@barlop CSM is basically the legacy BIOS compatibility module on UEFI systems. Generally, unless you actually need legacy BIOS support, you should always set up a new system with the CSM disabled so that it's actually booting in UEFI mode. Secure Boot is up to you; I normally prefer to keep it on unless I actually need to turn it off because it helps guard against certain types of malware that try to tamper with the boot process.

@barlop Windows 10 does not require Secure Boot to function. It's just that Microsoft requires OEMs to ship systems with it enabled. Unless your system is encrypted with BitLocker or device encryption, you can usually disable it without breaking anything. Again, I prefer keeping it on, but you should be able to install Windows from a flash drive (whether supplied with a retail copy of Windows or created with the media creation tool) with CSM disabled and Secure Boot enabled.

@bwDraco so is @gparyani wrong when he says "Secure Boot, which is now required for Windows logo certification," ?

Note that BitLocker/device encryption doesn't actually require Secure Boot per se, but because it normally uses the TPM to detect low-level system changes, changes to the Secure Boot setting will trigger BitLocker recovery.

(The TPM basically checks the firmware and bootloader to determine if there's low-level tampering that could compromise the boot process, e.g. by advanced UEFI-based malware or a bootloader rootkit, but this also means that some UEFI settings or hardware changes could result in the system requiring a BitLocker recovery key to start up.)

@barlop That's only something that PC manufacturers need to worry about. If you're building your own PC, it's not an issue (but do be aware that Secure Boot provides an additional layer of security).

I think that's a yes then. He's wrong when he said that!

what the default setting for secure boot is on pre-built systems isn't really relevant.

I notice the pre-built system i'm looking at is actually booting Windows 10 in Legacy mode

but maybe it's booting the DVD in EFI mode!

The way I set up my systems, I try not to disable Secure Boot or enable the CSM unless it's absolutely necessary. My laptops are encrypted with BitLocker, and I like having the extra layer of security there.

My desktop isn't encrypted, but I have Secure Boot enabled and even installed a TPM onto the motherboard for enhanced security with Windows Hello. (Yes, some motherboards do have TPM headers to allow the installation of an optional TPM add-in card. I added this when I got a fingerprint reader for my desktop.)

(Astaroth is my desktop.)

I'm used to not entering a password to sign into my PC.

(The TPM I ended up getting came with up-to-date firmware.)

@barlop Wat. Are you sure the system came out of the box this way?

no

@barlop Again, you do not want to be booting in legacy BIOS mode. For starters, most NVMe SSDs do not work in legacy BIOS mode (a few do have BIOS option ROMs but they're rare). Second, drives larger than 2 TB will not work properly on a legacy BIOS system or at the very least will not be bootable with their full capacity (because GPT support is required to use more than 2 TB).

well i'm not too worried about booting in one mode or the other 'cos if I can do that I can always choose how I boot!

You should always avoid having to use the CSM if you can help it.

well, at the moment i'm just trying to see what's up with the system.

for tinkering purposes.

If you boot EFI(csm disabled), will windows see both MBR partitions and GPT partitions?

It will.

ah correction.. MBR or GPT is just a partition scheme / type for partition table.. So there isn't really such a thing as an MBR partition or GPT partition

i've heard that officially Windows requires GPT for UEFI, and MBR for BIOS, but from what you're saying, GPT isn't a requirement when booting UEFI.

Note that UEFI firmware should be able to boot from either a GPT or an MBR drive. It just needs to have an EFI System Partition containing the boot files (and yes, you can create an ESP on an MBR drive).

That said, Windows can access both types of drives regardless of your boot mode. Booting from a GPT drive, or from an MBR drive not configured with a legacy BIOS bootloader (only an ESP), requires UEFI. Regardless, there's generally no reason to not use GPT for a boot drive on a UEFI system.

Again, it's not technically impossible to boot from a properly-configured MBR drive on a UEFI system. It's just that Windows doesn't support it.

(the partition ID for an ESP on an MBR partition table is 0xEF)

@barlop UEFI firmware is required to support booting from both types of partition tables. It's Windows that doesn't support booting from MBR drives on UEFI firmware.

The drive will read once you've booted into Windows.

ok, thanks

docs.microsoft.com/en-us/troubleshoot/windows-server/…

@barlop If you still need help, let me know. I'm back in here

Thanks.. I think i'm ok re that.. I found that it was starting the Win10 DVD install in EFI mode, and windows 10 in legacy mode!

If you want to setup your system to boot in EFI mode (what I recommend), you would either need to wipe your disk, or install a second disk.

I'm glad you have it going though

Or convert MBR to GPT, which apparently diskpart can do (though I understand that's not reversible)

Yes, and Windows likely won't boot after that. You'd have to do a reinstall

Shameless promotion of poorly thought-out question: superuser.com/questions/1586120/…