I just came across the same article. So the current assumption would be that for desktops allowing or not the user to disable Secure Boot is up to the OEM in all cases. That is still an assumption, though, as I didn't see any official information coming from Microsoft, as the one found here for Windows 8.

Anyway that shouldn't be a show stopper for Linux users as long as signed EFI binaries are available, provided that their signatures be accepted by the firmware, of course. Stay tuned

While we are making hypothesis, the really worrying scenario for Windows 10 users, IMHO, would be that their system may no boot after installing new hardware. For Windows 8 desktop users the workaround is to disable Secure Boot before installing the new hardware as explained in this article (cookies mandatory), but what if you are using Windows 10 and the OEM doesn't allow to disable Secure Boot?

I realize that I am going way off topic after having told others not to, sorry.

It is an old number by Microsoft that works.Discouragement BY Incompatibility.
Who remembers old DOS and MS-DOS knows.

it is not a safety, IT'S feature.

You don't have that choice outside France! Each and every laptop has Windows pre-installed! Some brands sell one or two models that are preloaded with Ubuntu but that's it. Only companies like bto.eu sell winless laptops but at a price. Their entry level system would cost me at least EUR 550, instead of a similar system preloaded with Windows costing around 400 euro.

It's time this kind of business is flagged to the EU antitrust offices again.

but I'm bored as M$ again and again manages to fool people.
Like dutchy013 said if they remain only machines with preinstalled Windows / the feature/ my liking or not will have no meaning, and you will never again be bored by Microsoft bashing again and again :-)

Universal happiness.
Former Throw in the ass lamented Balmer will be healed.

@BratPit: This kind of rant doesn't help to solve the OP's issue. Can't you just stay on topic?

I'm sorry Eric, but you just really made my day, and now I can't stop laughing. Okay sides hurting...

We're sorry, the page you requested cannot be found.

After looking around a bit, I guess this is the right link:

https://msdn.microsoft.com/en-us/lib...(v=vs.85).aspx

Thanks dutchy013, fixed now.

In https://msdn.microsoft.com/en-us/lib...(v=vs.85).aspx (Windows 10 Minimum hardware requirements) there is this section:

6.8 UEFI and Secure Boot
Windows 10 for desktop editions and Windows 10 Mobileand Windows 10 IoT Core must boot into UEFI mode by default and ship with UEFI Secure Boot enabled. System firmware must be compliant with the UEFI Specification Version 2.3.1 or higher.
OEM systems for special purpose commercial systems, build to order, and customer systems with a custom image are not required to ship with UEFI Secure Boot enabled.
Windows 10 for desktop editions and Windows 10 IoT Core systems can optionally support the ability to disable Secure Boot via firmware setup. Windows 10 Mobile systems must not implement the ability to disable Secure Boot. Windows 10 for desktop editions and Windows 10 Mobile systems must implement measurements into PCR [7].
Note No systems should allow programmatic disabling of Secure Boot during boot services or after exiting EFI boot services.

The highlighted sections are the parts relevant to OEM resellers. It can be interpreted reversely: it is not demanded of the OEM anymore that they allow the Secure Boot to be disabled.

2 members found this post helpful.

Why?
You stated "Windows 10 has a mandate Secure Boot be mandatory on all PCs." (really bad english by the way) but I still have not seen a source where this statement of yours is backed with facts.

That's how I understand it too, thanks for the link. At least there is a demand to be compliant to version 2.3.1 or greater of the UEFI specification, which is a good thing IMO as so providers of EFI images and applications now know what they should expect from the firmware of such machines.

It did not take the wisdom of Solomon to see that coming.
Perhaps your glee will be subdued by considering how M$ is manoeuvring in this space. Consider the requirements for Windows 10 on SoC. https://msdn.microsoft.com/en-us/lib...v=vs.8529.aspx
Under Security requirements -> UEFI secure boot
which according to http://www.uefi.org/sites/default/fi...Spec_2_3_1.pdf Section 27.5 p 1444 translates to an OEM can only ship Windows 10 with no other OS installed. With the historical close link between M$ and OEMs, that becomes a given.
Updating the signature database is being pushed to the OEMs discretion.
What is to stop the OEM from simply deleting the offending image?
The user is no longer in charge.
The ability to turn off Secure Boot is at the OEMs discretion, not mandatory as per previous.
The user has no recourse.

Requirements 12 to 21 do not seem quite so draconian.

Have a nice day!

1 members found this post helpful.

Thinking out loud here:

It is me, or is UEFI from a technological viewpoint somewhat massively flawed in design? No set standards like traditional BIOS where you have traditional template BIOS ROMs from AMI or Award that are fairly uniform so chances of systems ending up with buggy UEFI can occur other than what Microsoft wants which is still fairly loose in design. EF00 partition is formatted in FAT style which can be dangerous for data loss if mounted and you have a system failure compared to an MBR or an EF02 BIOS boot partition which can not be mounted so no data loss could occur, or lessens the chance greatly of loss to data from the bootloader. Secure Boot is nothing really seemingly but a bandaid to BIOS Protection Mode which accomplishes fairly the same thing minus some minor aspects that are just outlandish like signing bootloaders. I mean in all honesty, UEFI from a point of view can look very halfassed and slapped together. I mean GPT was the real gain here in solving the problem of MBR systems limited to a certain amount of partitions.

End of thinking out loud.

1 members found this post helpful.

@ReaperX7: did you read the UEFI specification?

Sorry to look rude but really, I'm tired of reading such baseless statements, additionally completely off topic.