How to Install Ubuntu 26.04 LTS Alongside Windows or on a Mac

To install Ubuntu, download Ubuntu 26.04.1 LTS from ubuntu.com/download/desktop, verify the ISO against Canonical's signed checksums, write it to a USB stick and boot from it. On a Windows PC, save your BitLocker recovery key and shrink the Windows partition first, then pick "Install Ubuntu alongside" in the installer. On an Apple silicon Mac, run Ubuntu in a virtual machine.

This guide covers each route: a clean install, dual boot with Windows 11, an Intel Mac, an Apple silicon Mac and a virtual machine. Every command and installer step comes from Canonical's, Microsoft's or Apple's own documentation, linked in the sources, and every step that touches a disk carries a warning. It ends with the hardening most guides skip.

Key takeaways

• The current LTS is Ubuntu 26.04.1 LTS (Resolute Raccoon), supported until April 2031.
• Download only from ubuntu.com, then verify the signed SHA256SUMS and the ISO.
• Find your BitLocker recovery key before you change anything. Microsoft Support states it cannot retrieve, provide or recreate a lost key.
• Shrink Windows from inside Windows, with Disk Management or diskpart, so Ubuntu gets clean unallocated space.
• Keep Secure Boot on. Ubuntu boots under Secure Boot through a Microsoft signed shim and a Canonical signed GRUB.
• Choose disk encryption in the installer. Hardware-backed (TPM) encryption cannot be turned on or off after installation, and Ubuntu's docs list real limitations.
• Apple silicon Macs are VM territory. Canonical does not support Ubuntu on them directly.
• After the first boot: install updates, confirm unattended-upgrades, enable ufw, and consider Livepatch through the free personal Ubuntu Pro tier.

Which Ubuntu version should you install?

Install the LTS release unless you have a specific reason not to. Ubuntu's download page lists Ubuntu 26.04.1 LTS as "the latest LTS version of Ubuntu, for desktop PCs and laptops." The 26.04 release notes are dated 23 April 2026 and state that the release "will be supported until April 2031." With Ubuntu Pro, the release notes say security maintenance extends to ten years, while the download page says "up to 15 years." If that horizon matters, check the current Ubuntu Pro terms.

The download page also offers Ubuntu 26.10, an interim release with nine months of updates, until July 2027.

The hardware floor is the same for both. The 26.04 release notes ask for a 2 GHz dual-core processor, at least 6 GB of RAM and 25 GB of free storage "for a comfortable experience." For machines with as little as 2 GB of RAM they suggest a flavor such as Xubuntu or Lubuntu. An internet connection helps but is not required.

There are two download architectures. Use Intel or AMD 64-bit (amd64) for almost every PC and for Intel Macs. The ARM 64-bit (arm64) image is, per the release notes, a generic ARM64 desktop ISO "targeting VMs, ACPI + EFI platforms and Snapdragon based WoA devices." That is the image you want for a virtual machine on an Apple silicon Mac.

Which install route fits your machine?

What should you do before installing Ubuntu?

1. Back up your data. Ubuntu's tutorial says to move anything you want to keep to an external disk before you start, and to back up the USB stick you will use, because it will be erased.
2. Find your BitLocker recovery key if this is a Windows PC (details in the dual boot section below).
3. Check the hardware. Canonical recommends devices on its certified hardware list. If yours is not there, use "Try Ubuntu" from the USB stick and check Wi-Fi, sound, suspend and graphics before installing.
4. Have an 8 GB or larger USB stick and plug the PC into power.
5. Write down how to reach your boot menu. Ubuntu's tutorial says F12 is most common on PCs, with Escape, F2 and F10 as alternatives. On a Mac it is the Option key.

How do you download Ubuntu from the official source?

Use the official download page at ubuntu.com/download/desktop. It links the amd64 and arm64 images for both the LTS and interim releases, plus an "alternative downloads" page with torrents, a network installer and Canonical's own list of mirrors.

