Re: Lock BootOrder variable

Samer El-Haj-Mahmoud


Looks like this is a Windows Hardware Compatibility Specification requirement: , in Systems.pdf, under System.Fundamentals.Security.DGCG.DeviceGuard - Firmware BIOS lockdown

I am aware of some proprietary implementations of "Lock Boot Order" as a firmware/UEFI setting, but not a standard method defined in the spec.

Also, NSA has some guidelines on locking down UEFI boot order using whatever firmware settings to disable any undesired boot sources (such as externally available USB or network ports): .


-----Original Message-----
From: <> On Behalf Of Wang, Sunny (HPS SW) via Groups.Io
Sent: Thursday, December 12, 2019 3:50 AM
Cc: Wang, Sunny (HPS SW) <>; Spottswood, Jason <>; Wiginton, Scott <>; Bodner, James <>; Haskell, Darrell <>
Subject: [edk2-discuss] Lock BootOrder variable

Hi All,

Is there any spec'd way that we can use to lock some UEFI variables like BootOrder without breaking OS installation and OS functionalities?

For some security reasons and customer use cases, we need to let system firmware completely own some UEFI variables like BootOrder. In other words, we don't want some UEFI variables to be controlled by the OS using the UEFI runtime service SetVariable. In addition, we tried to lock the BootOrder variable, but it would break OS installation or some OS functionalities.

By the way, we will bring this need to USWG if there is no existing spec'd way for satisfying this need.

Sunny Wang

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

Join to automatically receive all group messages.