How to Dual Boot Kali Linux and Windows Safely

Part of our free Build Your Own Cyber Lab series. Work through it in order, or jump to the part you need.

1. Plan your lab: hardware, hypervisors and safe networking
2. VirtualBox and VMware basics, then Kali, Parrot and Windows 11
3. Beyond VirtualBox: Hyper-V, VMware Workstation and Proxmox
4. Dual boot Kali Linux and Windows safely (you are here)
5. Ubuntu in your lab: desktop, server, SSH and Docker
6. Active Directory lab with Windows Server
7. Attack-and-defend network: firewall and vulnerable targets
8. Metasploitable 2 and 3: install and first exploits
9. Blue-team lab: Wazuh, Sysmon and Security Onion
10. Android app testing lab: emulator, MobSF, Frida and Burp
11. OT/ICS security lab: OpenPLC, Modbus and an HMI
12. Network lab: build it in Packet Tracer or GNS3, read it in Wireshark

Should you dual boot at all?

For most learning, no - a VM (part 2) is safer and more flexible. Dual boot is the right call when you need:

• Wireless attacks with a USB adapter in monitor mode, without passthrough headaches.
• GPU password cracking with hashcat on your real graphics card.
• Full performance on a laptop with too little RAM to run a host OS and a VM.

If none of those apply, stop here and use a VM. If they do, follow every step below - the risky part is the disk, not Kali.

Step 1: Back up and get your BitLocker key

1. Back up anything you cannot lose to an external drive or cloud storage. Partitioning mistakes are rare, but they are not reversible.
2. Many Windows 11 laptops have BitLocker or Device Encryption on by default. Find your recovery key before you start (it is usually in your Microsoft account) and write it down. Changing boot settings can trigger a recovery prompt.
3. Optionally suspend BitLocker protection (Control Panel > BitLocker Drive Encryption > Suspend protection) until the install is finished, then resume it.

Step 2: Prepare Windows

1. Disable Fast Startup: Control Panel > Power Options > Choose what the power buttons do > untick "Turn on fast startup". Fast Startup leaves the Windows partition in a hibernated state that Linux should not touch.
2. Shrink the Windows partition: press Win+R, run diskmgmt.msc, right-click the C: volume and choose Shrink Volume. Free at least 50 GB, ideally 100 GB. Leave the new space unallocated - do not format it.

Step 3: Write the installer USB

1. Download the Kali Installer image (not the Live or VM image) from the official site and verify its SHA256 checksum against the one published there.
2. Write it to a USB stick of 8 GB or more with Rufus (choose GPT partition scheme for UEFI systems) or balenaEtcher. This erases the stick.

Step 4: Boot the installer

1. Restart and open the one-time boot menu (often F12, F9, Esc or F11 - check your manufacturer).
2. Choose the USB stick's UEFI entry.
3. If it refuses to boot with Secure Boot enabled, check the Kali documentation for your release. Some combinations need Secure Boot turned off temporarily in firmware; if you do, remember Windows 11 features rely on it and turn it back on if Windows complains.

Step 5: Install Kali into the free space

1. Choose Graphical install and work through language, keyboard, hostname and user.
2. At Partition disks, choose Guided - use the largest continuous free space. This uses only the unallocated space you created and leaves Windows untouched.
3. Review the summary carefully: you should see new partitions in the free space and no change to the Windows (NTFS) or EFI partitions other than Kali adding its boot entry.
4. Select your desktop and tools (the default selection is fine) and finish.
5. When asked, install the GRUB boot loader to the primary drive.

Step 6: First boot and checks

GRUB should now offer both Kali and Windows Boot Manager. If Windows is missing:

sudo apt update && sudo apt install -y os-prober
echo 'GRUB_DISABLE_OS_PROBER=false' | sudo tee -a /etc/default/grub
sudo update-grub

If the machine boots straight to Windows, change the boot order in firmware so the Kali (or "debian") entry comes first, or use the one-time boot menu.

Finally, update Kali (sudo apt full-upgrade), boot Windows once to confirm it is healthy, and resume BitLocker if you suspended it.

Removing Kali later

Delete the Kali partitions in Windows Disk Management and extend C: into the space. Then remove the Kali boot entry from the EFI partition (for example with bcdedit or your firmware's boot menu) so the PC does not try to load a missing GRUB.

Keep it legal and contained

Only attack machines you own or have written permission to test. Vulnerable VMs and malware samples belong on an isolated network with no route to your home LAN or the internet, and never expose a deliberately vulnerable machine with a bridged adapter or a port forward.

Next step

Part 5 sets up Ubuntu, the Linux workhorse you will use as a server, Docker host and SIEM base for the rest of the series.