Canonical also publishes each release directory with its checksum files. For 26.04 the amd64 desktop image, its SHA256SUMS and SHA256SUMS.gpg sit at releases.ubuntu.com/26.04. The arm64 desktop image is in the matching directory on Canonical's cdimage server, reached through the arm64 download button. When we checked on 23 October 2026, the files were named:

ubuntu-26.04.1-desktop-amd64.iso
ubuntu-26.04.1-desktop-arm64.iso

Treat any other "Ubuntu download" site with suspicion. Type ubuntu.com yourself rather than clicking a search ad, because lookalike sites are a common way to deliver tampered installers, and an OS installer is the most privileged file you will ever run. We do not link third-party mirrors. Whichever source you use, including torrents and mirrors on Canonical's own list, verify the image as below. Get the USB writing tool from its own website too, since it runs with administrator rights.

How do you verify the Ubuntu ISO?

First prove the checksum file was signed by Canonical, then prove your ISO matches it. Canonical's verification tutorial notes the GPG check works "no matter where/how it was downloaded."

On Ubuntu or another Linux system

Put the ISO, SHA256SUMS and SHA256SUMS.gpg in one directory, then check the signature on the checksum file:

gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS

If gpg reports "Can't check signature: No public key", the message tells you which key IDs signed the file. Canonical's tutorial shows how to fetch them from the Ubuntu keyserver, using the IDs from your own error message:

gpg --keyid-format long --keyserver hkp://keyserver.ubuntu.com --recv-keys 0x<KEY_ID>
gpg --keyid-format long --list-keys --with-fingerprint 0x<KEY_ID>

Compare the printed fingerprint with the one in Canonical's tutorial, then run the --verify command again. You want "Good signature from Ubuntu CD Image Automatic Signing Key." The tutorial explains that the "not certified with a trusted signature" warning that follows only means you have not countersigned the key yourself.

Now check the ISO against the verified checksum file:

sha256sum -c SHA256SUMS 2>&1 | grep OK

You want a line with your ISO's file name followed by OK. The tutorial is explicit that any other result means the file "has been altered, or it downloaded incorrectly", and that you should download a fresh copy from a known good source.

On Windows

PowerShell's Get-FileHash uses SHA256 by default, according to Microsoft's documentation:

Get-FileHash .\ubuntu-26.04.1-desktop-amd64.iso

Compare the Hash with the line in SHA256SUMS. That checks integrity only; run the gpg step under WSL or on Linux to check authenticity.

On macOS

Canonical's tutorial installs GnuPG and sha256sum with Homebrew:

brew install gnupg
brew install coreutils

Then run the same gpg --verify and sha256sum -c commands as on Linux.

How do you create a bootable Ubuntu USB stick?

Warning: writing the image erases the USB stick completely. Every tool below lists your internal disk next to the USB stick. Select the stick, not the disk with your running system.

Writing an ISO is not the same as copying it. Ubuntu's Desktop documentation names a tool per platform.

On Windows, the tutorial uses Rufus, downloaded from the project's own website:

1. Launch Rufus and insert the USB stick. Check the Device field shows the right stick.
2. Click SELECT next to Boot selection and pick the Ubuntu ISO.
3. If the stick has failed to boot before, set Partitioning scheme to GPT and check Target system reads UEFI (non CSM).
4. Click START. When Rufus reports an ISOHybrid image, confirm Write in ISO Image mode.
5. Confirm the data destruction warning only after checking the device again. Writing takes around ten minutes; close Rufus when the status reads READY.

On macOS, the tutorial uses balenaEtcher from its own website, choosing the arm64 build on Apple silicon and the Intel build on an Intel Mac. Click Flash from file, choose the ISO, click Select target, choose the USB stick, then click Flash!

On Ubuntu, open the Disks app, select the USB stick in the sidebar, choose Restore Disk Image from the drive menu, pick the ISO and click Start Restoring. Eject the stick when the progress bar finishes.

How do you do a clean install of Ubuntu on a PC?

