ASRock Z87 Extreme6, Windows 8 Pro 64 bit and Secure Boot.

[balloonshark]

Hello everyone! This is only my 2nd build ever and my last build was 5 years ago. I'm totally new to most of the new tech and OS. I'm a simple home user using a non-RAID setup and I'll mostly be doing normal tasks and gaming with this PC. I would also like to take advantage of the built in security settings of Windows 8 Pro 64 bit.

I just build this rig this past weekend. Is it really worth reinstalling Windows 8 to enable Secure Boot? What settings would I need to change in the pic below to turn on secure boot? What other settings like Secure Boot (what's the deal with the keys) would I need to change before installing? If there are other settings not related to secure boot I should check (like ACHI, RAM frequency, etc.) please let me know. The UEFI has a ton of settings.



I found this guide on installing Windows 8 in UEFI mode and enabling Secure Boot. UEFI (Unified Extensible Firmware Interface) - Install Windows 8 with

With their method the disk was formatted with GPT. Is this mandatory? What are the drawbacks? Can I still image the drive?

I found the above link from this link.
Secure Boot - Enable or Disable in UEFI

I guess I need a step by step guide of what to check or change in the UEFI before installing Windows so I can activate it and make an image for safe keeping. I just found out about Secure Booting today so if there are other cool features I don't know about please let me know about them and what needs to be done to enable it.

Also, I'm on BIOS version 1.40 I think. I've been getting the occasional lock ups. Should I update it to 1.90 first? Should I keep one BIOS 1.40 and another 1.90? (not that I know how to do that yet).

P.S. Did you need to install the LAN driver like I did before you could activate Windows?

Edit: I took 2 more pics. Sorry about 2nd pics quality. It shows the boot menu where I believe it indicates that my Windows dvd is indeed a UEFI dvd.





Also, can the "No-Execute Memory Protection" be activated any time or does it have to be done before OS install?

Edit 2: Does this affect me. http://www.sapphireforum.com/showthr...highlight=UEFI If it does could I do the install anyways and disable what needs to be disabled until my card releases a fix?

Edit 3: I contacted Sapphire and the said there cards don't support UEFI.

[parsec]

Re: ASRock Z87 Extreme6, Windows 8 Pro 64 bit and Secure Boot.

Trying to explain everything related to secure boot is not easy and somewhat confusing. Secure boot is actually a feature of the underlying true change, booting Windows in true UEFI booting mode, for a lack of better terminology. The guides you posted the links to will be essential in order to install Windows so you can fully use the UEFI firmware, and then enable Secure Boot. Enabling secure boot is the simple part, installing Windows for true UEFI booting is more work, and is required for using secure boot.

Is it worth it to reinstall Windows to use Secure boot? IMO, no, I don't even use the secure boot feature. What I like is the speed that UEFI firmware starts a PC, and the potential is has compared to BIOS firmware. I have several PCs configured for UEFI booting Windows 8.

The BIOS of a mother board is really its firmware, and the new UEFI firmware is the replacement for the old BIOS firmware. All PCs with UEFI firmware are by default booting in BIOS-emulated firmware mode, that is provided by the UEFI firmware. The only thing new in this mode is the GUI style interface to the firmware settings.

The guide you found uses (unless it has been updated) secure boot as the "switch" to enable UEFI booting, which works but as a side affect of enabling secure boot. The true switch on ASRock boards to enable UEFI booting is the CSM option, which is the correct way to do this. As long as it is enabled, the PC boots in BIOS emulation mode. The UEFI on my ASRock Z77 board will disable CSM if Secure Boot is enabled, but you would need to verify that in your board's UEFI. Secure Boot itself does not need to be enabled to install Windows 8 in UEFI booting mode, just CSM disabled.

To be able to enable and use Secure Boot, you must install Windows 8 for UEFI booting (as described in the guide you listed), with the CSM option Disabled. The OS disk will be formatted as GPT by Windows if your installation media is correct for a UEFI booting installation, which is described in the guide. The downside to GPT formatting is not all OS backup programs can create an OS image with a GPT formatted disk.

Since your video card's Vbios does not support GOP, that is required for UEFI booting, you can use the onboard graphics of the CPU.

