Why does Windows 11 need secure boot

barman58 · Jan 2, 2022

Microsoft are simply stating that they will not support any system that does not meet certain technical specifications. this as a standard disclaimer that any company would provide to protect themselves.

The reason for the requirements are clearly stated by microsoft, eg the acceptable processors have certain new technologies included that May be used in future feature updates, ( and that if this is the case then non compliant systems will not be updated).

I am sure that Virus threats are more psychological than real, as they have not been a serious issue for more than 20 Years. there are various forms of current malware in the wild and thus new technologies such as secure boot are needed for todays threats.

barman58 · Jan 2, 2022

Wynona said:
Sounds good, Nigel! I think I'll do that.

What I would actually suggest is that you add a link to the tutorials section for the relevant OS as Shawn's (and others), tutorials cover all the basics, and they could then have you to go into more details in class when needed

jimbo45 · Jan 2, 2022

Hi folks
I think SCAMS and things like identity theft are actually more of a problem for (and I emphasize) standard Home users rather than malware or viruses -- those in W11 are excellently taken care of these days by WD. For those running web servers, work type networks etc then extra security is usually not a bad idea though.

I think the main reason secure boot is required is once one starts going into the realms of OS encryption and coupled with the TPM module where you can generate / use specific keys. This will add a great safety measure (maybe over the top for home users) and also could be used to control piracy (although there are so many legal ways to get W11 - perhaps Ms should kust byte the bullet and give it away.

For those that are interested -- in the install / add optional features you can install the tpm utility which can give info on the tpm running in your system whether you are using an "emulated" one or have real hardware.

Cheers
jimbo

barman58 · Jan 2, 2022

Jimbo,
If you take a deeper look at targeting of scams and related malware, it is actually better if the home user is more protected automatically than the businesses, I would expect any business to take full precautions against all the different attack vectors themselves to protect their assets.

The same cannot be said for the majority of home users they are the targets of scams and related malware and once made a victim this can result in their hardware joining a botnet or other distributive computing attack which can be used for further attacks

spapakons · Jan 2, 2022

Make no mistake. Even a fully compliant system with Secure Boot and TPM 2.0 is not immune. Unless you decrypt your files to make it harder to access them, if anyone has stolen your computer, all he has to do is remove the disk and connect in his computer to steal your data. Secure Boot and TPM do not magically protect you from that. If the disk is encrypted, it is more difficult to access it but not impossible. The same level of security can by enabled in Windows 10 as well, if you have the appropriate hardware. So Windows 11 is not by miracle better than Windows 10. If you can run Windows 10 on your current system, then why not also run Windows 11. Doing that doesn't make it more vulnerable than it is with Windows 10, just because you don't have Secure Boot and TPM 2.0. It will have exactly the same level of security if you run the same applications. Don't let anyone mislead you. Use your brain.

barman58 · Jan 2, 2022

Personally, Windows 11 gives me nothing over Windows 10, although my systems are fully compliant, so I only run it on test setups, retaining Windows 10 on my front line systems until I am ready to upgrade - as I am currently involved with a lot of software testing I do not want to add additional potential variables into the tests At this stage.

This is the way I've worked as an IT Pro for the last forty plus years, the minor upgrade that is currently in Windows 11 is not an essential must have, more of a reskinning of Windows 10, which I don't see very often as i run my software full screen, but I will phase it in when I have free time, and the system has settled down

spapakons · Jan 2, 2022

Exactly what you said. Windows 11 is Windows 10 with a nicer skin and some more features. Like Windows 98 and Windows 98 SE were. I like the new look, I welcome the new features, so I won't be held back because my system is non-compliant. Thankfully I can go around the restrictions.

Zardoc · Jan 3, 2022

I have seen Win 11 exactly the same way as Nigel has and nothing more than a Win 10 with a nice dress and a pair of handcuffs. I just started up a new Dell ordered for a customer. I always reinstall Win without the crap. These I....ts had Bitlocker enabled for new customers by default. I just noticed it when I tried to change the drive to a more performing option.

I installed 11 because some of my clients want it and I need to be able to help them surf through the settings. So far, the ONLY thing I like in Win 11 is the snap screen option. And it's far from being perfect. If you are in a zoom session and someone goes full screen on an image, you loose your settings when full screen is turned off.

The limited task bar and limited explorer bar bother me and especially the 2 part context menu.

Bitlocker is a great toy for those who want added security. But you better know how to use it because you may loose all your data if you make a bad move or loose your key code. I have a Veracrypt folder that holds all my important stuff and the drive is backup every day on a NAS.