A clean install replaces whatever is on the target drive. Insert the stick and restart; if the installer does not start, hold your boot menu key and pick the USB device. Ubuntu's 26.04 Desktop tutorial lists the screens in this order:

1. Language, accessibility settings and keyboard layout.
2. Network (optional), so the installer can fetch updates and drivers such as NVIDIA's.
3. Try Ubuntu or Install Ubuntu. Trying changes nothing and is the best hardware test you have.
4. Interactive or automated (autoinstall) installation. Pick interactive for a single PC.
5. Default or Extended app selection.
6. Third-party software for graphics, Wi-Fi and media formats, which the tutorial recommends enabling.
7. Disk setup. This is the step that matters most.

Warning: if the installer reports Intel RST (Rapid Storage Technology), stop. Ubuntu does not support RST and will not continue until you switch the controller to AHCI. On a PC that also runs Windows, follow the AHCI steps in the dual boot section first, or Windows may stop booting.

Erase disk and install Ubuntu

Warning: "Erase disk and install Ubuntu" deletes everything on the selected drive. If the PC has more than one drive, check the drive model and size twice before continuing.

This gives Ubuntu the whole drive. On a PC with several drives you choose which, which is also a clean way to run Ubuntu next to Windows. Choose encryption here (next section), then set your name, computer name, user name and a strong password. The tutorial recommends keeping Require my password to log in on for any machine you travel with. Pick your time zone, review the summary, and click Install. When it finishes, click Restart Now, remove the USB stick when asked, and press Enter.

Which disk encryption should you choose in the Ubuntu installer?

Decide this before you click Install. Ubuntu's documentation says hardware-backed encryption "cannot" be enabled or disabled after installation, and the other options are equally hard to change later.

When does TPM-backed encryption work?

Ubuntu's requirements page says most Intel and AMD systems made since 2018 are compatible, and most made since 2021 can unlock automatically. The firmware must be UEFI 2.5 or later with TCG 2.0 family support, the machine needs a TPM 2.0 chip, and Secure Boot must be enabled and in Deployed Mode. Automatic unlocking needs a hardware root of trust: Boot Guard on Intel or Platform Secure Boot on AMD. Without one, the installer makes a PIN or passphrase mandatory.

The TPM how-to says this option sits under Erase disk and install Ubuntu, so it overwrites the whole drive. At the end the installer shows a recovery key: save it off the machine, for example in a password manager. Canonical warns that losing it can mean losing access to your data.

The 26.04 release notes list limitations. If you forget the PIN and unlock with the recovery key, you cannot replace the PIN and must keep using the key. Re-encryption is not supported. The kernel snap may lack modules such as vmd for NVMe RAID, and NVIDIA's are the only out-of-tree drivers supported, so other DKMS drivers will not install. If any of that matters, use the passphrase option.

How do you dual boot Ubuntu alongside Windows 11?

Do these steps in order.

Step 1: Save your BitLocker recovery key

Warning: changing disk layout, firmware settings or the storage controller can make Windows ask for the 48-digit BitLocker recovery key at the next boot. Microsoft Support states it "doesn't have the ability to retrieve, provide, or recreate a lost BitLocker recovery key." Without it, Microsoft says your only option is resetting the device, which removes your files.

Microsoft lists where the key may already be stored:

• Personal Microsoft account: sign in at https://aka.ms/myrecoverykey from another device.
• Work or school account: sign in at https://aka.ms/aadrecoverykey, open Devices, and choose View BitLocker Keys. A managed device may need your IT team.
• A printout or a text file on a USB stick saved when BitLocker was turned on.

You can also print the protectors on the system drive from an elevated Command Prompt, using the -get option documented in Microsoft's manage-bde reference:

manage-bde -protectors -get C:

The numerical password listed there is the recovery key. Store it off the PC, with its key ID.

Step 2: Decide what to do about BitLocker

Ubuntu's own documents differ slightly here.

