CLI Guide

Table 235. SecureBootPolicy (continued)
Description
Sets the process to authenticate pre-boot images. When set to Standard, the
BIOS uses the system manufacturer keys and certificates to authenticate pre-boot
images. When set to Custom, the BIOS uses user-defined keys and certificates. The
default value is Standard.
Example:
A:>syscfg --SecureBootPolicy=Standard
SecureBootPolicy=Standard
Applicable Systems PowerEdge 12G and later systems
UefiVariableAccess
Table 236. UefiVariableAccess
Valid Arguments
● On systems prior to 13G: NA
● On 13G and later systems: Standard, Controlled
Description
Secures the UEFI variables. When set to Standard, the UEFI variables are
accessible from the operating system as per the UEFI specification. When set to
Controlled, selected UEFI variables are protected in the operating system and
new UEFI boot entries are pushed to the end of the current boot order.
Example:
A:>syscfg --UefiVariableAccess=Standard
UefiVariableAccess=Standard
Applicable Systems PowerEdge 13G and later systems
SecureBootMode
Table 237. SecureBootMode
Valid Arguments
● On systems prior to 14G: NA
● On 14G and later systems: UserMode, DeployedMode.
Description
This feature configures the BIOS uses the Secure Boot Policy Objects — PK, KEK,
db, dbx. In Setup Mode and Audit Mode, PK is not present, and BIOS does not
authenticate programmatic updates to the policy objects.
In User Mode and Deployed Mode, PK is present, and BIOS performs signature
verification on programmatic attempts to update policy objects.
Deployed Mode is the most secure mode. Use Setup, Audit, or User Mode when
provisioning the system, then use Deployed Mode for normal operation. Available
mode transitions depend on the current mode and PK presence.
In Audit Mode, the BIOS performs signature verification on preboot images and logs
results in the Image Execution Information Table, but executes the images whether
they pass or fail verification. Audit Mode is useful for programmatically determining a
working set of policy objects.
Example:
A:>syscfg --SecureBootMode=UserMode
SecureBootMode=UserMode
Applicable Systems PowerEdge 14G and later systems
116 SYSCFG