Solved Do You Use Secure Boot?

Buddywh said:

Yeah... but you're a smart guy about these things. A half-smart guy like me... or especially a DIY naif building their first system... won't always see the potential trap Microsoft laid for them.

Click to expand...

Yes, that is the issue. MS think they know what's best for us and set things up the way they'd like us to work without telling us.
9 times out of 10 it works fine and the user doesn't even notice. But that 10th time - oh boy does it hurt bad!

spapakons said:

Windows 11 has the interface of Windows 10X and version number 10.0.2xxxx.xxxx so it is basically Windows 10 with new skin and new features. Regarding Memory Isolation, this feature protects RAM data from virtual machine exploits. If you don't run a virtual machine is best disabled because it is a severe performance penalty.

Click to expand...

"I'm not sure that I agree with you 100% on your police work there, Lou."

The first part reminds me of our long-winded discussion about version numbers some time ago. You put way too much weight on their meaning. They're basically there to compare one version to another, and that's it. When iOS went from version 18 to 26 in a year's time, it wasn't that there were huge leaps in functionality that required a boost of eight.

As for the Windows features, there's no such thing called Memory Isolation, or Integration as you later called it. There are Core Isolation and Memory Integrity, neither of which have anything to do with whether you run virtual machines.

TraderGary said:

I can certainly appreciate the cost of new hardware. I just purchased two new W11 machines, and my trading account is definitely a bit lighter!

I think about this, when you bypass the requirements on older machines, you do lose key W11 security capabilities.

Click to expand...

If your machine doesn't have stuff like TPM2, you have no choice but to bypass that requirement if you want to install Windows 11.

TraderGary said:

think about this, when you bypass the requirements on older machines, you do lose key W11 security capabilities.

Click to expand...

It does depend a lot on the motherboard but you don't always have to give up Win11 security capability.

I was able to bypass Win11's install requirements on my 2012-era AM3+ motherboard and FX processor. The last BIOS update for it included UEFI support including secure boot and I was able to bypass TPM and processor requirements. I put in a discrete TPM1.2 module that DOES work to protect the Bitlocker key (everything I was told before-hand proved false it seems), and I also got a full complement of updated Secure Boot keys via MOSBY, including the KEK. So Win11 now works with its security as intended.

Well, all except for Memory Integrity since the SVM mode in FX processors simply sucks. And while I agree the TPM1.2 isn't nearly as secure as a TPM2.0 device, it's still more than enough for my purposes.

BTW: I don't recommend this except as a lark and using parts you happen to have lying about from upgrades over the years. It is certainly not really worth spending a lot on anything to do it.

I turned it off, it causes too many issues booting from usb sticks.

I don't use BitLocker on my in-house systems, with people almost always here and a good alarm system, there's very little chance of physical access to those machines by any outsider.

gunrunnerjohn said:

I don't use BitLocker on my in-house systems, with people almost always here and a good alarm system, there's very little chance of physical access to those machines by any outsider.

Click to expand...

Break-ins aren't that common in my township, but I really don't see any good reason not to use it. And also, any alarm system is only as good as the response from local constabulary: probably 20-30 minutes at best in many communities if they don't know for certain there is a life in jeopardy. That's more than enough time to snatch and run off with the stuff that looks easily sellable: like computing equipment.

I keep personal files and backups on external USB drives encrypted with BitLocker-to-Go which I move to whichever computer I want to use, even my laptop when I travel. That drive unlocks at startup with a key that's kept on the Bitlocker encrypted system drives of the computers I use it on... which itself only unlocks when the TPM unseals it... but only after validating a successful Secure Boot meaning the system hasn't been tampered with.

I feel this really is creating a layered defense to allow me to travel with portable drives full of personal information and not be scared to death of someone stealing or losing them. And moving the portable drive to my other computers is easy and transparent - even to a strange win10 or 11 computer (if needed) with the recovery key. This is also a lot easier and cheaper than setting up a NAS server for my other desktops, and the easiest way to travel securely with the data and the laptop.

I've never had any problems with this arrangement: except when I made them with messing around with things I shouldn't have been. All I had to do was dig out the Recovery Key and I was back in business... a little wiser for what I did.

All this " security " is killing us slowly..............
Never used it and never any problems or other " security"-stress.............

I remember an Administrator in the 90's at University that locked down the computers so we couldn't run unapproved programs. But he overdid it, we weren't allowed to even load Notepad to take notes! When we told him he spent a lot of time trying to fix it because he didn't remember everything he did to lock it. That was the moment I hated Windows NT 4.0 and every other limited access version and appreciated that I had full access to my Windows 95 system. I don't like being a limited user, I like being Admin.

PS: Sorry for the duplicate, it stuck when posting and upon clicking the button again posted twice.

spapakons said:

I remember an Administrator in the 90's at University that locked down the computers so we couldn't run unapproved programs. But he overdid it, we weren't allowed to even load Notepad to take notes! ...

Click to expand...

Oh yah.. that was exactly the kind of thing I was afraid would happen when I started to use secure boot and bitlocker to secure my system. But once I'd set it up and saw just how transparent it was, I was more than a little surprised.

