Windows modifies UEFI settings on runtime. There is an API for that. Even setting password for BIOS/UEFI won’t prevent that as machine has been booted already.

Windows modifies UEFI settings on runtime. There is an API for that. Even setting password for BIOS/UEFI won’t prevent that as machine has been booted already. For example : https://docs.microsoft.com/en-us/windows/win32/sysinfo/access-uefi-firmware-variables-from-a-universal-windows-app https://docs.microsoft.com/en-us/windows/win32/sysinfo/acces... https://wikileaks.org/ciav7p1/cms/page_26968097.html https://wikileaks.org/ciav7p1/cms/page_26968097.html https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface#UEFI_variables https://wiki.archlinux.org/title/Unified_Extensible_Firmware... There is also NtSetBootEntryOrder() in Windows ntddl