MokManager passwords cannot be removed because they are not stored on disk but generated dynamically during the Secure Boot enrollment process. To regain access, you must either know the current password to enroll your keys or disable Secure Boot in the UEFI firmware settings entirely.
Understanding MokManager and Secure Boot
The Machine Owner Key (MOK) manager is a component of Shim, which is a small bootloader used to enforce Secure Boot policies on Linux systems. When you install third-party drivers, such as NVIDIA proprietary modules or VirtualBox extensions, the system requires you to enroll a signing key. This process prompts for a temporary password, known as the MOK password.
This password is never saved to the hard drive. It exists only in the volatile memory of the boot process. Consequently, there is no command-line utility that can "delete" or "remove" this password from the system configuration. The security model relies on the fact that if an attacker gains physical access to the machine, they would need the password to persistently modify the boot chain. If you have forgotten this password, the standard recovery path involves bypassing the requirement entirely through hardware-level changes.
Option 1: Disabling Secure Boot in UEFI
The most reliable method to resolve this issue without the password is to turn off Secure Boot in your computer’s BIOS or UEFI settings. This action allows the system to boot unsigned kernels and modules, effectively rendering the MOK manager prompt irrelevant for future boots.
- Restart your computer and press the key to enter the BIOS/UEFI setup. Common keys include
F2,F10,Delete, orEsc, depending on the manufacturer. - Navigate to the Security or Boot tab using the arrow keys.
- Locate the Secure Boot option. It may be nested under a submenu like "Boot Configuration" or "Authentication."
- Change the setting from Enabled to Disabled.
- Save changes and exit. The system will reboot.
After disabling Secure Boot, you should be able to boot into your operating system normally. However, note that some software, such as certain DRM-protected media players or enterprise security tools, may require Secure Boot to be enabled. If you rely on these applications, this option may not be suitable for your workflow.
Option 2: Enrolling Keys Without the Password
If you must keep Secure Boot enabled, you can attempt to enroll the necessary keys again. In some cases, if the previous enrollment was incomplete, the system might allow you to reset the state. However, this typically requires knowing the original password or having access to the enrolled key files.
You can check the status of your enrolled keys by booting into your Linux environment and running the following command:
mokutil --list-enrolledIf the output shows empty or unexpected keys, you may need to re-run the installation script for the driver that triggered the initial prompt. For example, if it was a graphics driver, reinstalling the package might trigger a new enrollment prompt. If you do not remember the password, you cannot complete this step successfully unless you can revert to a previous state where Secure Boot was not enforced.
Preventing Future Lockouts
To avoid this situation in the future, consider documenting the MOK password you create during driver installations. Alternatively, you can use a hardware token or TPM-based attestation if your motherboard supports it, though this is less common for standard desktop users.
For more information on managing user permissions and authentication, you might find Could Unforeseen Issues Arise When Changing Sudo Required Access Pass Command? helpful, as it discusses broader authentication management in Linux environments.
Why You Cannot Simply Delete the Password
Many users search for commands like mokutil --remove-password or similar variations. These commands do not exist. The design philosophy of Shim and MokManager is that the password is a transient challenge-response mechanism. Once the key is enrolled, the password is discarded from memory. There is no persistent storage entry to delete.
Attempting to hack the GRUB configuration to bypass this check is risky and often fails because Shim validates signatures before handing control to GRUB. Modifying grub.cfg directly, as discussed in Linux Boots Grub - How to Fix a Broken grub.cfg, will not remove the MOK prompt if Secure Boot remains active in the firmware.
Frequently Asked Questions
Can I recover the forgotten MokManager password?
No, the password is not stored anywhere on the disk and cannot be recovered. It is generated randomly each time the enrollment process is initiated. If you did not write it down, it is permanently lost.
Will disabling Secure Boot affect my Windows installation?
Disabling Secure Boot generally does not break your Windows installation, provided you are not using features that strictly require it, such as Windows Hello fingerprint readers or certain BitLocker configurations. Most standard Windows installations will boot normally.
Is it safe to leave Secure Boot disabled?
For most home users, leaving Secure Boot disabled is safe and has minimal impact on daily usage. However, it reduces protection against low-level rootkits and bootkit malware. Enterprise environments usually mandate it for compliance.
How do I re-enable Secure Boot after disabling it?
You can re-enable it in the same BIOS/UEFI menu where you disabled it. Keep in mind that if you have already installed unsigned drivers while Secure Boot was off, you may need to re-enroll those keys when you turn it back on.
What if I am locked out of my Linux system completely?
If the system refuses to boot due to missing keys and you do not have the password, you must disable Secure Boot in the UEFI firmware. This is the only supported method to regain boot access without the original enrollment credentials.