怎样禁用UEFI boot option中的USB启动，防止U盘WIN PE系统黑入电脑？

Title： Disable all UEFI boot options

tblatt 问：

Hello,

system: Latitude E6530

I want to disable all UEFI boot options when system ist booting.

In BIOS setup under Settings --> General --> Boot Sequence, I can configure the boot list options for UEFI. But when I disable all options (NIC, USB, DVD, ...) and apply, they appear anyway at booting system pressing F12. The same, when I delete all boot options. When I go back after booting to BIOS, the options are there again.

With legacy options it's fine, all changings appear at booting.

What I have to do? Is there a additional box which I have to check?

Best Regards

Thomas

Dell 技术服务回答：

Hi,

F12 is a One-Time Boot menu. you can see all the supported boot options which the System has currently . This is mainly for the one time boot mode entry. when you restart the system the system will boot only from by the priority which you specified in the F2 screen settings under -->General --> Boot Sequence.

F2 screen Boot sequence is for setting the priority on which the system should boot at startup.( without using F12 each time )

F2 boot sequence ( Pre- Set boot priorities ) is different from F12 boot ( One time Boot Menus ) .

For more clarification: - Insert USB into system and see in F12 boot. you can see USB boot option.

- Remove the USB from the system and see in F12 boot. you will not find the USB boot option.( inspite of this Option is disabled in F2 or not. )

tblatt 问：

Hi,

thanks for your answer.

You say F12 shows all the boot options, the system has. But for legacy mode, it's working for me. I press F12, select the options I want to have, save, boot, F12, and under Legacy, there are exactly the checked options.

For UEFI, the system doesn't care, which options I check or uncheck, it always shows me usb or cd (when usb or cd is plugged in).

What I want to do is, to prevent, that our users can boot from their own usb stick or cd.

Is there a way to realize this?

Best Regards

Thomas

Dell 技术服务回答：

Hi ,

Try this. these are the options to disable the boot support of USB and CD devices.

Bios Version:  A12 .

System Configuration >> USB configuration >> uncheck Enable Boot Support - ( this will disable USB boot support )

System Configuration >> Miscellaneous Devices >> uncheck Enable Module Bay - ( this will disable the CD/DVD device boot support )

Now press F12 and check.  USB and DVD/CD boot devices will not be shown even if Devices are connected.

Note:- i hope this options will be available in A13 Bios under same category.

U盘启动和光盘启动可以绕过你硬盘上安装的操作系统，转而使用win pe将操作系统加载至内存，从而绕过你硬盘上安装的操作系统和其上的密码、安全设置、摆渡工具等所有安全防范。

后记：win pe启动拷贝文件是否会记入event log等其他相关日志并写入硬盘？ 这个有待试验调查。