• The 26.04 release notes say that since Ubuntu 25.04 the installer can install Ubuntu alongside existing BitLocker partitions "if enough unallocated space (or a sufficiently large and resizable partition) is available", and that encrypted installs are now available for dual boot.
• The 26.04 Desktop tutorial and its BitLocker reference page still describe an alert: with BitLocker on, the installer "can't correctly map data, and can't install alongside Windows without data loss." The options are to erase Windows, turn BitLocker off, or use a separate unencrypted disk.

The safe reading: create unallocated space from inside Windows first (Step 4), so the installer never has to resize the encrypted volume. If it still shows the BitLocker alert, follow the tutorial.

To turn BitLocker off, Ubuntu's how-to says: on Windows 11, open Settings, go to Privacy & Security, then Device Encryption, and toggle it off. Wait for decryption, reboot and check your files. Ubuntu warns: "Certain versions of Windows will no longer allow you to re-enable BitLocker after disabling it."

If you only need to stop recovery prompts during a firmware change, Microsoft's manage-bde reference documents a temporary suspension that resumes after a set number of restarts, between 0 and 15. This example suspends protection for one restart:

manage-bde -protectors -disable C: -rebootcount 1

Microsoft notes this leaves "the encryption key available unsecured on drive" until protection resumes, so keep it short.

Step 3: Check the storage controller mode (Intel RST)

Ubuntu does not support Intel RST mode. To check, open Device Manager and look under IDE ATA/ATAPI controllers. If it says anything other than Standard SATA AHCI Controller, Windows has to be prepared before you change the firmware setting.

Warning: switching the firmware to AHCI without preparing Windows can leave Windows unbootable with the stop code INACCESSIBLE BOOT DEVICE. Back up first, and suspend or turn off BitLocker, as Ubuntu's how-to instructs.

Ubuntu's sequence is:

1. In Registry Editor, set Start to 0 under the iaStorV key and the value 0 under its StartOverride subkey to 0; repeat for storahci if present (paths below).
2. Turn off BitLocker and any Intel Optane acceleration.
3. In msconfig, on the Boot tab, enable Safe boot.
4. In firmware setup, change the disk controller to AHCI.
5. Let Windows start in safe mode, then turn Safe boot off in msconfig.
6. Confirm Standard SATA AHCI Controller in Device Manager and reboot.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iaStorV\
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\storahci\

Step 4: Shrink the Windows partition

Warning: shrinking the wrong volume, or a raw partition that holds data, can destroy data. Microsoft's documentation warns that shrinking "a raw partition that contains data, such as a database file" might destroy it. Shrink only the NTFS Windows volume, and only after your backup and recovery key are safe.

Microsoft's guide to shrinking a basic volume gives two ways, both of which move files to free contiguous space without reformatting.

Disk Management: right-click the Windows volume (usually C:), choose Shrink Volume, and enter how much to free: at least 25 GB, more for a development machine.

diskpart: from an elevated Command Prompt:

diskpart
list volume
select volume <volume-number>
shrink desired=<size-in-MB>

Microsoft notes that shrink with no size "reclaims the maximum amount of space possible," and that the volume can only shrink as far as unmovable files such as the page file or shadow copy storage. If the shrink stops short, check the Application log for event ID 259, which names the blocking file. Moving the page file temporarily often helps.

Leave the new space Unallocated; do not format it.

Step 5: Keep Secure Boot on

You do not need to switch Secure Boot off. Ubuntu's security documentation explains the chain: firmware validates a shim binary signed by Microsoft, shim carries Canonical's certificate, and shim then validates GRUB and the kernel signed with Canonical's UEFI key. On amd64 these come from the main archive as shim-signed and grub-efi-amd64-signed.

Check the state from Windows with the PowerShell cmdlet Microsoft documents for this:

Confirm-SecureBootUEFI

True means Secure Boot is on. After Ubuntu is installed, the mokutil manual documents the equivalent:

mokutil --sb-state

Because Windows and Ubuntu share firmware trust lists, Windows updates can change what boots. Our guides to why Windows updates break Linux dual boot and to the 2026 Secure Boot certificate rotation explain how to keep both systems booting.

