Desktop BIOS configuration

Table of Contents

1. Entering the startup device menu

Enjoy the Lenovo logo when powering on your new desktop for the first time...

Tip:
Click on the screenshots to see them in full size.

Press F12 to interrupt the normal startup procedure.

The startup device menu has no timeout and will allow you to choose the boot option.

Press ↓ until you reach Enter Setup.

2. Entering the BIOS

At the startup device menu press Enter to enter the BIOS.

Conditional:
Depending on the factory defaults of your desktop you may be asked for the BIOS password.

Usually the default BIOS password is 123456.

In rare cases the password is set to 0000 or 000000.

Optional:
Use the Show Password toggle to verify that you've correctly typed in the password.

If you've done everything correctly so far, the BIOS is loading after clicking Yes...

3. Loading BIOS default settings

Once the BIOS is loading the Main screen of the BIOS shows various system information.

Press ↓ until you reach Exit.

Press → to enter the Exit configuration.

Press ↓ until you reach Load Setup Defaults and press Enter to select it.

Press Enter again to confirm loading setup defaults.

Rational:
Loading the default options will revert (almost) all options to a know good state.
Subsequently only a few changes need to be done and are documented below.

Press ← to return to the Start Menu.

Press ↑ until you reach Devices.

4. Configuring device items

Press → to enter Devices configuration.

Press ↓ until you reach Audio Setup.

Press Enter to enter the Audio Setup submenu.

Press ↓ until you reach Internal Speaker.

Press Enter to configure.

Press ↓ to select Disabled.

Press Enter to confirm disabling.

Rational:
In noise sensitive environments such as offices we recommend to disable the internal speaker and use headphones instead.

Press Esc to return to the Devices configuration.

Press ← to return to the Start Menu.

Press ↓ until you reach Advanced.

5. Configuring advanced items

Press → to enter Advanced configuration.

Press ↓ until you reach Intel Software Guard Extension.

Press Enter to enter Intel Software Guard Extension submenu.

Press Enter to configure.

Press ↑ to select Disabled.

Press Enter to confirm disabling.

Rational:
Intel SGX allows to define private regions of memory. Unfortunately it has several security issues and is better replaced by Linux kernel internal functions.

Press Esc to return to the Advanced configuration.

Press ← to return to the Start Menu.

Press ↓ until you reach Power.

6. Configuring power items

Press → to enter Power configuration.

Press ↓ until you reach Automatic Power On.

Press Enter to enter Automatic Power On submenu.

Press Enter to configure.

Press ↑ to select Primary.

Press Enter to confirm your choice.

Rational:
Enabling Wake-on-LAN only on the primary (onboard) interface for our WOL-aaS.

Press Esc to return to the Power configuration.

Press ← to return to the Startup Menu.

Press ↓ until you reach Security.

7. Configuring security items

Press → to enter Security configuration.

Press Enter to configure Set Supervisor Password.

Conditional:
If you have been asked for the BIOS password before, re-enter it here.

Usually the default BIOS password is 123456.

In rare cases the password is set to 0000 or 000000.

Press Yes to continue.

Press Enter to not enter a new password.

Press Enter again to confirm not entering a new password.

Press Yes to confirm your choice.

Rational:
Setting a BIOS password does not increase system security but makes using the system inconvenient. Therefore we recommend to disable it.

Press Enter to acknowledge disabling the password.

Press ↓ until you reach Secure Boot.

Press Enter to enter Secure Boot submenu.

Press Enter to configure.

Press ↓ to select Disabled.

Press Enter to confirm disabling.

Rational:
Secure Boot defacto requires bootloader signatures from Microsoft and does not increase security.

Press Esc to return to the Security configuration.

Press ↓ until you reach Computrace.