One thing I dislike is UAC... I really, really, REALLY hate the extra dialogue box I have to click through to start something like Terminal with Admin rights, for instance. But I also see it's usefulness.

spapakons said:

I remember an Administrator in the 90's at University that locked down the computers so we couldn't run unapproved programs. But he overdid it, we weren't allowed to even load Notepad to take notes! When we told him he spent a lot of time trying to fix it because he didn't remember everything he did to lock it. That was the moment I hated Windows NT 4.0 and every other limited access version and appreciated that I had full access to my Windows 95 system. I don't like being a limited user, I like being Admin.

PS: Sorry for the duplicate, it stuck when posting and upon clicking the button again posted twice.

Click to expand...

Under Edit > Options, you can delete the duplicate.

Egads, I've duplicated the duplicate!

TraderGary said:

Under Edit > Options, you can delete the duplicate.

Egads, I've duplicated the duplicate!

Click to expand...

Where? I cannot find it.

Buddywh said:

Oh yah.. that was exactly the kind of thing I was afraid would happen when I started to use secure boot and bitlocker to secure my system. But once I'd set it up and saw just how transparent it was, I was more than a little surprised.

One thing I dislike is UAC... I really, really, REALLY hate the extra dialogue box I have to click through to start something like Terminal with Admin rights, for instance. But I also see it's usefulness.

Click to expand...

I also hate UAC, so I always set it to the lowest level so it bothers me only for important actions that might damage my system. Not for everything. This is very important for me because I use a lot of old applications and I have set them to run as Admin for compatibility reasons. I would hate to see the UAC every time I launch one.

spapakons said:

Where? I cannot find it.

Click to expand...

Look for the Delete icon at the bottom left of your post.

Buddywh said:

Break-ins aren't that common in my township, but I really don't see any good reason not to use it. And also, any alarm system is only as good as the response from local constabulary: probably 20-30 minutes at best in many communities if they don't know for certain there is a life in jeopardy. That's more than enough time to snatch and run off with the stuff that looks easily sellable: like computing equipment.

Click to expand...

Well, one reason is the performance impacts. Also, the complication when you do updates of system components, hence @garlin recommending turning it off before updating the secure boot certs, etc.

Secure Boot itself has zero performance impact on Windows.

Enabling Secure Boot allows you to enable VBS and other kernel security features, which will cause some level of performance drag. It's not from Secure Boot doing its job, but having the option for those enhanced security features that can't happen without Secure Boot building a "safe foundation" by being there at boot time.

garlin said:

Secure Boot itself has zero performance impact on Windows.

Enabling Secure Boot allows you to enable VBS and other kernel security features, which will cause some level of performance drag. It's not from Secure Boot doing its job, but having the option for those enhanced security features that can't happen without Secure Boot building a "safe foundation" by being there at boot time.

Click to expand...

For a new and compliant PC the performance penalty is negligible, I guess, but for an unsupported PC every detail counts. Especially when it is already slow and you try to make it faster. So apart from disabling visual effects (transparency, animations, fades) and useless startup applications, you must also disable Memory Integrity and anything else that slows it down.

gunrunnerjohn said:

Well, one reason is the performance impacts. Also, the complication when you do updates of system components, hence @garlin recommending turning it off before updating the secure boot certs, etc.

Click to expand...

I can't see how Secure Boot could affect performance once in Windows. And even on my "antique" unsupported system (AM3+ with FX6300) I don't see any performance impact with bitlocker once it finally completed encrypting the drive. It's just as snappy as it was before encrypting the drive... and that alone surprised the heck out of me when I got Win11 installed on it.

But yes, installing anything that alters the Secure Boot environment will put it into Bitlocker recovery unless protection is suspended for the next bootup in the Bitlocker applet. Microsoft seems to handle it transparently with updates at least... I suspect that's why I see more 2nd restarts after an update when it disables protection until the update process is completed. For a BIOS update I will have to disable protection completely for a while (there's a PowerShell command to do that easily enough) until I'm confident the new BIOS is working OK; otherwise have the recovery key handy until settings are stable with Secure Boot enabled. But nothing has posed any problems so far.

Secure Boot as related to the UEFI, only happens once at boot-time. The UEFI will compare the boot file's signing cert against the enrolled DB certs, and block anything listed on the DBX list. If your boot file's cert passes inspection, it's allowed to boot.

Windows boot manager will check the DBX's SVN number (if one exists) and stop booting on its own if the current SVN is higher than the SVN programmed into the boot file in the .rsrc region. This prevents attackers from rolling back to an older version of the boot manager.

This takes almost no time to process. If the boot manager makes it this far, it starts a process of setting specific security flags in a protected CPU register.

Windows cannot run in VBS or use Core Integrity features if these flags are not detected. Secure Boot doesn't need VBS. But VBS needs Secure Boot.

When uninformed users say Secure Boot is slowing down their system, what they mean is VBS is running. VBS virtualizes parts of the Windows kernel to protect itself from... Windows. You're running a VM-like environment on top of whatever else is going on. This is done to sandbox naughty drivers that were written with malicious intent from having free reign over the entire system.

garlin said:

users say Secure Boot is slowing down their system, what they mean is VBS is running

Click to expand...

What's VBS again? Is that Intel's equivalent to AMD's SVM (hardware virtualization)?

At any rate, I do note that SVM slows my system down but I think that's only when I enable Memory Integrity. With that off it's pretty normal. But also, my most sluggish machine is my antique with an FX processor and I can't really run it in Windows much with it enabled. On that one SVM simply sucks and Windows randomly crashes if I enable it - but then W11 isn't supposed to work at all on that machine so I'm not complaining.