Official Microsoft source for both procedures: https://support.microsoft.com/en-us/surface/drivers-firmware/boot-surface-from-a-usb-device

Microsoft also documents a Windows path on supported Surface devices:

Settings → System → Recovery → Advanced startup → Restart now → Use a device → USB Storage

Same source: https://support.microsoft.com/en-us/surface/drivers-firmware/boot-surface-from-a-usb-device

Framework

Framework's community BIOS guide documents:

  • F2 — BIOS Setup.
  • F12 — one-time boot override.
  • Fn+Esc — toggles Fn Lock; with Fn Lock enabled, use Fn+F2 / Fn+F12 as appropriate.

Helpful Framework community reference: https://community.frame.work/t/bios-guide/4178

Source-quality note: This is a Framework Community guide rather than a current Framework Knowledge Base article, so it should be labeled as community/helpful documentation rather than manufacturer KB documentation.

System76

System76 publishes an unusually useful model/firmware table.

Open Firmware laptops

Boot menu: Esc, then choose One Time Boot or use Boot Override.

Firmware interface: Esc.

Proprietary-firmware laptops

Boot menu: F7.

BIOS: F2.

Thelio

Boot menu: F8, F11, or F12, depending on motherboard/model.

Firmware: Del or F2.

Meerkat

Boot menu: F10.

Firmware: F2.

Official System76 boot-menu table: https://support.system76.com/support/boot-menu/

Pop!_OS Secure Boot exception

System76 currently states that Secure Boot must be disabled before installing Pop!_OS. This is an operating-system-specific requirement, not a universal rule for USB booting.

Official System76 installation documentation: https://support.system76.com/support/install-pop/

MSI

MSI documents the following for USB OS installation/troubleshooting:

  • Repeatedly tap F11 during startup to open boot-device selection.
  • Repeatedly tap Delete to open BIOS.
  • MSI's current guidance defaults USB boot to UEFI mode.

Official MSI source: https://us.msi.com/support/technical_details/NB_OS_USB_Device_Detection

MSI also documents selecting UEFI: USB Flash Drive from the F11 menu during Windows installation: https://www.msi.com/support/technical_details/VGA_OS_Installation

Gigabyte and AORUS

Current Gigabyte motherboard/desktop manuals document:

  • Del — BIOS Setup / Q-Flash.
  • F12 — one-time Boot Menu.
  • Selecting a device from the F12 menu applies only to that startup; it does not permanently rewrite the normal boot order.

Official Gigabyte manual: https://download.gigabyte.com/FileList/Manual/desktop_pc_manual_ai-top-100-z890_1003_e.pdf?v=2491dd10a46725c03eefd1eaf13abca4

Another Gigabyte motherboard manual with the same keys: https://download.gigabyte.com/FileList/Manual/mb_manual_a520m-k-series_e_1101.pdf

ASRock

ASRock's own FAQ documents:

  • F2 — BIOS setup.
  • F11 — Boot Menu.

Official source: https://www.asrock.com/support/faq.asp?id=181

ASRock also documents selecting USB from its boot menu: https://asrock.com/support/faq.asp?id=27

Some very old ASRock boards also accepted F8; use the current model manual rather than assuming F8 applies to modern boards.

Samsung PCs

Samsung's current PC support article says:

  1. Connect properly configured boot media.
  2. Power the PC on.
  3. Immediately and repeatedly press F10 until the boot menu appears.
  4. Select the desired boot device.

Official Samsung source: https://www.samsung.com/us/support/answer/ANS10002820/

Because Samsung's support article is specifically authoritative for the boot menu, this guide does not claim a universal BIOS-setup key for every Samsung PC generation. Check the exact model manual when firmware setup is needed.

Dynabook and Toshiba

Dynabook documents F12 for the startup Boot Menu on supported Windows-era systems: https://support.dynabook.com/support/viewContentDetail?contentId=4009420

Older Toshiba hardware spans many BIOS generations and should be treated as model-specific. If the machine does not respond to F12, use the exact model's Dynabook/Toshiba manual rather than cycling through guessed keys.

Sony VAIO

VAIO behavior differs substantially by generation.

VAIO Care Rescue-era systems

Sony documents a VAIO Care Rescue screen where:

  • F11 — Start from media (USB device/optical disc).
  • F12 — start from network.
  • F2 — start BIOS.

Official Sony source: https://www.sony.com/electronics/support/laptop-pc-svf-series/svf14n13cls/articles/00020285

Sony also documents using the ASSIST button while powered off on some Windows 8-era systems, then selecting Start from media (USB device/optical disc) [F11]: https://www.sony.com/electronics/support/articles/S1F1313

Older BIOS-controlled VAIO systems

Sony documents F2 at the VAIO logo to enter BIOS and enabling External Device Boot where required: https://www.sony.com/electronics/support/articles/00030199

Because these procedures are generation-specific, there should be no article-wide statement that “all VAIOs use F11/F12.”

