Up till W8.1, the spec (https://msdn.microsoft.com/en-us/library/windows/hardware/jj128256 https://msdn.microsoft.com/en-us/library/windows/hardware/jj...) expl

Up till W8.1, the spec (https://msdn.microsoft.com/en-us/library/windows/hardware/jj128256 https://msdn.microsoft.com/en-us/library/windows/hardware/jj...) explicitly requires the ability to disable Secure Boot: On non-ARM systems, the platform MUST implement the ability for a physically present user to select between two Secure Boot modes in firmware setup: "Custom" and "Standard". Custom Mode allows for more flexibility as specified in the following: ... B.If the user ends up deleting the PK then, upon exiting the Custom Mode firmware setup, the system is operating in Setup Mode with SecureBoot turned off. ... Enable/Disable Secure Boot. On non-ARM systems, it is required to implement the ability to disable Secure Boot via firmware setup. A physically present user must be allowed to disable Secure Boot via firmware setup without possession of PKpriv. I can't find the doc for W10. Has the language changed? Can you link it? The closest thing I found is https://msdn.microsoft.com/en-us/library/windows/hardware/dn898540 https://msdn.microsoft.com/en-us/library/windows/hardware/dn... which isn't really a spec, but does say: For most PCs, you can disable Secure Boot through the PC’s firmware (BIOS) menus. For logo-certified Windows RT 8.1 and Windows RT PCs, Secure Boot is required to be configured so that it cannot be disabled. which seems to imply that it is no longer a hard requirement for x86 unlike before.