Everything you want to know about BIOS-UEFI Settings Niall C. Brady niall@windows-noob.com Windows-noob Ronnie Jakobsen rja@coretech.dk Coretech Mike Terrill mike.terrill@1e.com 1E

Everything you want to know about BIOS-UEFI Settings Niall C. Brady niall@windows-noob.com Windows-noob Ronnie Jakobsen rja@coretech.dk Coretech Mike Terrill mike.terrill@1e.com 1E

Mike Terrill Ronnie Jakobsen Niall C. Brady @ncbrady AZSMUG 9+ Years 6 year ECM MVP Deploying Windows since Windows NT 4.0/ConfigMgr since SMS1.2 Working in IT since NT was hot, started programming in 1981 on a TI-99 Working with SCCM since SMS 2003, started programming in 1985 in ZX80 Assembly $$$ Tequila Whisky Preferably Scottish Whiskey

Agenda Why UEFI? Upgrade methodologies: Refreshing an UEFI BitLocker’ed device Bare minimum BIOS settings for UEFI OEM specific settings Configuring settings programmatically Inventory vendor specific settings

Why UEFI?

Upgrade Methodologies Could do Wait for hardware replacement to do the switch Deploy Windows 10 to BIOS machines Should do Switch over UEFI if at all possible Automate the switch to save you a lot of time Should not do Convert to UEFI for performance benefits Convert to UEFI and disable Secure Boot Manually switch your hardware to UEFI Not move to UEFI at all

Refreshing (not upgrading) an UEFI BitLocker’ed device

Bare minimum BIOS settings for UEFI Boot mode (or BIOS mode) Boot list order Secure Boot PXE UEFI Network Boot Upgrade to the latest BIOS-UEFI version!!! (For more info, see Updating your Enterprise Environment)

Settings of Interest BIOS Settings: Boot Mode (i.e. Legacy, UEFI Hybrid, UEFI Native) Secure Boot (not just enabled or disabled, but capable) UEFI PXE Virtualization Settings (DEP, VTd, VTx) TPM (OS mgmt, Activation Policy, Device) WOL Device Boot Order: Legacy, UEFI, Network

Client Architecture Types (Option 93) UEFI PXE Booting Client Architecture Types (Option 93) Boot Image Type Architecture Name x86 x64 Intel x86PC ● ○ 1 NEC/PC98 2 EFI Itanium 3 DEC Alpha 4 Arc x86 5 Intel Lean Client 6 EFI IA32 7 EFI BC 8 EFI Xscale 9 EFI x86-64

Booting with ConfigMgr BIOS Configuration Boot List Option Legacy Option ROMs (CSM) _SMSTSBootUEFI Client Architecture PC BIOS Legacy Enabled FALSE Intel x86PC UEFI Hybrid (with Legacy ROMs) UEFI FALSE* TRUE* Intel x86PC* EFI BC* Disabled TRUE EFI BC

Vendor specific settings – Dell, HP and Lenovo

Configure Settings Programmatically Vendor tools - Dell Dell Command | Configure (aka CCTK) Get BIOS mode: Cctk bootorder --activebootlist Enable UEFI: Cctk bootorder --activebootlist=uefi Get Legacy ROM setting (aka CSM): Cctk --legacyorom Disable Legacy ROMs: Cctk --legacyorom=disable Enable Secure Boot: Cctk --secureboot=enable

Configure Settings Programmatically Vendor tools - HP HP BIOS Configuration Utility Get BIOS mode: BiosConfigUtility(64).exe Enable UEFI: BiosConfigUtility(64).exe /setvalue:"Boot Mode","UEFI Native (Without CSM)" Enable Secure Boot: BiosConfigUtility(64).exe /setvalue:"SecureBoot","Enable"

Configure Settings Programmatically Vendor tools - Lenovo One method – VBScript Get current settings: Cscript ListAll.vbs Enable UEFI & Secure Boot: Cscript SetConfig.vbs SecureBoot Enable

And Then … Discuss: Evaluations: Ask your questions-real world answers! Plenty of time to engage, share knowledge. Discuss: Evaluations: Please provide session feedback by clicking the EVAL button in the scheduler app (also download slides). One lucky winner will receive a free ticket to the next MMS!

And Then …

Q & A / Discussion

Windows 10 Servicing with Configuration Manager Other Sessions: Niall Windows 10 Servicing with Configuration Manager Tuesday at 11:00 AM & Wednesday at 2:00 PM

Other Sessions: Mike & Ronnie Everything you want to know about BIOS/UEFI Settings Tuesday at 2:00 PM Updating your Enterprise Environment Wednesday at 11:00 AM Configuration Manager meet Power BI Thursday at 2:00 PM