This whole thing of secure boot is not part of your operating system. It is part of your motherboard, which hosts the BIOS.
Google for "secure boot" and the details of your particular motherboard model, and then you will get the specific instructions you need. Unfortunately, the BIOS is a little different with every motherboard, and it can be confusing if you don't have the right instructions.
I forgot to mention that if your computer is pretty old, then it might not even have secure boot at all.
The older models of motherboards have only the old-style BIOS, they don't have the UFI firmware.
In any case, don't sweat it, it is not a big deal either way.
Not supported:
Code:PS C:\Windows\system32> Confirm-SecureBootUEFI Confirm-SecureBootUEFI : Variable is currently undefined: 0xC0000100 At line:1 char:1 + Confirm-SecureBootUEFI + ~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ResourceUnavailable: (Microsoft.Secur...BootUefiCommand:ConfirmSecureBootUefiCommand) [C onfirm-SecureBootUEFI], StatusException + FullyQualifiedErrorId : GetFWVarFailed,Microsoft.SecureBoot.Commands.ConfirmSecureBootUefiCommand PS C:\Windows\system32>
According to my experience with several Lenovo ThinkCentre and ThinkPad computers, itīs possible to configure the boot as:
- Boot mode: UEFI only
- Secure Boot enabled or disabled
With this configuration, the computer wonīt boot from MBR disks or legacy boot media. Secure Boot can be enabled or disabled.
Also, itīs possible to configure as:
- CSM enabled (legacy mode)
- Boot mode: Auto.
With this configuration, the computer boots from either MBR or GPT disks, and from UEFI or legacy boot media. Secure Boot is disabled.
It's not an "error", it's just a setting. You can have it on or off. Lots of people don't have Secure Boot on. It's supposed to help prevent specific types of infections, but the bad guys have already overcome it. Having it off can have its advantages; i.e. you'll be able to boot the system to other media (in the event you ever need to do this), or dual-boot a non-UEFI OS.
So, based on this, you'd select
UEFI/Legacy Boot = UEFI Only
and that should turn off CSM and provide Secure Boot?
Based on what the Lenovo website said, the system should have been set that way to begin with. That's why I thought setting the BIOS back to Default settings would do it, and asked what had been done to the system to change this.
Oh yes - here it is:
https://download.lenovo.com/ibmdl/pu...n.pdf#page=142
So you would select
UEFI Only and CSM Support = NO.
@KB1240: The original OS offered on your Lenovo desktop was Windows 7; therefore, you may not even have a secure boot option in you BIOS to enable or disable. However, if it is there, it would be readily identifiable in the the Security settings (as an enable/disable toggle). Now, I looked to see if there were any BIOS updates available for your desktop, and if I found your correct model, a new update was released on 12/29/2016:
http://pcsupport.lenovo.com/us/en/pr...5ish/downloads
However, I have no idea if that BIOS update contains any updates to add/show a Secure Boot Option because the readme is just instructional (no change log).
In summary, if you can't find it anywhere in the BIOS, you don't have that option.
Good luck,
WOT
Updated to include a BIOS screenshot:
If the original OS was W7, Secure Boot may not be an option if the system was "upgraded" to W10 (and why I asked in Post #8). But OP says it's 1 year old and came with W10 installed (Post #10), so I still don't understand then, why the system would not have shipped with UEFI+Secure Boot enabled, as they are instructed to do so by MS? Something is not right here: either the system was upgraded from W7, or the settings have been changed at one point, or Belarc is mis-reading the information.
You logic is sound (as always). The only thing I can say is the BIOS should have the option to enable or disable secure boot (as shown in my screenshot). At this point I think the OP needs to contact Lenovo support and ask them directly. As you are aware, laptop manufacturers are well known for limiting what options are available in the BIOS for user configuration. Who knows, maybe the latest BIOS update might unhide that option?
A year ago we were on version 1511, upgrading to version 1607 may have caused this issue and you wouldn't be the first.
Reset BIOS to factory setting won't hurt if you get <<false>> reading in powershell. You even have the solution in post # 14. Thanks to @Anibor.
All the best,
Last edited by MikeMecanic; 07 May 2017 at 19:53.
Quote