Intel NUC and ASUS NUC

Intel's traditional NUC firmware and ASUS's inherited NUC documentation both use F2 for BIOS Setup on supported models.

Intel source: https://www.intel.com/content/www/us/en/support/articles/000006028/intel-nuc.html

ASUS NUC source: https://www.asus.com/us/support/faq/1052524/

On supported NUC firmware, F10 opens the Boot Menu. ASUS's NUC UEFI Shell guide documents F10 during startup for Boot Menu access: https://www.asus.com/us/support/faq/1052381/

NUC USB not appearing

Intel documents disabling Fast Boot and ensuring USB is enabled in firmware when a NUC Laptop Kit does not show the USB flash drive: https://www.intel.com/content/www/us/en/support/articles/000087831/intel-nuc.html

Apple Macs

Intel-based Mac

Apple documents:

Hold Option (⌥) or Alt during startup to open Startup Manager and choose another available startup disk or volume.

Official Apple source: https://support.apple.com/en-ie/102603

Intel Mac with Apple T2 Security Chip

T2 Macs have a separate Allowed Boot Media policy. If external boot is blocked, use macOS Recovery and Startup Security Utility to permit external/removable media.

Apple security documentation: https://support.apple.com/guide/security-pdf/startup-security-utility-secc7b34e5b5/web

Apple external-startup-disk support article: https://support.apple.com/en-gb/111336

Do not automatically set T2 Secure Boot to No Security. Apple documents media boot policy and Secure Boot policy as separate controls.

Apple silicon: M1, M2, M3, M4, M5 and later

Apple documents this startup method:

  1. Turn on the Mac and continue holding the Power button.
  2. Release it when Startup Options appears.
  3. Select another startup disk or choose Options for recovery tools.

Official Apple source: https://support.apple.com/en-ie/102603

Apple silicon does not use the same external-media policy as Intel T2 Macs. Apple's security documentation explicitly notes that the T2 media-boot policy is not required on Apple silicon.

Source: https://support.apple.com/guide/security-pdf/startup-security-utility-secc7b34e5b5/web

Chromebooks

Chromebooks are not conventional PC UEFI systems and should not be reduced to a generic “press F12” instruction.

Developer Mode / external boot

Chromium's developer documentation states:

  1. Enter Recovery Mode.
  2. Use Ctrl+D, then confirm, to enter Developer Mode on supported hardware.
  3. Once Developer Mode is enabled, Ctrl+U can boot from external USB/SD media only after crossystem dev_boot_usb=1 has been set.

Official Chromium documentation: https://www.chromium.org/chromium-os/developer-library/guides/debugging/debug-buttons/

Chromium warns that Developer Mode disables security features. Device behavior also varies by Chromebook generation and firmware.

Managed school/business devices may prohibit these changes through administrative policy.

Raspberry Pi

Raspberry Pi systems do not use PC-style BIOS hotkeys.

Raspberry Pi 4 and later

Raspberry Pi documents boot-order configuration through raspi-config:

sudo raspi-config

Then:

Advanced Options → Boot Order

Official Raspberry Pi documentation: https://www.raspberrypi.com/documentation/configuration/usb.md

The same documentation explains that Raspberry Pi 4 and later use configurable boot order and can attempt USB/network boot depending on the EEPROM configuration.

Raspberry Pi 3 family

Do not group all Pi 3 models together. USB boot capabilities differ by exact model and boot configuration. Consult the current Raspberry Pi bootloader/USB documentation before setting OTP values.

Official documentation: https://www.raspberrypi.com/documentation/configuration/usb.md

Raspberry Pi Secure Boot

It is no longer accurate to say “Raspberry Pi has no Secure Boot.” Raspberry Pi now documents a secure-boot architecture using a hardware root of trust and OTP-stored public-key hashes on supported platforms.

Official Raspberry Pi security architecture: https://www.raspberrypi.com/documentation/security/security-architecture.html

Secure Boot Provisioner: https://www.raspberrypi.com/documentation/security/secure-boot-provisioner.html

PINE64 / Pinebook Pro

PINE64 devices are not one generic PC platform. Boot behavior depends on the SoC, installed bootloader, SPI contents and device model.

Pinebook Pro

PINE64 documents the RK3399 hardware boot sequence as:

SPI NOR → eMMC → SD → USB OTG

but the bootloader installed on the device can create a different user-visible boot order.

PINE64 bootable-storage documentation: https://pine64.org/documentation/Pinebook_Pro/Features/Bootable_storage/

RK3399 boot-sequence documentation: https://pine64.org/documentation/General/RK3399_boot_sequence/

PINE64 also documents that not every physical USB connector on the Pinebook Pro has the same boot capabilities. Therefore a blanket instruction such as “insert any USB and it boots automatically” is not reliable.