The new NIC chips on this board need drivers that Windows 8 does not have. So you don't have any Internet access at all without the drivers installed.

[balloonshark]

Re: ASRock Z87 Extreme6, Windows 8 Pro 64 bit and Secure Boot.

parsec,

Thank you very much for your reply. You did a great job of explaining about UEFI.

I can't believe I bought a $300+ graphics card that won't support UEFI. It would have been nice to use Secure Boot when gaming.

I have a few more quick questions if you don't mind.

1. In my first pic what do the other "OpRom Policy" changes do?
2. By chance, would the "Launch Video OpRom Policy" allow me to use my 7970 card and still use UEFI?
3. Does it matter what they are set to before I attempt to reinstall Windows?

Thanks again!

Edit: If I do install in UEFI mode and use my onboard graphics for daily use would I just need to enable CSM and then reboot to use my 7970?

[parsec]

Re: ASRock Z87 Extreme6, Windows 8 Pro 64 bit and Secure Boot.

parsec,

Thank you very much for your reply. You did a great job of explaining about UEFI.

I can't believe I bought a $300+ graphics card that won't support UEFI. It would have been nice to use Secure Boot when gaming.

I have a few more quick questions if you don't mind.

1. In my first pic what do the other "OpRom Policy" changes do?
2. By chance, would the "Launch Video OpRom Policy" allow me to use my 7970 card and still use UEFI?
3. Does it matter what they are set to before I attempt to reinstall Windows?

Thanks again!

Well thanks, it's not easy explaining all of this in a few words. Not that it's complex, but can be confusing. FWIW, I started a reply yesterday but was frustrated with it and quit.

Questions:

1. First, if you disable CSM, all those options disappear, not used when you are UEFI booting. Important side note, a UEFI booting Windows installation also works non-UEFI booting, meaning you can enable CSM (which disables Secure Boot) and it works fine. The OS drive is still formatted as GPT, but Windows puts a "safety" MBR partition on the OS drive during the installation, so it can work both ways.

The "OpRom Policy" things are related to Windows working both in UEFI and non-UEFI booting mode. You know what Option ROMs are? The programs that may run during POST, like the Intel RAID configuration utility, or for Marvell RAID chips? UEFI booting allows larger and more sophisticated Option ROM programs, although there aren't very many that exist currently. The point is there can be different Option ROMs stored on the BIOS... uh, firmware chip. one for UEFI booting and one for BIOS/non-UEFI booting. ASRock has the Intel RAID UEFI booting version Option ROM on the firmware chip, and the standard one too. Those OpRom Policy settings allow you to select, when non-UEFI booting, to run the UEFI booting version of the Option ROM, given that it exists on the firmware chip. The Storage setting is for the RAID utility. I believe PxE is the network or remote login configuration, or the remote system administrator interface to many PCs in a business. The video one, who knows, but it is does not allow you to use a video card that does not support GOP. So all of that description for really nothing, see what I mean about frustrating?

2.You, I, and everyone else wishes! If that worked, video card manufactures would tell us that. The video card's BIOS (Vbios) that is on a chip on the video card, is what provides the required GOP support for UEFI booting. I got lucky and my EVGA video card had a Vbios update to support GOP, and it works fine UEFI booting. It seems some video cards will never have this capability, or the manufacture simply won't do it. EVGA is only doing this for their 600 series cards, and newer models, AFAIK.

3. When you install Windows for UEFI booting, you must have CSM set to disabled before you start the installation. As I said earlier, when that is done, those options are gone, don't apply to anything happening during the installation, and aren't worth anything to most users anyway. But you must be using the onboard graphics if you install Windows 8 this way. When the first boot after the installation is done, and you're using a non-GOP video card, the ASRock UEFI stops the boot with an error.

[balloonshark]

Re: ASRock Z87 Extreme6, Windows 8 Pro 64 bit and Secure Boot.

Thank you once again parsec. You make everything easy to understand. I wasn't expecting so much information but I really do appreciate your help :).

I'm glad to hear that the OpRom option are disabled when CSM is disabled. That is one less thing I need to worry about. I'm also glad to hear that I can switch back and forth from UEFI booting and non-UEFI booting.

