I’m here at the Minnesota Management Summit at the Mall of America.
We got some exciting stuff going on here at 1E around Windows 10 and security features like Secure Boot and Device Guard, and I’ve have been digging into the details of BIOS and UEFI.
The big challenge in this space is helping clients and customers who are currently running Windows 7 to upgrade to Windows 10 with Secure Boot, If you rolled the UEFI firmware back to CSM/BIOS mode, then your machine can’t leverage the super cool Windows 10 In-Place Upgrade functionality to upgrade from Windows 7 to Windows 10. Instead, we will need to perform a wipe and reload on the machine. Stay tuned to 1E for more information this week on BIOS to UEFI.
This all happens when you get a machine that supports UEFI and Secure Boot (Say a machine with a Windows 8, Windows 8.1 or Windows 10 Logo), and you want to install Windows 7. Windows 7 can’t work with UEFI and Secure Boot, because Windows 7 isn’t a supported Secure Boot operating System. Windows 7 does support UEFI, however you may have some more problems getting Windows 7 loading in UEFI, so we may need to add some CSM components, in a “Hybrid Mode” to load. For many IT departments, Getting Windows 7 to load with UEFI is hard, so they load in BIOS mode instead.
Moving forwards, We are now have a new recommendation:
“Install new Computers for Windows 7 in UEFI mode without Secure Boot!”  
 – May require an updated BIOS
 – May require CSM “Hybrid Mode” not full BIOS mode.
The advantage here, is that if/when it becomes necessary to migrate to Windows 10 and leverage the security features of Windows 10, all we need to do is run the standard Windows 10 In-place upgrade task sequence for SCCM/OSD or MDT. Don’t fall into the CSM/BIOS trap! :^)
OEM Specific settings
Now, honestly, we have had some problems getting Windows 7 running on a pure “UEFI” implementation, instead we have found out that you must enable *some* legacy aspects of CSM, but not the full CSM mode. We call this “UEFI Hybrid” mode, after the name HP gave this mode (see below).
So how would this look on various machines? Well, we can go into the BIOS and change the settings
- “LegacyoRom” set to “enable”
- “ActiveBootList” set to “UEFI”
- “UEFI/Legacy Boot” set to “Both”
- “UEFI Priority […]” = “UEFI First”
- “CSM Support” = “YES”
- “Boot Mode” = “UEFI Hybrid (with CSM)”
Hopefully this should help you move forwards to Windows 10, yet still deploy Windows 7 for your existing needs.