Step 6: Run the installer and choose "Install Ubuntu alongside"

Boot the USB stick, go through the first screens as in the clean install, and at Disk setup choose the option to install Ubuntu alongside Windows. Ubuntu's tutorial says you then pick the drive and how much space Ubuntu gets, the installer "will preserve all existing files," and it selects the largest partition by default. If the default does not point at your unallocated space, switch to Manual partitioning only if you are comfortable reading partition tables.

Warning: in Manual partitioning, do not format or delete the EFI System Partition, the Windows partition or the small recovery partitions. Canonical describes manual mode as "designed for advanced users."

Since 25.04, encrypted installs and other advanced options are available in dual boot, per the release notes, so you can still choose Encrypt with a passphrase for the Ubuntu side.

Step 7: First boot and checks

You should now see the GRUB menu with Ubuntu and Windows Boot Manager. Boot each once. A suspended BitLocker resumes on its own; if you turned it off, decide whether to turn it back on.

Can you install Ubuntu on an Intel Mac?

Yes, the Ubuntu Desktop tutorial covers booting Apple hardware: restart or power on the Mac with the USB stick inserted while holding Option (also labelled Alt). Startup Manager appears and the stick shows as a gold or yellow icon labelled EFI Boot. Select it to reach the Ubuntu boot menu.

To confirm you have an Intel Mac, Apple says to open About This Mac: an Intel Mac shows Processor followed by an Intel chip name, while an Apple silicon Mac shows Chip.

On Macs with the Apple T2 Security Chip, Apple says the default "most secure setting" disallows booting from external media. Start up from macOS Recovery, open Startup Security Utility from the Utilities menu, and allow external boot media. Apple describes its Secure Boot levels only in macOS and Windows terms and does not say which one Ubuntu needs, so change only what the Mac actually refuses.

Use Try Ubuntu first and test Wi-Fi, keyboard, trackpad, audio and sleep. Ubuntu's tutorial does not cover partitioning macOS for dual boot, so we do not improvise it here; back up first, and consider a virtual machine as the lower risk option.

Can you install Ubuntu on an Apple silicon Mac?

Not with Canonical's installer. The 26.04 Desktop tutorial says that to run Ubuntu on Apple silicon hardware, "such as recent Macs using M1 CPUs or later," you should look at the Ubuntu Asahi community project, "which isn't supported by Canonical," and that "Ubuntu Asahi 25.10 only runs on systems with M1 and M2 CPUs." Apple's model list shows every MacBook Pro from 2021, every MacBook Air from 2022, Mac mini from 2020 and Mac Studio from 2022 uses Apple silicon, along with the M1 models from 2020.

For almost everyone, the practical answer is a virtual machine with the arm64 Ubuntu Desktop image, covered next.

How do you run Ubuntu in a virtual machine?

VirtualBox

Canonical's VirtualBox tutorial uses the Unattended Guest OS Install in VirtualBox 7 and later. Download VirtualBox from its own downloads page, then:

1. Click New, name it "Ubuntu" and select the verified ISO.
2. Set your own user name and password. The tutorial warns the defaults, vboxuser and changeme, "will create a user without sudo access."
3. Tick Guest Additions, and give the VM about 8 GB of RAM, 4 CPUs and at least 25 GB of disk.
4. Click Start and let the unattended install run untouched.

Then update inside the VM, as the tutorial recommends:

sudo apt update && sudo apt upgrade -y
sudo snap refresh

Microsoft notes VirtualBox and Hyper-V rely on the same processor features, so expect conflicts if both are active.

UTM on a Mac

UTM's Ubuntu guide walks through the wizard: click +, choose Virtualize, then Linux, set RAM and CPU cores, Browse to the ISO, set the disk size, optionally pick a shared folder, then Save and Run. After the installer's "Reboot Now," the guide says the VM may hang at a black screen, which "is expected": quit the VM, unmount the installer ISO, and start it again.

UTM's guide was written for Ubuntu 22.04, when there was no ARM desktop ISO, so it installs Ubuntu Server for ARM and then adds the desktop:

sudo apt update
sudo apt install ubuntu-desktop
sudo reboot

With 26.04 you can use the official arm64 desktop ISO directly instead, since the release notes describe it as targeting VMs.

