4 ms·

You can on Intel-based machines, as far as I know it is not clear yet whether you can on ARM-based systems.

somerandomqaguy 6y ago
Pressure for that came from Microsoft for Windows 8 certified devices: "Enable/Disable Secure Boot. On non-ARM systems, it is required to implement the ability to disable Secure Boot via firmware setup. A physically present user must be allowed to disable Secure Boot via firmware setup without possession of PKpriv. A Windows Server may also disable Secure Boot remotely using a strongly authenticated (preferably public-key based) out-of-band management connection, such as to a baseboard management controller or service processor. Programmatic disabling of Secure Boot either during Boot Services or after exiting EFI Boot Services MUST NOT be possible. Disabling Secure Boot must not be possible on ARM systems."[1] This requirement is no longer needed for Windows 10 logo certified x86_64 computer,[2] but I've yet to see a vendor actually take it out. For SOC systems, at least if you wish to have Windows 10 Logo, it makes it optional if I'm reading their spec sheet correctly: "Requirement 10: OPTIONAL. An OEM may implement the ability for a physically present user to turn off Secure Boot either with access to the PKpriv or with Physical Presence through the firmware setup. Access to the firmware setup may be protected by platform specific means (administrator password, smart card, static configuration, etc.)"[3] That said, that's only for Windows logo certified devices. I'd assume if you don't intend to make you system Windows compatible then you can do whatever you want. ------ [1]https://docs.microsoft.com/en-us/previous-versions/windows/hardware/cert-program/windows-hardware-certification-requirements-for-client-and-server-systems https://docs.microsoft.com/en-us/previous-versions/windows/h... [2]https://www.pcworld.com/article/2901262/microsoft-tightens-windows-10s-secure-boot-screws-where-does-that-leave-linux.html https://www.pcworld.com/article/2901262/microsoft-tightens-w... [3]https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/uefi-requirements-that-apply-to-all-windows-platforms https://docs.microsoft.com/en-us/windows-hardware/drivers/br...

Pressure for that came from Microsoft for Windows 8 certified devices: "Enable/Disable Secure Boot. On non-ARM systems, it is required to implement the ability to disable Secure Boot via firmware setup. A physically present user must be allowed to disable Secure Boot via firmware setup without possession of PKpriv. A Windows Server may also disable Secure Boot remotely using a strongly authenticated (preferably public-key based) out-of-band management connection, such as to a baseboard management controller or service processor. Programmatic disabling of Secure Boot either during Boot Services or after exiting EFI Boot Services MUST NOT be possible. Disabling Secure Boot must not be possible on ARM systems."[1] This requirement is no longer needed for Windows 10 logo certified x86_64 computer,[2] but I've yet to see a vendor actually take it out. For SOC systems, at least if you wish to have Windows 10 Logo, it makes it optional if I'm reading their spec sheet correctly: "Requirement 10: OPTIONAL. An OEM may implement the ability for a physically present user to turn off Secure Boot either with access to the PKpriv or with Physical Presence through the firmware setup. Access to the firmware setup may be protected by platform specific means (administrator password, smart card, static configuration, etc.)"[3] That said, that's only for Windows logo certified devices. I'd assume if you don't intend to make you system Windows compatible then you can do whatever you want. ------ [1]https://docs.microsoft.com/en-us/previous-versions/windows/hardware/cert-program/windows-hardware-certification-requirements-for-client-and-server-systems https://docs.microsoft.com/en-us/previous-versions/windows/h... [2]https://www.pcworld.com/article/2901262/microsoft-tightens-windows-10s-secure-boot-screws-where-does-that-leave-linux.html https://www.pcworld.com/article/2901262/microsoft-tightens-w... [3]https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/uefi-requirements-that-apply-to-all-windows-platforms https://docs.microsoft.com/en-us/windows-hardware/drivers/br...