Windows 10: UEFI with secure boot disabled

According to my experience with several Lenovo ThinkCentre and ThinkPad computers, it´s possible to configure the boot as:

- Boot mode: UEFI only
- Secure Boot enabled or disabled

With this configuration, the computer won´t boot from MBR disks or legacy boot media. Secure Boot can be enabled or disabled.

Also, it´s possible to configure as:

- CSM enabled (legacy mode)
- Boot mode: Auto.

With this configuration, the computer boots from either MBR or GPT disks, and from UEFI or legacy boot media. Secure Boot is disabled.

 

It's not an "error", it's just a setting. You can have it on or off. Lots of people don't have Secure Boot on. It's supposed to help prevent specific types of infections, but the bad guys have already overcome it. Having it off can have its advantages; i.e. you'll be able to boot the system to other media (in the event you ever need to do this), or dual-boot a non-UEFI OS.

So, based on this, you'd select
UEFI/Legacy Boot = UEFI Only
and that should turn off CSM and provide Secure Boot?





Based on what the Lenovo website said, the system should have been set that way to begin with. That's why I thought setting the BIOS back to Default settings would do it, and asked what had been done to the system to change this.

 

Oh yes - here it is:





https://download.lenovo.com/ibmdl/pu...n.pdf#page=142

So you would select
UEFI Only and CSM Support = NO.

 

@KB1240: The original OS offered on your Lenovo desktop was Windows 7; therefore, you may not even have a secure boot option in you BIOS to enable or disable. However, if it is there, it would be readily identifiable in the the Security settings (as an enable/disable toggle). Now, I looked to see if there were any BIOS updates available for your desktop, and if I found your correct model, a new update was released on 12/29/2016:

http://pcsupport.lenovo.com/us/en/pr...5ish/downloads

However, I have no idea if that BIOS update contains any updates to add/show a Secure Boot Option because the readme is just instructional (no change log).

In summary, if you can't find it anywhere in the BIOS, you don't have that option.

Good luck,



Updated to include a BIOS screenshot:

 

If the original OS was W7, Secure Boot may not be an option if the system was "upgraded" to W10 (and why I asked in Post #8). But OP says it's 1 year old and came with W10 installed (Post #10), so I still don't understand then, why the system would not have shipped with UEFI+Secure Boot enabled, as they are instructed to do so by MS? Something is not right here: either the system was upgraded from W7, or the settings have been changed at one point, or Belarc is mis-reading the information.

 

You logic is sound (as always). The only thing I can say is the BIOS should have the option to enable or disable secure boot (as shown in my screenshot). At this point I think the OP needs to contact Lenovo support and ask them directly. As you are aware, laptop manufacturers are well known for limiting what options are available in the BIOS for user configuration. Who knows, maybe the latest BIOS update might unhide that option?

 

A year ago we were on version 1511, upgrading to version 1607 may have caused this issue and you wouldn't be the first.

Reset BIOS to factory setting won't hurt if you get <<false>> reading in powershell. You even have the solution in post # 14. Thanks to @Anibor.

All the best,

 

That is quite possible! *Wink

 

I have never heard of that.

 

Neither had I, so I looked it up . . .

Does Windows 10 change BIOS/ Cause boot problems

Basically, the answer to the question says Windows 10 does not change any BIOS settings.

 

I really hope this is not the end of the forum response or have i missed something?

 

Perhaps you have.

I believe your answer is to turn CSM off (which is legacy support).
Just remember, if you have installed W10 in Legacy, your system won't boot after making that change.

 

Good work KB!

It makes sense that the CSM parameter was causing this issue or disabling Secure Boot.

Take care,