A lot of machines ship with secure boot locked to Microsoft's key. Usually there's a way to turn it off, otherwise you need the shim loader Microsoft signed in 2015 whose signature has just expired and who knows if Microsoft will sign it again.