Step reference
Secure Boot check
Report whether Secure Boot is enabled and record the finding on the job — optionally failing the setup if it's off.
What it does
Checks whether Secure Boot is enabled and records the result on the job, so you have evidence of the device's boot-security posture. By default it's report-only: a disabled result completes the step with a clear finding rather than failing the build.
Options
| Option | What it controls |
|---|---|
| If Secure Boot is disabled | Report only (default) — complete the step and show the finding. Fail the step — treat a disabled result as a failure (then the step's fail behaviour decides stop vs warn). |
Good to know
- It reports; it doesn't switch Secure Boot on. Secure Boot can't be enabled from within Windows. To actually turn it on, use the HP or Dell BIOS configuration step, which runs in WinPE before Windows installs.
- A natural pairing: enable Secure Boot via the OEM BIOS step early in the template, then verify it with this step later as proof.
Part of the step catalogue.
Related
Install Windows 11
True bare-metal Windows 11 install with the right OEM driver pack injected automatically. Skips cleanly if the device already has Windows.
OOBE configuration
Auto-answer the out-of-box screens (region, keyboard, device name, EULA, optional Wi-Fi) and optionally skip the account screen so the device lands ready — no duplicate admin.
Language & region
Set the display language, keyboard layout, regional format, home location and timezone for the installed Windows and every new user. Autopilot-compatible.