I wish I had known about UEFI installation before installing the first time. I think I will give it a try very soon. If it doesn't work I can always fall back to a non-UEFI image.

Thank you parsec. Have a great weekend.

P.S. It looks like there is a new UEFI update. I'll be keeping an eye out on how it is working for you all.

[parsec]

Re: ASRock Z87 Extreme6, Windows 8 Pro 64 bit and Secure Boot.

Thanks for your kind words. If you try it and have trouble, post in this thread again.

The new UEFI seems Ok, better in some ways. Haswell is so different in some ways, but its power usage at idle is lower than anything I've ever seen, at least at stock CPU clocks.

[balloonshark]

Re: ASRock Z87 Extreme6, Windows 8 Pro 64 bit and Secure Boot.

Well, that was interesting lol. I did manage to get the OS installed in UEFI mode but hit a ton of bumps along the way. Here's a tip. Plug your monitor into your onboard graphics port before you change the setting in the UEFI lol.

I've hit a snag. When I plugged in my 2nd HDD after the install the system won't boot. When I installed it originally it had 3 primary and 1 logical partition all formatted to NTFS. I'm going to do some searching on the subject but if you have a link that is helpful I would appreciate it. Please don't go out of your way explaining what needs to be done.

[parsec]

Re: ASRock Z87 Extreme6, Windows 8 Pro 64 bit and Secure Boot.

Well, that was interesting lol. I did manage to get the OS installed in UEFI mode but hit a ton of bumps along the way. Here's a tip. Plug your monitor into your onboard graphics port before you change the setting in the UEFI lol.

I thought I tol' you dat...

I've hit a snag. When I plugged in my 2nd HDD after the install the system won't boot. When I installed it originally it had 3 primary and 1 logical partition all formatted to NTFS. I'm going to do some searching on the subject but if you have a link that is helpful I would appreciate it. Please don't go out of your way explaining what needs to be done.

Sounds like that second HDD has a Windows MBR partition on it, the usual thing Windows does when more than one drive is on the PC during the installation, which happened during your previous Windows installation. So it gets confused.

If you can boot the PC with your old Windows install, if it exists now, you could try marking that partition as Inactive, which may not work. You can also try booting from your Windows installation disk, Repair option, and find the option to run the Command prompt. Then run diskpart, select that second HDD and try to remove that partition, assuming it is there. But IMO this is probably the cause.

Going to work, will be gone till this evening, good luck!

[balloonshark]

Re: ASRock Z87 Extreme6, Windows 8 Pro 64 bit and Secure Boot.

Thank you. I may need to install that HDD in my old computer to make a backup because I goofed and stored my latest pre-UEFI images on the last logical partition. I'll probably do that later so I also won't be on until later tonight. I'll just bump this thread to let you know the results.

Cheers

[�code]

Re: ASRock Z87 Extreme6, Windows 8 Pro 64 bit and Secure Boot.

Hi balloonshark, what are you expecting from secure boot exactly?

You may or may not find this thread interesting regarding your sapphire.

[balloonshark]

Re: ASRock Z87 Extreme6, Windows 8 Pro 64 bit and Secure Boot.

Hi balloonshark, what are you expecting from secure boot exactly?

You may or may not find this thread interesting regarding your sapphire.

Hi ucode. I was just wanting to take advantage of some of the built in security that UEFI and Windows provides. It will be my first machine where I run a standard user account and play with SRP and whatever else I can learn about.

Thanks for the link. I actually saw the link during a search but hex editors are a little bit over my head. I may get desperate in the future though.
__________________________________________________ _____________________________________

Since I had to install my 2nd HDD in my old computer I went ahead and installed a new power supply. I also copied my images from the 2nd HDD and deleted all of the partitions. This will be a data drive with hopefully 4 partitions 250GB each. One for programs, one for data, and the other two will be for backups and images. What format is UEFI and non-UEFI friendly? What type of volume should they be?

How much trouble am I going to have if I plug in my external eSATA drive? It worked fine before in non-UEFI mode.

Also, when I tried to boot into non-UEFI mode (CSM enabled) with my 7970 card it wouldn't work. I had to change the "Launch Storage OPRom Policy" to UEFI only. Does that sound right? Any side effects of going back and forth that I should know about?

