https://docs.microsoft.com/en-us/windows/security/informatio...
>All x86-based Certified For Windows 10 PCs must meet several requirements related to Secure Boot:
> - They must have Secure Boot enabled by default.
> - They must trust Microsoft’s certificate (and thus any bootloader Microsoft has signed).
> - They must allow the user to configure Secure Boot to trust other bootloaders.
> - They must allow the user to completely disable Secure Boot.
The last two points in particular. It's been this way since SB was introduced.
Note that this requirement does not apply to non-x86 devices. In particular, ARM devices (Windows RT) are explicitly required to disallow SB from being disabled, to meet the certification requirement.
This one in particular always pissed me off, and I'm glad it only applies to pre-built machines that come with Windows 10 preinstalled. If the individual motherboard makers ever decide they need to be "certified for Windows 10" and start auto-trusting a certificate for closed-source commercial software, I'm left with no choice but to either stick with my "old" (not really that old) hardware or switch to another platform like POWER9.
My Ryzen board trusted Microsoft out of the box, it has to if they want to pass Windows logo certification. You can check yours here: https://partner.microsoft.com/en-us/dashboard/hardware/searc...
That's the entirety of my complaint.
Thanks for the link! My board is not on it as I assumed.
Sure, they're loaded by default, and you can argue that we can't prove the board isn't gonna trust them behind your back -- but that applies to older non-open hardware too.
My bigger annoyance is Intel Boot Guard. I want Intel to let us control the firmware more directly -- even if it requires some physical authorization/kills some DRM component in ME or something. But that's not happening anytime soon...
The requirements mentioned by grandparent are for setup where without any extra configuration you can approach a computer with Windows 10 install media and it will install properly.
You can do this on any x86/x86_64 hardware made in the past 15 years. Whether your machine has a traditional BIOS, UEFI with SecureBoot off, or UEFI with SecureBoot on, Windows 10 will install with zero complaints.
You only get to be "certified by Microsoft" if you follow all of their rules, but you don't have to be certified to install Windows 10 (yet).
It also covers "will work as advertised", i.e. certain features will operate properly. And secured boot path is, indeed, one of such features.
From 2012 until present, computers have been produced that run any EFI binary you want. Why not buy one of those? It's no different than sticking with pre-2012 machines, except you aren't attached to cruft from the 1980s anymore.