Mind you, I like the shell of Win 11 but doesn't Stardock make something for that?

Edwin · Jan 3, 2022

Zardoc said:
...Win 10 with a nice dress and a pair of handcuffs...

Bree · Jan 3, 2022

spapakons said:
About official Microsoft support, most of us don't give a damn as they rarely help us solve our issues. Forums like this are much faster and much helpful. Who cares about Microsoft? Me not.

The only official Microsoft support that matters are the OS updates through Windows Update. There is a risk that MS may stop providing them to unsupported devices. The exact wording of the statement from Microsoft is that "Devices that do not meet these system requirements will no longer be guaranteed to receive updates, including but not limited to security updates" (my bold)

So far unsupported devices have received all the updates and I would rate the risk of MS stopping them as very low, but not so low that it can be ignored completely.

spapakons · Jan 3, 2022

When that happens (if it ever does) will be the same as using Windows 7/8 today or Windows 10 after 2025 when it will be out of support. This means no new features through Windows Update, no new security fixes etc. For security we could install a third party antivirus. For other features it might be a workaround. Also if we cannot install updates from Windows Update, maybe we can manually download them from Microsoft Update Catalog and install them. I believe that all of this will happen in the far future and by then we will probably have upgraded our computers, so we won't care. Until then, I will take the chance to run Windows 11 on my unsupported computer (see 2nd PC specs).

Zardoc · Jan 3, 2022

Here is the Win 10 system requirements. As you can see the wording has changed from Experience to updates.
These are the basic requirements for installing Windows 10 on a PC. If your device does not meet these requirements, you may not have as great an experience with Windows 10 and might want to consider purchasing a new PC.

As you can see with other options below Bitlocker requirements are there but you didn't need them to install, they just might not work properly.


Processor:	1 gigahertz (GHz) or faster processor or System on a Chip (SoC)
RAM:	1 gigabyte (GB) for 32-bit or 2 GB for 64-bit
Hard drive space:	16 GB for 32-bit OS 32 GB for 64-bit OS
Graphics card:	DirectX 9 or later with WDDM 1.0 driver
Display:	800x600
Internet Connection:	Internet connectivity is necessary to perform updates and to download and take advantage of some features. Windows 10 Pro in S mode, Windows 10 Pro Education in S mode, Windows 10 Education in S mode, and Windows 10 Enterprise in S mode require an internet connection during the initial device setup (Out of Box Experience or OOBE), as well as either a Microsoft account (MSA) or Azure Activity Directory (AAD) account. Switching a device out of Windows 10 in S mode also requires internet connectivity. Learn more about S mode here.

In addition to the requirements above that are needed to run Windows, some features have additional requirements. In some cases, features included with updated versions of Windows 10 will be best experienced with newer processors. For specific hardware support please refer to your Original Equipment Manufacturer (OEM). Below are some additional details regarding requirements for key features:

BitLocker Drive Encryption (available with Windows 10 Pro or Windows 10 Enterprise only) requires a Trusted Platform Module (TPM) 1.2 or higher and Trusted Computing Group (TCG)-compliant BIOS or UEFI. BitLocker can be used on devices without TPM, but you will need to save a startup key on a removable device such as a USB flash drive. TPM 2.0 and InstantGo support is required when you want to automatically encrypt the local drive when joining a device to Azure Active Directory (AAD). Check with your PC manufacturer to confirm if your device supports the correct TPM version and InstantGo for the scenario you want to enable.
BitLocker To Go requires a USB flash drive (available in Windows 10 Pro and Windows 10 Enterprise only).
Client Hyper-V requires a 64-bit system with second level address translation (SLAT) capabilities and additional 2 GB of RAM (available in Windows 10 Pro and Windows 10 Enterprise only).
Cortana is only currently available on Windows 10 for the United States, United Kingdom, China, France, Italy, Germany, Brazil, Mexico, Japan, Canada, Spain, Australia and India.
Microsoft account is required for some features.
Miracast requires a display adapter which supports Windows Display Driver Model (WDDM) 1.3, and a Wi-Fi adapter that supports Wi-Fi Direct.
Movies & TV application is not available in all regions. For the most up-to-date list of regions, please go to the Movies & TV information page.
Secure boot requires firmware that supports UEFI v2.3.1 Errata B and has the Microsoft Windows Certification Authority in the UEFI signature database.
Skype is available only in select countries and regions. Calling to select countries and regions only. Excludes special, premium and non-geographic numbers. For details, visit the Office FAQ page.
Snap: The number of applications that can be snapped will depend upon the minimum resolution for the application with a limit of two applications in Tablet mode and four applications in Desktop mode.
Speech recognition will vary by device microphone. For a better speech experience, you will need a:
High fidelity microphone array
Hardware driver with microphone array geometry exposed
Tablet mode is available on tablets and 2-in-1s with GPIO indicators or those that have a laptop and slate indicator will be able to be configured to enter "tablet mode" automatically.
Touch: To use touch, you need a tablet or a monitor that supports multi-touch.
Two-factor authentication requires the use of a PIN, Biometric (finger print reader or illuminated infrared camera), or a phone with Wi-Fi or Bluetooth capabilities.
Windows Hello requires a camera configured for near infrared (IR) imaging or fingerprint reader for biometric authentication. Devices without biometric sensors can use Windows Hello with a PIN or a portable Microsoft compatible security key.
Xbox application requires an Xbox Live account, which is not available in all regions. For the most up-to-date list of regions, please go to Xbox Live Countries and Regions website.
Wi-Fi Direct Printing requires a Wi-Fi adapter that supports Wi-Fi Direct and a device that supports Wi-Fi Direct Printing.