Servers and Workstations

Dell PowerEdge

Dell documents:

  • F2 — System Setup.
  • F10 — Lifecycle Controller on supported systems.
  • F11 — Boot Manager.
  • F12 — PXE Boot.

Official Dell PowerEdge source: https://www.dell.com/support/kbdoc/en-us/000176910/how-to-boot-into-the-bios-or-the-lifecycle-controller-on-your-poweredge-server

Dell's PowerEdge BIOS/UEFI manuals further document F11 → Boot Manager → One-shot Boot Menu for a temporary boot device: https://www.dell.com/support/manuals/en-us/poweredge-xr11/pexr11_bios_ism_pub/boot-manager?guid=guid-772cb380-431b-48e0-ac2b-bd5e662049bf&lang=en-us

HPE ProLiant Gen10 / Gen10 Plus

HPE documents an F11 One-Time Boot Menu prompt on supported ProLiant/Synergy systems.

Official HPE source: https://support.hpe.com/hpesc/public/docDisplay?docId=a00112581en_usen_us&docLocale=en_US&page=GUID-C4023994-3C36-434A-B288-8DD7132A2B50.html

Older/newer ProLiant generations can differ, so use the generation's UEFI System Utilities guide rather than assuming all ProLiant systems share the same startup screen.

Lenovo ThinkSystem

Lenovo's ThinkSystem UEFI documentation shows:

  • F1 — Enter Setup.
  • F12 — Boot Menu.
  • F10 — Network Boot.

Official Lenovo ThinkSystem source: https://pubs.lenovo.com/hs350x-v3/thinksystem_hs350xv3_uefi_user_guide.pdf

Secure Boot: What It Actually Does

Secure Boot verifies signatures on pre-operating-system software. It does not mean “USB drives are disabled.”

Microsoft Secure Boot documentation: https://learn.microsoft.com/en-us/windows-hardware/drivers/bringup/secure-boot

Microsoft Trusted Boot overview: https://learn.microsoft.com/windows/security/operating-system-security/system-security/trusted-boot

Linux and Secure Boot

Ubuntu documents Microsoft-signed shim binaries and Canonical-signed GRUB/kernel components for Secure Boot-capable systems: https://documentation.ubuntu.com/security/security-features/platform-protections/secure-boot/

Pop!_OS is an example of a distribution whose current installation instructions specifically require Secure Boot to be disabled: https://support.system76.com/support/install-pop/

Therefore the correct rule is:

  1. Try the USB with Secure Boot enabled.
  2. Check the operating system/tool's own documentation.
  3. Disable Secure Boot only when that media actually requires it.
  4. Restore the original security configuration afterward when appropriate.

UEFI vs Legacy BIOS / CSM

Modern operating systems should normally boot in UEFI mode.

Legacy BIOS compatibility may be labeled:

  • Legacy Boot
  • CSM
  • Compatibility Support Module
  • Legacy Option ROMs

Do not enable CSM merely because a USB drive is not showing up. Some current hardware has removed Legacy BIOS support entirely.

Intel NUC documentation, for example, explicitly notes that Legacy mode is available only where supported: https://www.intel.com/content/www/us/en/support/articles/000092463/intel-nuc.html

Changing the firmware boot mode can also make the currently installed operating system temporarily unbootable if that OS was installed for the other mode.

USB Filesystem Compatibility

The previous simplistic rule “FAT32 = Secure Boot; NTFS = no UEFI” is incorrect.

The UEFI specification requires firmware support for the EFI FAT filesystem family. UEFI 2.10 states that EFI firmware must support FAT12, FAT16 and FAT32 variants of the EFI filesystem.

UEFI specification: https://uefi.org/specs/UEFI/2.10/13_Protocols_Media_Access.html

UEFI 2.10 PDF: https://uefi.org/sites/default/files/resources/UEFI_Spec_2_10_Aug29.pdf

Practical table

Format / image layout Practical guidance
FAT32 Safest general filesystem when relying on standard UEFI removable-media filesystem support
FAT16 / FAT12 Also part of the UEFI EFI-filesystem requirement; mostly relevant to smaller/older media
NTFS Not required by the UEFI specification; some firmware supports it and some boot tools load their own NTFS driver
exFAT Not required as a generic UEFI boot filesystem; do not assume firmware can boot it
Hybrid ISO image Common for Linux installation media intended to be written directly to the whole USB device

Secure Boot is separate from filesystem format. A FAT32 device is not automatically trusted by Secure Boot, and Secure Boot is not simply “FAT32 required.”

Ventoy

Ventoy allows multiple ISO/WIM/IMG and other supported images to coexist on a reusable boot drive.

