Dell PowerEdge R350 Integrated Remote Access Controller 9 Attribute Registry - Page 381

When the value of SecureBootMode is DeployedMode AND the value of SecureBoot is Enabled, BIOS will append a ProgReadOnlyLocal modifier to SecureBoot, SecureBootPolicy, and SecureBootMode. This means that inband system management tools will not allow users to change these attributes when these conditions are true. Legal Values ● Enabled ● Disabled Default Value Not Applicable Write Privilege Server Control License Required iDRAC Express or iDRAC Enterprise Dependency Not applicable BIOS.SysSecurity.SecureBootMode (Read or Write) Description This field configures how the BIOS uses the Secure Boot Policy Objects (PK, KEK, db, dbx). In Setup Mode and Audit Mode, PK is not present, and BIOS does not authenticate programmatic updates to the policy objects. In User Mode and Deployed Mode, PK is present, and BIOS performs signature verification on programmatic attempts to update policy objects. Deployed Mode is the most secure mode. Use Setup, Audit, or User Mode when provisioning the system, then use Deployed Mode for normal operation. Available mode transitions depend on the current mode and PK presence. Refer to Figure 77 in the UEFI 2.6 specification for more information on transitions between the four modes. In Audit Mode, the BIOS performs signature verification on pre-boot images and logs results in the Image Execution Information Table, but executes the images whether they pass or fail verification. Audit Mode is useful for programmatically determining a working set of policy objects. When the value of SecureBootMode is DeployedMode AND the value of SecureBoot is Enabled, BIOS will append a ProgReadOnlyLocal modifier to SecureBoot, SecureBootPolicy, and SecureBootMode. This means that inband system management tools will not allow users to change these attributes when these conditions are true. This attribute is always read-write in BIOS Setup and in out-of-band system management tools. Legal Values ● SetupMode ● UserMode ● AuditMode ● DeployedMode Default Value Not Applicable Write Privilege Server Control License Required iDRAC Express or iDRAC Enterprise Dependency Not applicable BIOS.SysSecurity.SecureBootPolicy (Read or Write) Description Legal Values Allows selecting the Secure Boot Policy. When set to Standard, the BIOS uses the key and certificates from the system manufacturer to authenticate pre-boot images. When set to Custom, the BIOS uses the user-customized key and certificates. Note: If Custom mode is selected, the Secure Boot Custom Policy Settings menu is displayed. Note: Changing the default security certificates may cause the system to fail booting from certain boot options. When the value of SecureBootMode is DeployedMode AND the value of SecureBoot is Enabled, BIOS will append a ProgReadOnlyLocal modifier to SecureBoot, SecureBootPolicy, and SecureBootMode. This means that inband system management tools will not allow users to change these attributes when these conditions are true. ● Standard ● Custom BIOS Attributes 381