Hyper-V on Windows

Hyper-V needs Windows 10 or 11 Pro or Enterprise; Microsoft states it "can't be installed on Windows 10 Home or Windows 11 Home." Enable it from Turn Windows features on or off, or from an elevated PowerShell:

Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All

Restart, then in Hyper-V Manager choose New, Virtual Machine, and Generation 2, which Microsoft recommends. Secure Boot is on by default, and Microsoft says that to Secure Boot a generation 2 Linux VM "you need to choose the UEFI CA Secure Boot template." Attach the verified ISO and start the VM. Microsoft's guest support table lists Ubuntu releases up to 24.04 when we checked; 26.04 was not yet listed.

Multipass

Canonical's tutorial also mentions Multipass. On Linux it is a snap:

snap install multipass

It also runs on macOS 14 or later and on Windows 10 or 11 (Home included), and is driven from the command line, which suits development more than trying the desktop.

How do you secure Ubuntu right after installing?

Install all updates now

Update right away, from Software Updater or a terminal, as the Desktop tutorial advises:

sudo apt update
sudo apt upgrade

Since 25.10 Software Updater shows a notification instead of a window, so it is easy to miss. Refresh snaps with sudo snap refresh.

Confirm unattended-upgrades is on

Ubuntu applies security updates automatically through unattended-upgrades, which the Ubuntu Server documentation says "is installed by default" and runs once per day. Check that both settings in /etc/apt/apt.conf.d/20auto-upgrades are "1":

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

Simulate a run to see what it would install, without changing anything:

sudo unattended-upgrade -v --dry-run

Two details catch people. First, by default only the release and -security pockets (plus ESM when available) are allowed origins; general -updates are commented out in /etc/apt/apt.conf.d/50unattended-upgrades. Second, the docs warn that adding another repository "WILL NOT make unattended-upgrades consider it for updates." If you add a vendor repository or PPA, you either add its origin to that file or update it yourself. Automatic reboots are off by default (Unattended-Upgrade::Automatic-Reboot "false"), so kernel updates wait for your next restart. Logs are in /var/log/unattended-upgrades.

Turn on the firewall

The Ubuntu Server documentation says ufw is "the default firewall configuration tool for Ubuntu" and is "initially disabled." On a laptop that joins public Wi-Fi, turn it on:

sudo ufw enable
sudo ufw status numbered

Only open ports you need. For example, if you will SSH into the machine from one home subnet:

sudo ufw allow proto tcp from 192.168.0.0/24 to any port 22

Livepatch and Ubuntu Pro

Livepatch patches critical and high severity kernel vulnerabilities while the system runs. Canonical says it is "free for up to 5 machines, for personal use," through Ubuntu Pro. Attach the machine with your token, then enable it:

sudo pro attach <YOUR_TOKEN>
sudo pro enable livepatch

Canonical is clear that Livepatch "is not a replacement for rebooting." It narrows the window until your next restart. You can also enable Ubuntu Pro from the Security Center app.

Keep Secure Boot and your recovery details current

Run mokutil --sb-state after firmware or Windows updates, and keep the Ubuntu disk passphrase or TPM recovery key with the BitLocker key, off the machine.

Know where your software comes from

Ubuntu 26.04 no longer ships the Software & Updates app by default (sudo apt install software-properties-gtk restores it). Every PPA, vendor repository or downloaded .deb is a new party you trust with root, and is not auto-patched. Prefer the Ubuntu archive and remove sources you stop using.

How do you keep Ubuntu updated and upgrade to the next LTS?

Day to day, unattended-upgrades plus a weekly sudo apt update && sudo apt upgrade and a restart after kernel updates keeps you patched. For release upgrades, follow Ubuntu's Upgrade Ubuntu Desktop how-to. The release notes set the path: from 24.04 LTS or 25.10 you can move to 26.04 LTS, but from older releases such as 22.04 LTS or 25.04 you "must first upgrade to either Ubuntu 24.04 LTS or 25.10." Back up before every release upgrade, and on a dual-boot PC check the BitLocker key is still at hand.

