Step reference
Secure Boot check
Report whether Secure Boot is enabled and record the finding on the job, optionally failing the setup if it's off.
What it does
Checks whether Secure Boot is enabled and records the result on the job, so you have evidence of the device's boot-security posture. By default it's report-only: a disabled result completes the step with a clear finding rather than failing the build.
Options
| Option | What it controls |
|---|---|
| If Secure Boot is disabled | Report only (default): complete the step and show the finding. Fail the step: treat a disabled result as a failure, after which the step's fail behaviour decides stop vs warn. |
This step reports; it does not switch Secure Boot on
Secure Boot cannot be enabled from within Windows at all. To actually turn it on, use the HP or Dell BIOS configuration step, which runs in WinPE before Windows installs.
Good to know
- The natural pairing is to enable Secure Boot with the OEM BIOS step early in the template, then verify it with this step later as proof for the client.
Part of the step catalogue.
Related
Install Windows 11
True bare-metal Windows 11 install with the right OEM driver pack injected automatically. Wipes the target disk; runs only on the USB entry point.
OOBE configuration
Auto-answer the out-of-box screens (region, keyboard, device name, EULA, optional Wi-Fi) and optionally skip the account screen so the device lands ready, with no duplicate admin.
Language & region
Set the display language, keyboard layout, regional format, home location and timezone for the installed Windows and every new user. Autopilot-compatible.