[parsec]

Re: ASRock Z87 Extreme6, Windows 8 Pro 64 bit and Secure Boot.

Relax dude, if certain disk formats were necessary with UEFI booting, beyond the OS drive of course, I would have told you that. It would have been so not nice of me to not mention, BTW, all your drives must now be... whatever, but that is not the case. It sounds like your booting problem with that HDD has you worried now, but I explained that. Installing Windows with only the OS drive connected to the PC is standard procedure for people that know better, to keep Windows from pulling its stupid little trick, for security or whatever.

Besides the OS drive being formatted GPT, you can use the standard Windows formatting for storage drives. You can mix GPT and standard storage drive formatting on your PC, I've never had a problem with that. Same for an eSATA connection, external USB, etc.

Your problem with not booting when enabling CSM, did you have Secure Boot enabled at that time? Did you have Ultra Fast boot enabled? Either of those will cause the boot to fail with CSM enabled.

More to the point, needing the "Launch Storage OPRom Policy" to UEFI only, what SATA driver are you using, and what is your SATA mode set to? That is on the Intel chipset. Are you using the ASMedia SATA ports?

[balloonshark]

Re: ASRock Z87 Extreme6, Windows 8 Pro 64 bit and Secure Boot.

When I installed Windows in non-UEFI and UEFI the SSD was the only drive connected. After the first Win8 install I didn't connect the drive until after installing the LAN driver and updating Windows. I then let Windows do the fast/easy format/partition of the HDD. That is how I ended up with 3 primary and 1 logical partitions.

I've also read that Windows UEFI won't boot with a connected drive that has extended or logical partitions. Maybe that was the problem I had?

Your problem with not booting when enabling CSM, did you have Secure Boot enabled at that time? Did you have Ultra Fast boot enabled? Either of those will cause the boot to fail with CSM enabled.

No, I've been keeping everything basic for the time being.

More to the point, needing the "Launch Storage OPRom Policy" to UEFI only, what SATA driver are you using, and what is your SATA mode set to? That is on the Intel chipset. Are you using the ASMedia SATA ports?

The only driver I have installed so far is the LAN driver. I haven't installed it yet but the SATA driver that I will be using will be from the Extreme6 site. I haven't installed any drivers in the UEFI/firmware.

The only things connected to my MB are my graphics card (but using onboard IGPU for now), SSD, HDD, dvd writer. If I remember correctly the only settings I changed in Advanced - Storage Configuration was to set my SSD to SSD instead of HDD.

[parsec]

Re: ASRock Z87 Extreme6, Windows 8 Pro 64 bit and Secure Boot.

You need to install the chipset/INF files, INF driver ver:9.4.0.1017, and the Intel Management Engine software, Intel Management Engine driver ver:9.0.0.1287, or all your board's and CPU's features will not be working.

You're using the native Microsoft Win 8 AHCI driver, storahci now. Why that only works when you enable Launch Storage OPRom Policy to UEFI only, I'm not sure.

When you install the Intel Rapid Storage Technology driver and utility ver:12.6.0.1033, which is both an AHCI and RAID driver, you should not have that problem, although it really an issue at all setting that policy to boot in non-UEFI mode.

[balloonshark]

Re: ASRock Z87 Extreme6, Windows 8 Pro 64 bit and Secure Boot.

Thanks. I was wanting to make an image of Windows 8 activated before installing drivers so I can fall back to a fresh install as driver support improves. After I make that image I can go nuts installing drivers and then re-image before installing regular programs. I can't do that until I format and partition my 2nd HDD. I'm sorry if I wasn't clear with my intentions .

It's been a while since I learned about partition types so I'm a little rusty. Add on top of that the UEFI install and I just didn't want to reinstall Windows again and re-do my 2nd HDD. That was why I was asking advice on future proofing the 2nd HDD. I've also read topics like this which caused me to ask about partition types. Solved Cannot boot UEFI install

1. Can I go ahead and format my HDD before installing the drivers? If so what is the best way to do it? I was wanting 4 partitions but I go do with 3.

2. After formatting and partitioning my HDD (before driver installs) can I image it to the last HDD partition with Windows build in image program?