Official project: https://www.ventoy.net/

Ventoy Secure Boot

Ventoy's own Secure Boot documentation says Secure Boot support is available but not perfect on every machine. It may require key enrollment, and some systems require Allow Microsoft 3rd Party UEFI CA.

Ventoy Secure Boot documentation: https://ventoy.net/en/doc_secure.html

Ventoy also notes that version 1.1.14 introduced a new UEFI Secure Boot CA and that the new key must be enrolled on first boot on affected configurations.

Ventoy release notes: https://www.ventoy.net/en/doc_news.html

Do not describe Ventoy Secure Boot as “works universally.” Ventoy itself does not make that claim.

If the USB Drive Does Not Appear

1. Verify that the USB is actually bootable

Copying an ISO file onto an ordinary USB filesystem does not normally make the device bootable unless the boot tool specifically uses that design, such as Ventoy.

Use the operating-system publisher's recommended image-writing method.

2. Try another USB port

This is explicitly included in MSI's USB-detection troubleshooting procedure: https://us.msi.com/support/technical_details/NB_OS_USB_Device_Detection

Avoid hubs and docks during troubleshooting when possible.

3. Shut the system down fully

Several vendors instruct users to begin their boot-menu procedure from a full shutdown, including ASUS and Surface.

ASUS: https://www.asus.com/support/faq/1013017/

Microsoft Surface: https://support.microsoft.com/en-us/surface/drivers-firmware/boot-surface-from-a-usb-device

4. Disable Fast Boot only if it is interfering with detection

Do not confuse Windows Fast Startup with firmware Fast Boot; both can affect troubleshooting in different ways.

ASUS documents disabling firmware Fast Boot here: https://www.asus.com/support/faq/1044641/

Intel documents a NUC case where disabling Fast Boot restores USB boot-device visibility: https://www.intel.com/content/www/us/en/support/articles/000087831/intel-nuc.html

5. Use a wired keyboard during firmware startup

Firmware may not initialize Bluetooth keyboards early enough. Intel/ASUS NUC documentation explicitly warns that a Bluetooth keyboard cannot be used to access BIOS in the cited troubleshooting path: https://www.asus.com/us/support/faq/1052670/

6. Check the CPU architecture

Boot media must contain software for the machine's architecture. An x86-64 installer is not automatically bootable on ARM64 hardware such as Apple silicon, Raspberry Pi, or many Snapdragon PCs.

For Macs, Apple's startup documentation distinguishes Intel from Apple silicon and gives different startup procedures: https://support.apple.com/en-ie/102603

7. Look for a UEFI-prefixed USB entry

Some firmware exposes both UEFI and legacy paths for the same physical device. Prefer the UEFI path for current operating systems unless the software documentation says otherwise.

ASRock explicitly shows choosing a UEFI: installation-media entry in current Windows installation guidance: https://www.asrock.com/support/faq.asp?k=boot+usb

MSI likewise documents selecting UEFI: USB Flash Drive: https://www.msi.com/support/technical_details/VGA_OS_Installation

Windows: Boot From USB Without Racing a Function Key

On supported systems Windows Recovery / Advanced Startup can provide a firmware or device-selection path.

Microsoft's Surface documentation gives a concrete example:

Settings → System → Recovery → Advanced startup → Restart now → Use a device → USB Storage

Source: https://support.microsoft.com/en-us/surface/drivers-firmware/boot-surface-from-a-usb-device

Windows also provides UEFI Firmware Settings through Windows Recovery Environment on supported UEFI PCs. Because the exact menu availability depends on the hardware and installation, this guide does not promise the option exists on every PC.

Microsoft recovery overview: https://support.microsoft.com/en-us/windows/experience/backup-recovery/recovery-options-in-windows

BIOS Flashback and Firmware Recovery Are Not USB Boot

Motherboard firmware-recovery features often use a USB drive but are not the same operation as booting an operating system from USB.

Treat them as separate procedures and follow the exact motherboard manual. Never substitute a generic filename or pin-short procedure for model-specific instructions.

This distinction matters because a normal USB boot goes through the machine's firmware boot manager; BIOS Flashback may run from a dedicated embedded controller with no operating system involved.

Legacy and Obscure Hardware: Do Not Invent a Universal Key

The following brands span too many unrelated generations or ownership/manufacturing arrangements to justify a single cross-model key without model-specific documentation:

  • Gateway
  • Packard Bell
  • eMachines
  • very old Toshiba systems
  • early IBM/Lenovo desktops and notebooks
  • miscellaneous white-box PCs
  • rebadged retail laptops

For these systems, identify the exact model number, then use:

  1. the original manual if still available;
  2. the manufacturer's archived support page;
  3. an archived manual from a reputable manual repository when the manufacturer documentation is gone;
  4. the key prompt displayed during POST.

A model-specific source is better than a confident but invented universal shortcut.