Looks up to the OEM. “Requirement 10: OPTIONAL. An OEM may implement the ability for a physically present user to turn off Secure Boot either with access to th

Looks up to the OEM. “Requirement 10: OPTIONAL. An OEM may implement the ability for a physically present user to turn off Secure Boot either with access to the PKpriv or with Physical Presence through the firmware setup.“ https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/uefi-requirements-that-apply-to-all-windows-platforms#security-requirements https://docs.microsoft.com/en-us/windows-hardware/drivers/br... EDIT: It looks like these two come with windows locked in S mode. I don’t know if that impacts the bootloader, but the stock OS is limited to windows store apps I think.