Windows 10: Secure Boot question (Expert Key Management)?

I want to enable Secure Boot, but there is another option under the Secure Boot menu within the UEFI firmware section that I don't know what it means and my question is, should I enable the Expert Key Management options as well when enabling Secure Boot?

:)

 

specific Secure Boot question

Hi Ronald,

Thank you for posting the query on Microsoft Community. I am glad to assist you on this.

I would suggest you to refer the below articles and check if it helps.

http://windows.microsoft.com/en-in/windows-8/secure-boot-watermark

Secure Boot Overview

Secure Boot Overview

Kindly let us know if you need any further assistance with Windows. We are glad to assist you.

Thank you.

 

specific Secure Boot question

My question is related to an article Ubuntu's Secure Boot support vulnerability threatens even Windows PCs

The relevant info is that malware writers may soon be able to write bootkits that can bypass Secure Boot protection- because they will be signed with MS's key.

Is there anything a user can do to keep Secure Boot secure?

 

That option is if you want to install your own secure boot keys - by default the Microsoft (and probably Dell) keys are already installed. You would need to install your own keys if you are using a non-Microsoft/non-Dell bootloader or UEFI drivers.

 

I want to keep it as it is if that would be possible and ONLY enable Secure Boot. Would that be fine?
Or, do I need to enable the Expert Key Management option as well?

I don't plan on adding my own keys and I would not even know how to do that.

Another concern when enabling Secure Boot. Sometimes, Windows 10 downloads driver updates for Intel related stuff like network cards and maybe some display drivers as well. Since Intel is not Microsoft or Dell related, would this cause issues with Secure Boot?

Thanks!

 

Do not enable Expert Key Management it if you don't have your own keys, though I don't think it'll hurt anything if you enable it and don't load any certificates.

3rd party drivers are still signed by Microsoft.

 

So let me just confirm one last time just to be sure.

Is it fine to leave the Expert Key Management options alone and only enable Secure Boot?

Please confirm.

 

Yes. Leave it alone.

If you want to install some boot loader that isn't signed by Microsoft (or on their list of approved ones) then you might have to temporarily disable Secure boot until you can install your own key.

If you are just running Windows then forget it.

If you want to install something else that is unsigned then you must disable secure boot first. You can then self sign later if you really want to use secure boot.

There is some more good reading here if you are interested - Secure Boot - ArchWiki