Advanced UEFI security features for Surface Pro 3

This article describes how to install and configure the v3.11.760.0 UEFI update to enable more security options for Surface Pro 3 devices.

To address more granular control over the security of Surface devices, the v3.11.760.0 UEFI update provides more security options that allow you to disable specific hardware devices or to prevent starting from those devices. After the UEFI update is installed on a device, you can configure it manually or automatically by running a script.

Manually install the UEFI update

Before you can configure the advanced security features of your Surface device, you must first install the v3.11.760.0 UEFI update. This update is installed automatically if you receive your updates from Windows Update. For more information about how to configure Windows to update automatically by using Windows Update, see How to configure and use Automatic Updates in Windows.

To update the UEFI on Surface Pro 3, you can download and install the Surface UEFI updates as part of the Surface Pro 3 Firmware and Driver Pack. These firmware and driver packs are available from the Surface Pro 3 page on the Microsoft Download Center. You can find out more about the firmware and driver packs at Download drivers and firmware for Surface. The firmware and driver packs are available in two formats: self-contained Windows Installer (.msi) and archive (.zip). You can find out more about these two formats and how you can use them to update your drivers at Manage and deploy Surface driver and firmware updates.

Manually configure other security settings

After the v3.11.760.0 UEFI update is installed on a Surface device, another UEFI menu named Advanced Device Security becomes available. If you select this menu, the following options are displayed:

Automate more security settings

As an IT professional with administrative privileges, you can automate the configuration of UEFI settings by using Surface Pro 3 Firmware Tools (476 KB) available from the Microsoft Download Center. These tools install a .NET assembly that can be called from any custom application or script.

Prerequisites

• The sample scripts on this page apply the previously mentioned extension and therefore assume that the tool is installed on the device being managed.
• The scripts must be run with administrative privileges.
• The Windows PowerShell command Set-ExecutionPolicy Unrestricted must be called before running sample scripts if they aren't digitally signed.

Sample scripts

Show all configurable options:

# Load the extension 
[System.Reflection.Assembly]::Load("SurfaceUefiManager, Version=1.0.5483.22783, Culture=neutral, PublicKeyToken=20606f4b5276c705")  
 
# Get the collection of all configurable settings 
$uefiOptions = [Microsoft.Surface.FirmwareOption]::All() 
 
foreach ($uefiOption in $uefiOptions) 
{ 
    Write-Host "Name:" $uefiOption.Name 
    Write-Host " Description =" $uefiOption.Description 
    Write-Host " Current Value =" $uefiOption.CurrentValue 
    Write-Host " Default Value =" $uefiOption.DefaultValue 
    Write-Host " Proposed Value =" $uefiOption.ProposedValue 
     
    # This gives usage and validation information 
    Write-Host " Allowed Values =" $uefiOption.FriendlyRegEx 
    Write-Host " Regular Expression =" $uefiOption.RegEx 
     
    Write-Host 
}

Set or change UEFI password:

# Load the extension 
[System.Reflection.Assembly]::Load("SurfaceUefiManager, Version=1.0.5483.22783, Culture=neutral, PublicKeyToken=20606f4b5276c705")  
 
# Must supply UEFI administrator Password if set 
# If it is not currently set this is ignored 
[Microsoft.Surface.FirmwareOption]::Unlock("1234") 
 
$Password = [Microsoft.Surface.FirmwareOption]::Find("Password") 
 
# Set New value to 12345 
$Password.ProposedValue = "12345"

Check status of proposed changes:

# Load the extension 
[System.Reflection.Assembly]::Load("SurfaceUefiManager, Version=1.0.5483.22783, Culture=neutral, PublicKeyToken=20606f4b5276c705")  
 
# Check update status 
$updateStatus = [Microsoft.Surface.FirmwareOption]::UpdateStatus 
$updateIteration = [Microsoft.Surface.FirmwareOption]::UpdateIteration 
Write-Host "Last Update Status =" $updateStatus 
Write-Host "Last Update Iteration =" $updateIteration 
 
# Get the individual results for the last proposed update 
# If the device has never had an update attempt this will be an empty list 
$details = [Microsoft.Surface.FirmwareOption]::UpdateStatusDetails 
Write-Host $details.Count "Settings were proposed" 
if ($details.Count -gt 0) 
{ 
    Write-Host "Result Details" 
    foreach ($detail in $details.GetEnumerator()) 
    { 
        Write-Host " " $detail.Key "=" $detail.Value 
    } 
}

Revert UEFI to default values:

# Load the extension 
[System.Reflection.Assembly]::Load("SurfaceUefiManager, Version=1.0.5483.22783, Culture=neutral, PublicKeyToken=20606f4b5276c705")  
 
# Must supply UEFI administrator Password if set 
# If it is not currently set this is ignored 
[Microsoft.Surface.FirmwareOption]::Unlock("1234") 
 
# Get the collection of all configurable settings 
$uefiOptions = [Microsoft.Surface.FirmwareOption]::All() 
 
# Reset all options to the factory default 
foreach ($uefiOption in $uefiOptions) 
{ 
    $uefiOption.ProposedValue = $uefiOption.DefaultValue 
}

Status code interpretation

The following status codes help interpret the results of UEFI configuration changes:

• 00 - The proposed update was a success
• 02 - One of the proposed values had an invalid value
• 03 - There was a proposed value set that wasn't recognized
• 0F - The unlock password didn't match currently set password