You install a Windows update, restart, and the GRUB menu that let you choose between Linux and Windows has vanished. The PC boots straight into Windows, or stops with a message about a security policy violation. GRUB missing after Windows update looks alarming, but in most cases both operating systems are intact and only the path to the boot menu has changed. This guide explains the usual causes on modern UEFI computers and older BIOS machines, how to restore GRUB safely and what to check before you start.
GRUB missing after Windows update: why it happens
On a UEFI computer each operating system installs its own boot loader on the EFI system partition, and the firmware keeps a list of boot entries in a set order. Dual boot works when the Linux entry (shim and GRUB) comes first and GRUB offers Windows as a choice. Three things commonly break it:
- The boot order changed. Large Windows updates can put Windows Boot Manager back at the top of the firmware's list. GRUB is still installed; it is simply no longer started.
- Secure Boot revocations. In August 2024 a Windows security update applied a Secure Boot policy (SBAT) to some dual-boot PCs it should have skipped, and Linux stopped with "Verifying shim SBAT data failed: Security Policy Violation". Later Windows updates stopped applying that setting, and updated shim and GRUB packages from Linux distributions satisfy it. Similar revocations will happen again as old boot loaders are retired, so an out-of-date Linux installation is the one most likely to be refused.
- Legacy BIOS systems. On older PCs that start from a master boot record, a Windows repair or reinstall can overwrite the MBR boot code and replace GRUB with the Windows loader.
First checks before any repair
- Open the firmware boot menu. Most PCs show a one-time boot menu on a key such as F12, F11 or Esc at power-on. If an entry for your Linux distribution is listed and starts GRUB, the only fix needed is the UEFI boot order.
- Find your BitLocker recovery key. Changing boot entries or Secure Boot settings can make Windows ask for it at the next start. On business PCs it is often stored in the company's Microsoft Entra ID or Active Directory, on personal ones in the user's Microsoft account. Without the BitLocker recovery key an encrypted drive cannot be read.
- Turn off Windows Fast Startup if Linux needs to write to the Windows partition, because a hibernated Windows partition is locked against changes.
- Note the exact error message. "Security Policy Violation", a grub rescue> prompt and a silent boot into Windows point to different fixes.
How to restore GRUB on a UEFI computer
If Linux starts from the firmware menu, you can fix the order from inside Linux. The efibootmgr command lists the boot entries and the current BootOrder, and efibootmgr -o followed by the entry numbers in the order you want, Linux first, makes the change permanent. Some firmware ignores that and resets the order, in which case the setting has to be changed in the firmware setup screen itself.
A GRUB restore only rewrites boot files and boot entries; documents and programs on both systems stay where they are. If Linux does not start at all, boot a live USB of the same distribution, mount the installed system and its EFI system partition, and repair GRUB from a chroot. On Debian and Ubuntu that means reinstalling the shim and GRUB EFI packages or running grub-install, followed by update-grub. For the SBAT error, the documented workaround is to disable Secure Boot briefly, start Linux, install all pending updates including shim, then switch Secure Boot back on.
The community Linux Boot-Repair tool automates many of these steps from a live session. It works well on simple layouts, but read what it proposes before accepting, especially on encrypted disks, RAID arrays or machines with more than two operating systems. If you would rather not work in a chroot at all, this is exactly the kind of job our GRUB and MBR repair service handles.
Windows missing from the GRUB menu: the os-prober setting
Sometimes GRUB appears but lists only Linux. Since GRUB 2.06, the os-prober step that looks for other operating systems is disabled by default for security reasons, so update-grub no longer adds Windows by itself. Setting GRUB_DISABLE_OS_PROBER=false in /etc/default/grub and running update-grub again brings the entry back. Alternatively, leave GRUB as it is and choose Windows from the firmware boot menu when you need it.
When the fix is on the Windows side
If Windows itself no longer starts, its boot files on the EFI partition may be damaged. From the Windows Recovery Environment, the bcdboot command rebuilds them from the Windows folder, as described in Microsoft's BCDBoot documentation. On legacy BIOS computers, bootrec /fixmbr restores the Windows MBR code, which also takes GRUB out of the boot path, so plan to restore GRUB afterwards if you still want the menu. The same tools that fix Windows boot problems can remove the Linux entry, so check your backups before running them.
Frequently asked questions: grub missing after windows update
Can I fix this without a live USB?
Often, yes. If Linux still starts from the firmware boot menu, the order can be corrected from inside Linux with efibootmgr or in the firmware settings. A live USB is only needed when Linux does not start at all.
Should I disable Secure Boot permanently to avoid this?
Better not. Secure Boot protects against malware that loads before the operating system. Keep Linux updated so its signed shim and GRUB are accepted, and switch Secure Boot off only briefly when a repair requires it.
Dual boot not working after a BIOS update: is it the same problem?
Often, yes. Firmware updates can reset the boot order, drop custom boot entries or restore Secure Boot defaults. The same checks apply: look at the firmware boot menu first, then fix the order with efibootmgr or recreate the Linux entry.
How can I stop the next update from breaking dual boot?
Keep both systems updated, store the BitLocker recovery key somewhere you can reach from another device, and check the boot order once after large Windows updates. Installing each operating system on its own drive also limits how much one update can change.
Stuck at a boot error on a PC or server in Los Angeles? Our GRUB repair service covers Linux, Windows and dual-boot machines on UEFI and older BIOS systems, and if the drive shows signs of failure we copy your data first. When the cause turns out to be hardware, our computer and laptop repair service is the next step. Contact us with a photo of the exact error message.
