Windows 10: UEFI Admin Password needed if BitLocker is enabled?

Just a quick question. I have enabled BitLocker with TPM-Only protector and was just wondering if I need to set an Admin BIOS/UEFI password to prevent someone from changing the UEFI settings. I also have Secure Boot enabled as well along with the following BitLocker protection policies below.

In my UEFI boot settings, I have Windows Boot Mannager and then my Internal HDD as the boot order.
Boot from external media is enabled, because I tend to reinstall Windows from my Windows 10 bootable USB flash drive.

With all these below BitLocker settings and policies, do I really need to set an Admin or Supervisor password to prevent an attacker from changing the UEFI settings in case the laptop gets stolen?

My current BitLocker protection settings from the Windows 10 v1803 Security Baseline.

Disable new DMA devices when this computer is locked:
Enabled

Allow Secure Boot for integrity validation:
Enabled



https://support.microsoft.com/en-us/...-reduce-1394-d

Prevent installation of devices that match any of these device IDs
PCI\CC_0C0A

Prevent installation of devices using drivers for these device setup classes:
{d48179be-ec20-11d1-b6b8-00c04fa372a7}

:)

 

admin password?

You can reset the Admin Password using Windows XP repair; See Here for step by step.

*Toast :toast:

 

System firmware UEFI Admin Password


I am thinking about setting an Admin password for the UEFI firmware settings.
Is this really required?

BitLocker full drive encryption is enabled.


I have Secure Boot enabled, but what if my laptop gets stolen and someone can change the UEFI settings?


.So can I create the UEFI Admin password to be the same as my OS Admin password?
Would this pose an issue? My passwords are very complex.

Its very surprising to me that in most of security related forums out there, setting a UEFI Admin password is off the radar and not talked about so much...

 

System firmware UEFI Admin Password

Problem is if you set a password and forget it, you are screwed and may have to resort to elaborate physical methods to reset bios.

There is no real need to use a bios password unless you want to prevent users with PHYSICAL access to pc to change anything.

Remote users/hackers cannot modify the bios.

I guess it helps if laptop is stolen but even then most thieves would wipe drives anyway. You should not keep confidential details on a laptop if risk of theft is high where you take it.