Timeline for What is the impact of deactivating the PCR 4 "Boot manager" from my Bitlocker Group Policy
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 21, 2022 at 17:19 | comment | added | MathisGauthey | PCR4 used to work with just the dual drive setup, not the encrypted one. I guess something keeps changing in grub, maybe the Linux mint theme is doing something like that. Or maybe it is related to the fact that GRUB autosave the last boot option and pre-selects it, I think this is related to that. Anyway, I'll keep it deactivated as I now know the impact it has, it's not worth the extra complexity for my setup ! Thanks ! | |
| Jul 20, 2022 at 13:21 | comment | added | grawity_u1686 | PCR4 should mostly work with GRUB, normally you will only need the BitLocker recovery if something changes – e.g. if GRUB gets updated, or if Windows BOOTMGR gets updated. On the other hand, PCR7 will never work with GRUB or any other external bootloader (even if it's Secure Boot-signed), as BitLocker is intentionally programmed to only rely on PCR7 if it indicates that only the "Windows CA" was used in the boot process. (That's mentioned in Event Viewer and in the MS docs somewhere.) | |
| Jul 20, 2022 at 13:19 | comment | added | grawity_u1686 |
I wasn't talking about going into Setup and changing the boot order, I was talking about the "direct" menu that you get when pressing F8 or Esc (or F11, or F10, or...) But if you don't want to use that, then the easiest alternative is to have your current OS tell UEFI to directly reboot into another OS without using the boot menu. Assuming Linux (GRUB) is the default option, run efibootmgr to find the Windows boot entry ID, run efibootmgr --bootnext 0002 to set it as the "next boot" entry, and reboot as usual.
|
|
| Jul 20, 2022 at 13:13 | vote | accept | MathisGauthey | ||
| Jul 20, 2022 at 13:13 | comment | added | MathisGauthey | Thanks for the insights, it answers all of my questions. I just can't stand going into my BIOS every time I change my OS as I'm rotating it quite often between work and gaming. Is there any convenient way that you are aware of like GRUB to make the change while keeping PCR 4 and 7 activated ? | |
| Jul 19, 2022 at 14:00 | history | answered | grawity_u1686 | CC BY-SA 4.0 |