How do you remove Ubuntu from a dual-boot PC?

Warning: removing partitions is permanent. Back up anything in your Ubuntu home folder first, and be certain which partitions belong to Ubuntu. Never delete the EFI System Partition, which Windows needs to boot.

From Windows, open Disk Management. Ubuntu's partitions appear without drive letters. Removing them turns them back into unallocated space. Microsoft's guide to extending a basic volume then lets you give that space back to Windows with Extend Volume, with two conditions: the unallocated space "must be located immediately after the volume that you want to extend," and it must be on the same disk. If a recovery partition sits between C: and the freed space, Disk Management cannot extend C: into it.

Ubuntu's boot files and firmware boot entry remain afterwards. Set Windows Boot Manager first in the firmware boot order; removing the leftover entry is vendor specific and not covered by the official guides we used, so check your PC maker's documentation.

How do you fix common Ubuntu install errors?

Common mistakes

• Starting without the BitLocker recovery key. Microsoft cannot recover it for you.
• Skipping ISO verification.
• Formatting the freed space in Windows instead of leaving it unallocated for the installer.
• Choosing "Erase disk" on a dual-boot PC after not reading the screen. It deletes Windows.
• Switching the controller to AHCI in firmware first, then wondering why Windows will not start.
• Turning Secure Boot off to "make Linux work" and never turning it back on. Ubuntu supports Secure Boot, and TPM encryption requires it.
• Picking TPM-backed encryption on a machine that needs DKMS drivers other than NVIDIA, or NVMe RAID, despite the documented limitations.
• Keeping VirtualBox's default vboxuser and changeme credentials, which also leaves you without sudo.
• Never restarting because Livepatch is on. Canonical says it is not a substitute for rebooting.

FAQ

What is the latest Ubuntu LTS version?

Ubuntu 26.04 LTS, codenamed Resolute Raccoon, released 23 April 2026. The current point release on ubuntu.com is 26.04.1. It receives free security updates until April 2031.

How much disk space do I need to install Ubuntu alongside Windows?

Canonical's minimum is 25 GB, with 6 GB of RAM and a 2 GHz dual-core CPU. Leave more on a development machine.

Do I need to turn off BitLocker to dual boot Ubuntu?

Not always. The 26.04 release notes say the installer can work alongside BitLocker if enough unallocated space exists; if it shows the BitLocker alert, the tutorial says to turn BitLocker off or use another drive. Save your recovery key first either way.

Do I need to disable Secure Boot to install Ubuntu?

No. Ubuntu boots through a Microsoft signed shim and a Canonical signed GRUB, so it works with Secure Boot on. TPM-backed disk encryption requires Secure Boot to be enabled.

How do I shrink my Windows partition for Ubuntu?

In Windows, right-click the C: volume in Disk Management and choose Shrink Volume, or use diskpart with select volume and shrink desired= in megabytes. Leave the result unallocated.

Can I install Ubuntu on an M1, M2 or M3 Mac?

Not with Canonical's installer. Canonical points to the community Ubuntu Asahi project, which it does not support and which, per the tutorial, runs only on M1 and M2 in its 25.10 release. Run the arm64 Ubuntu Desktop image in a VM such as UTM instead.

How do I verify an Ubuntu ISO?

Download SHA256SUMS and SHA256SUMS.gpg from the same Canonical release directory, run gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS, then sha256sum -c SHA256SUMS 2>&1 | grep OK. On Windows, Get-FileHash gives the SHA256 to compare.

Should I choose passphrase or TPM encryption when installing Ubuntu?

Canonical recommends the passphrase. TPM encryption is more convenient on recent PCs but is install-time only, uses the whole disk, and has documented limitations.

How do I turn on automatic security updates in Ubuntu?

