3 ms·
Assuming the BIOS lock also prevents you from adding your own keys this fails the Windows Compatibility Program requirements (i.e. Microsoft's requirements for
by cmeacham98 5y ago
Assuming the BIOS lock also prevents you from adding your own keys this fails the Windows Compatibility Program requirements (i.e. Microsoft's requirements for OEMs to be able to pre-install Windows).
From https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-secure-boot#secure-boot-requirements https://docs.microsoft.com/en-us/windows-hardware/design/dev...
> The platform must come provisioned with the correct keys in the UEFI Signature database (db) to allow Windows to boot. It must also support secure authenticated updates to the databases.
I'm not sure how to contact Microsoft about this issue though.
- AshamedCaptain 5y agoI believe that allowing updating the database from Windows itself is enough to satisfy the requirement. No need to allow doing it from firmware setup. Microsoft's own devices do it that way.
- jfrunyon 5y ago> It must also support secure authenticated updates to the databases. This does not imply "the user must be able to add their own keys". (Particularly as that would not usually be "authenticated"). Secure Boot keys include keys which (in theory) are used to authenticate an update to the key database.
- jonwest 5y agoMaybe unrelated to your post, but assuming you can’t change the boot order how could you feasibly reinstall the OS if you ran into malware or other issues?