cereberus · Jan 3, 2022

tinmar49 said:
Secure boot is not needed if you never connect your pc to the internet.

Bree said:
The only official Microsoft support that matters are the OS updates through Windows Update. There is a risk that MS may stop providing them to unsupported devices. The exact wording of the statement from Microsoft is that "Devices that do not meet these system requirements will no longer be guaranteed to receive updates, including but not limited to security updates" (my bold)

So far unsupported devices have received all the updates and I would rate the risk of MS stopping them as very low, but not so low that it can be ignored completely.

Spot on but you can bet your bottom dollar, will whinge if they do not get updates as a consequence!

spapakons · Jan 3, 2022

As already mentioned, we may not be able to get Windows updates automatically, but it might be possible to download them from Microsoft Update Catalog or other third party site (such as UPP) and install them manually. Surely there will be some workaround.

Bree · Jan 3, 2022

spapakons said:
...if we cannot install updates from Windows Update, maybe we can manually download them from Microsoft Update Catalog and install them.

I suspect not. MS already have mechanisms in place to block standalone updates from installing on unsupported devices. For example, they use it to prevent RTM users installing the updates still being issued for the LTSC versions of older Windows 10, such as 1809's latest CU: 'December 14, 2021—KB5008218 (OS Build 17763.2366)'. The same applies to the Windows 7 Extended Security Updates (ESU) which will continue to be issued until January 10, 2023.

All of the above can be downloaded from the update catalog, none of them will install on a machine not entitled to them.

spapakons · Jan 3, 2022

Maybe then we can modify some Registry keys to fake/convert the Windows version or bypass compatibility check.

Bree · Jan 3, 2022

spapakons said:
Maybe then we can modify some Registry keys to fake/convert the Windows version or bypass compatibility check.

If MS ever do stop providing updates to unsupported devices, then I expect the only reason would be that they include functions that rely on CPU capabilities not present in older CPUs. If that is the case, then you may not want to install them anyway. Doing so may break your OS

Zardoc · Jan 3, 2022

I don't think MS will ever block you from getting updates. If you don't use it, you just won't get updates. And if your unsupported material is linked with other functionalities that do need updates, again you won't get them but your toy may stop working.

MS doesn't do research on the probabilities that your non supported material will work if they add updates. It's basically your call. If it works, have fun & enjoy. When it stops working, don't call support. Even when it's supported they're confused (third level support). Imagine if it's not

spapakons · Jan 3, 2022

Since my computer is unsupported, I run Windows 11 at my own risk and of course I will never ask Microsoft for support. In case that an update screws things so badly and I cannot load Windows I will hopefully go one or two system restore points back and then block that update. In worst case I will replace my SSD with the old SSD running Windows 10.

barman58 · Jan 4, 2022

Be carefully relying on restore points for system recovery
they do not back up any user data so a fault could cost you your data. Data in this case involves any files and documents, images etc and potentially user settings

Why does Windows 11 need secure boot

Moderator

My Computers

Moderator

My Computers

Well-known member

My Computer

Moderator

My Computers

Well-known member

My Computers

Moderator

My Computers

Well-known member

My Computers

Dazed & Confused

My Computer

♦ ♦

My Computers

Well-known member

My Computers

Well-known member

My Computers

Dazed & Confused

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Dazed & Confused

My Computer

Well-known member

My Computers

Moderator

My Computers

Similar threads