pupils boot from usb!? it's disabled (windows boot manager) I think..

[chazzy2501]

I have boot from usb media disabled in the bios but it turns out if a pupil uses the old shift+reboot (windows recovery) then they can specify boot from usb . I'm thinking that the windows boot manager is allowing this to happen. (the PC has a UEFI bios)

 

The boot order is windows boot manager then PXE, that is all. (the boot manager places itself in the boot order after a PXE image)

 

Do I have a bugged UEFI or is this expected behaviour of the windows boot manager?

 

EDIT: (the dvd drive was still enabled as a boot device but it is disconnected internally. Maybe a specially crafted usb stick could appear as a cd drive and this would fool the bios?)

 

Am I wrong, I'm putting this together from CCTV footage.

 

Also what would it take to protect the OS on the internal drive?

 

edit2: Elitedesk 800 G1 latest bios

Edited June 8, 2022 by chazzy2501

[glen_j]

That's expected behaviour shift + restart brings up recovery options. We've removed the shutdown button from the startmenu and login screen via GPO to prevent this and added a log off and shutdown shortcut to the desktop instead. If they have a TPM module you could enable bitlocker too. Edited June 8, 2022 by glen_j

[mavhc]

reagentc.exe /disable

[bald_pig]

Have you actually disabled USB boot, or just removed it from the boot order?

[chazzy2501]

should I just disable windows RE? is this a GPO option..

[chazzy2501]

Have you actually disabled USB boot, or just removed it from the boot order?

 

The USB options are still in the boot order but greyed out and you can't select them. (I'd have to dig around the BIOS to see the wording)

[mavhc]

should I just disable windows RE? is this a GPO option..

 

Yes, and don't think so

[clareq]

You should be able to run a start up script by GPO, to disable Windows RE. This thread has some ideas http://www.edugeek.net/forums/windows-10/201059-removing-windows-restore-repair-shift-restart.html

I have

bcdedit /set {default} recoveryenabled No
bcdedit /set {default} bootstatuspolicy ignoreallfailures

as a startup script here, which works well.

[DrBeaker]

I just disable booting everything except HDD and PXE/LAN booting.

 

We have passwords on the BIOS too.

 

Can you check those options at all?

 

If there is a need for USB booting - it's only ever going to be me doing it, even that's rare with PXE boot etc. I happily toggle it on/off again during the work if doing USB. Otherwise it comes back to the office with me to do where I can do it without the kit being messed with.