Boot Device List

Hey Folks,

I have been trying to figure out a way to prevent people from booting off of CDs, USB devices, etc. [For reasons which should be pretty obvious :D] The machine I am currently working with is a Dell Optiplex. I have gone into the BIOS, and disabled all items in the boot sequence, except for the SATA HDD, and set the administrator password [to prevent changes in Setup]. Even with this set, you can still tap F12, which brings up a list of devices, and choose which one to boot from. I inserted a linux live cd, and was able to boot from it with no problems.

Does anyone know of a way to prevent users from accessing the boot device listing? I have been searching around, but have not found anything yet. I will edit this post if I find the answer before anyone responds.

Thanks in advance.

Edit:

The closest thing I have found so far, is to turn off the message that says 'Press F12 for boot device list'. Though if you already know which key to press, or mash enough keys, you can still get to it...

Hi westin,

Obviously this is a BIOS issue, and may well be peculiar to Dell. My wife has a Dimension 8100 which also has the F12 option (F2 = setup, F12 = boot selection menu). I have mentioned in other posts that OEMs tend to have their own versions of BIOS which are presumably designed to minimise and simplify their support activity.

I guess that this is an easy way to get into the recovery partition/CD:rolleyes:

I have just booted up one of my home-built boxes, and this option is not there and F12 does nothing.

I am wondering if this has something to do with the fact that Dells ship with the ESXi hypervisor virtualisation product ("and not many people know that" :lildevil:)

You might try this:

:xbones:REMOVE ALL EXTERNAL USB STORAGE DEVICES:xbones:

THEN:-

1. Boot to setup (F2)
2. Go to "Integrated Devices"
3. Select SD Card or Internal USB Port (depends on your model)
4. Toggle to "disabled"
5. Reboot

If that works, please blame MsMittens :bigpimp:

Quote:

---

Originally Posted by nihil

I have just booted up one of my home-built boxes, and this option is not there and F12 does nothing.

---

Try F10 or F11. A lot of BIOS manufacturers have this option.

Quote:

---

Try F10 or F11. A lot of BIOS manufacturers have this option.

---

No, no response with those either. It is a home built box with a Gigabyte MoBo and a P4 2.26GHz single core, booting XP Pro, which I guess makes it about 6 or 7 years old.The BIOS is Award 6.0 PG, dated 17 May 2002. My wife's is a Dell, which is a couple of years older and has the F12 functionality.

I seem to recall that if this function is there, you also have an option in the BIOS to "Disable boot menu on startup" or something along those lines?

AS westin specifically mentioned Dell, it made me think of the ESXi recovery mechanism that uses onboard SD Flash or USB memory.

Quote:

---

Originally Posted by nihil

I seem to recall that if this function is there, you also have an option in the BIOS to "Disable boot menu on startup" or something along those lines?

---

Yeah, something like that. I've also seen "Alternative boot options".

Thanks for the response nihil. I will give that a shot. I just don't want the kiddos in the school here booting BackTrack, Knoppix STD, OWASP, etc... :eek:

I have noticed the boot menu on IBM/Lenovo machines as well. I am sure that several other manufacturers have something similar.

Thanks again for the help, I will let you know what happens.

Update:

I didn't see either SD Card or Internal USB. It did have 'USB Controller'. I switched that setting to 'No Boot'. This option appears to disable booting from USB devices, but will still allow booting from CD. Getting closer. :)

disable a IDE port or remove power\cable from cd-device.

Quote:

---

Originally Posted by Linen0ise

disable a IDE port or remove power\cable from cd-device.

---

That would be ideal, but unfortunately some of the classes have instructional CDs/DVDs that they watch.

I appreciate the suggestion though... :)

Quote:

---

Originally Posted by westin

That would be ideal, but unfortunately some of the classes have instructional CDs/DVDs that they watch.

I appreciate the suggestion though... :)

---

lol.... Disable the devices and put those cd's on a local server with a desktop shortcut. Otherwise you have a no-win situation. They still have access to the primary partition including everyone's documents and settings. A hacker just needs to take a snapshot of the original partition before creating their personal partition; restoring the magic numbers will pwn you everytime.

Quote:

---

Originally Posted by Linen0ise

lol.... Disable the devices and put those cd's on a local server with a desktop shortcut. Otherwise you have a no-win situation. They still have access to the primary partition including everyone's documents and settings. A hacker just needs to take a snapshot of the original partition before creating their personal partition; restoring the magic numbers will pwn you everytime.

---

Thanks again for the suggestions

I may give that a try. It will be painful, as some of the classes [credit recovery for example] have 30-45 cds that they use throughout the year. And the business classes like to burn their projects to CD... but we can probably work around that... though if anyone has any suggestions that would be easier to implement, I am all ears. :)

Hmmmm,

What BIOS version is your Dell running? I don't seem to have any problems with the wife's machine.

I turn off the CD in the boot options.......set the PXE BIS Default Policy to off.

Then when I use the F12 option and select CD, I get a Device Not Found message.

It offers an option to retry which continuously produces the same message and an F2 option to reset the BIOS. I guess if you password protect the BIOS setting then that isn't an issue?

Maybe there are hidden menu screens in the BIOS, like my bios. While on the first screen, press F1 or ctrl-F1 or alt-F1. Maybe some of those rigs need a bios update. On one project, we had stacks of Dell optiplex's that didn't network boot to our automated image server. After update, they were all able to coldboot and become zombies.

BIOS Revision A03

The only boot device I have enabled is the SATA HDD. I was still able to boot off of a clonezilla cd through the boot device menu. Strange?

edit: Just saw Linen0ise's post... will try that. :)

edit x2: Didn't find any hidden menus :(

Hi westin,

Please look for a BIOS revision on the Dell site. This machine has A09, although it is a different model.