Zbook 15 G2: does it feature the Secure Boot?

[aerostrato]

Hello,

in order to fix an issue due to the upgrade to the Windows 10 PRO 1903, I had to reinstall the OS keeping all my apps and files. The procedure to do that requires to disable the Secure Boot (if enabled).

I had to check ti in the BIOS settings and it seemed that no Secure Boot was enabled.

That was the first time I "faced" the Secure Boot.

After I completed the reinstallation, I wanted to enable the Secure Boot since the advantage it may add in terms of protection against pre-boot viruses.

I went in the BOOT options as you may see below:

FirstSecondThird

I selected UEFI then I rebooted; a message told me that was impossible to boot.

I had to restart my PC and this time no message on left below the screen informed me (as before in normal BOOT) what was the key to press to enter the BIOS.

At first, I was completely lost thinking about the impossibility of booting again!

I then restarted my PC and pressed the ESC key - and it worked - I entered in the BIOS settings and reenabled the BIOS legacy option that is the old setting.

Now I wonder if my PC features the Secure Boot and if yes, what is the right procedure to enable it.

Thank you.

[IT_WinSec]

Hello @aerostrato 

Thank you for posting in the HP Support Community.

Secure boot is related to the new BIOS, known as UEFI >> https://www.howtogeek.com/56958/htg-explains-how-uefi-will-replace-the-bios/

Your PC model uses UEFI but can simulate the legacy BIOS mode (CSM).

You have reinstalled (restored) Windows while Secure Boot was off and while UEFI was off, too.

• Therefore, it may be hard or impossible to re-activate Secure Boot now - without additional Windows reinstallation (restoration).

Here is the official Microsoft article that explains it >> https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/disabling-secure-boot

Usually, if Windows is installed in BIOS/Legacy/CSM mode, this is the way to use it.

If it is installed with UEFI/Secure Boot, this is the way to do it.

Personally, I recommend you leave it as it is now without further interfering with it. The potential benefits are more on theory rather than practical.

[aerostrato]

Thank you for your answer. Yesterday, I run Belarc and it told that Secure Boot is not supported!

How to be sure if it is?

[IT_WinSec]

Secure Boot is mentioned in the BIOS/UEFI of your computer, so this is one prooves it exists.

Another thing is that for the model for be certified by Microsoft as compatible to run latest Windows, it must have Secure Boot and enabled if Windows is preinstalled

Secure Boot is mentioned in the PC service guide >> http://h10032.www1.hp.com/ctg/Manual/c04493862

What you see from Belarc is probably a miswording - wrong words used. Perhaps the results mean that Secure Boot is not enabled, therefore it cannot check for its existence.

[aerostrato]

I wonder where is the HP documentation on how to enable the Secure Boot?

[IT_WinSec · Accepted solution]

Here is the official documentation that you request:

For Windows 10 >> https://support.hp.com/us-en/document/c04784866

For Windows 8 >> https://support.hp.com/us-en/document/c03653226

[aerostrato]

As in the photos, I've attached, the only option that is enabled to be selected is the highlighted one; that is at the moment the enabled option.

It is impossible to select the SecureBoot item in the SecureBoot section so at the moment I don't know how and if the SecureBoot is enabled, 

[IT_WinSec]

---

@aerostrato wrote:

(...)

It is impossible to select the SecureBoot item in the SecureBoot section so at the moment I don't know how and if the SecureBoot is enabled, 

---

Hi,

No, Secure Boot is not enabled at the moment - based on your description and based on the pictures.

Secure Boot is indeed supported, it might be activated but at that moment now -> it is not active.

In order to restore your Windows (a.k.a. to make it boot  again), you have last enabled Legacy (CSM) mode. Secure Boot can only be functional if legacy mode is off and if UEFI mode is ON

Here are your options:

• UEFI Mode ON = Secure Boot ON
• UEFI Mode ON = Secure Boot OFF
• BIOS Mode (known as Legacy mode or CSM mode) = Secure Boot off or non-existing

Secure boot is related to the new BIOS, called as UEFI >> More details >> https://www.howtogeek.com/56958/htg-explains-how-uefi-will-replace-the-bios/

Your PC model uses UEFI but can simulate the legacy BIOS mode (CSM). Based on the pictures and description, your PC is now configured to simulate Legacy Mode (a.k.a BIOS mode). Secure Boot cannot operate and exist while in BIOS mode.

You have reinstalled (restored) Windows while Secure Boot was off and while UEFI was off, too.

• Therefore, it may be hard or impossible to re-activate Secure Boot now - without additional Windows reinstallation (restoration).
• In order to re-enable Secure Boot, you may need to (1) enable UEFI Mode, (2) activate Secure Boot in the BIOS/UEFI/F10 - it will then become active option not greyed out, and then (3) reinstall Windows while the above mentioned modes are ON.
• Windows reinstallation may be needed because to change the boot mode from legacy/CSM to UEFI, you will have to convert your OS HDD drive from MBR to GPT scheme  >> https://superuser.com/questions/739153/uefi-with-mbr-partition-table

All of this is not worth it due to all the hassle.  In my opinion Secure Boot will not make you much more protected. Best would be to leave as it is now - in Legacy mode and enjoy it

Hope this makes it clear now. Let me know if any follow up questions.