They are on by default through unattended-upgrades. Confirm APT::Periodic::Unattended-Upgrade "1"; in /etc/apt/apt.conf.d/20auto-upgrades and run sudo unattended-upgrade -v --dry-run to see what it would do.

Fix it without waiting for upstream

A new Ubuntu machine is usually a new developer workstation, and the first thing it does is pull dependencies, toolchains and container images. Canonical patches the operating system; the open source components you build and ship are where the steps below apply.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

None of these demos installs Ubuntu or touches disks and firmware; that stays with Canonical's installer and your PC maker. They show the step after, when the new machine starts pulling packages and images, with a person approving each action.

In this Safeguard CLI session you install the CLI, run safeguard to open the interactive terminal and ask it to fix the lodash CVE in a repository. It reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. On a freshly installed Ubuntu workstation, this is how you bring a project's dependencies to fixed versions before you start building on them.

Click through it at your own pace, or open it full screen.

This demo sets up the Safeguard runner on your own machine, approves it with its device code, then scans from the terminal. A new Ubuntu box is a natural place to host it, so repositories and images are scanned locally rather than leaving your network. Our guide to how the local runner and offline mode work covers the details.

Click through it at your own pace, or open it full screen.

This demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. Once connected, you can ask in plain language which of your projects contain a given component and version, the same question our post on using SBOMs to find affected products fast works through.

Click through it at your own pace, or open it full screen.

You can download Safeguard at safeguard.sh/download and read the CLI documentation at docs.safeguard.sh/docs/cli.

Quick check

Sources

• Ubuntu: Download Ubuntu Desktop
• Ubuntu release notes: Ubuntu 26.04 LTS
• Ubuntu release notes: Ubuntu 26.04 LTS summary for LTS users
• Ubuntu release notes: Ubuntu 26.04 LTS changes since 25.10 (TPM/FDE limitations)
• Ubuntu releases: 26.04 release directory and SHA256SUMS
• Ubuntu Desktop documentation: Install Ubuntu Desktop (26.04)
• Ubuntu Desktop documentation: BitLocker during Ubuntu installation
• Ubuntu Desktop documentation: Turn off BitLocker in Windows
• Ubuntu Desktop documentation: Reconfigure Windows to use AHCI
• Ubuntu Desktop documentation: Advanced disk setup features
• Ubuntu Desktop documentation: Encrypt your disk with TPM
• Ubuntu Desktop documentation: Hardware-backed disk encryption requirements
• Ubuntu Desktop documentation: Hardware-backed disk encryption
• Ubuntu tutorials: How to verify your Ubuntu download
• Ubuntu tutorials: Install Ubuntu Desktop
• Ubuntu tutorials: Create a bootable USB stick on Windows
• Ubuntu tutorials: Create a bootable USB stick on macOS
• Ubuntu tutorials: Create a bootable USB stick on Ubuntu
• Ubuntu tutorials: How to run Ubuntu Desktop on a virtual machine using VirtualBox
• Ubuntu Security documentation: UEFI Secure Boot
• Ubuntu Server documentation: Automatic updates
• Ubuntu Server documentation: Firewalls
• Ubuntu: Livepatch
• Multipass documentation: Install Multipass
• Microsoft Support: Find your BitLocker recovery key
• Microsoft Learn: manage-bde protectors
• Microsoft Learn: BitLocker recovery overview
• Microsoft Learn: Shrink a basic volume
• Microsoft Learn: Extend a basic volume
• Microsoft Learn: Get-FileHash
• Microsoft Learn: Confirm-SecureBootUEFI
• Microsoft Learn: Install Hyper-V
• Microsoft Learn: Create a virtual machine in Hyper-V
• Microsoft Learn: Should I create a generation 1 or 2 virtual machine in Hyper-V?
• Apple Support: Mac computers with Apple silicon
• Apple Support: About Startup Security Utility on a Mac with the Apple T2 Security Chip
• Apple Support: Change security settings on the startup disk of a Mac with Apple silicon
• UTM documentation: Ubuntu guide
• mokutil manual page (lcp/mokutil)

Last reviewed: 23 October 2026.