How to Configure Surface 3 UEFI/BIOS Settings

Every Surface 3 and Surface Pro model doesn’t use BIOS (Basic Input/Output System) as you expected on older PCs. It’s replaced by a firmware interface called the Unified Extensible Firmware Interface (UEFI). This new firmware interface allows your Surface to boot faster and provides better security.

In this article, we will walk you through how to get to the Surface 3 UEFI settings. You will see also how to configure the UEFI settings to check device identity information, improve the device security, and more.

1. How to access Surface 3 UEFI settings?
2. What is Trusted Platform Module (TPM)?
3. What is Secure Boot Control?
4. How to Check Your Surface 3 Device Information via UEFI settings?
5. How to Change System Boot Order on Surface 3?
6. How to Manage Device Security on Surface 3 UEFI Settings?
7. How to Protect UEFI settings with a password on Surface 3?
8. Other Surface UEFI Settings

1 How to access Surface 3 UEFI settings?

You can enter the Surface 3 UEFI setup screen only while your Surface is starting up. Here is how you do that:

1. Shut down your Surface.
2. Press and hold the Volume Up button on your Surface, then press and release the Power button.
3. When you see the Surface logo screen appear, release the Volume Up button. The UEFI settings menu will appear in a few seconds.
   

After you have made any changes to the UEFI settings, you can save or delete those changes by:

Save Configuration and Restart Your Surface

• In the UEFI settings menu, choose Exit Setup, and you will see the following screen:
  
• Now you have 2 options:
  • Yes – Save your changes and restart your Surface.
  • No – turn back to the UEFI settings.

Restart Your Surface without Saving Your Configuration

• In the UEFI settings menu, press the ESC key as in the picture below or press the ESC key if you have a Surface Type Cover connected.
  
• Now you have 2 options:
  • Yes – Delete your changes and restart your Surface.
  • No – turn back to the UEFI settings.

2 What is Trusted Platform Module (TPM)?

The Trusted Platform Module (TPM) is a technology that provides a major advancement over BIOS in hardware-based security features. It is a specialized chip that stores RSA encryption keys specific to each Surface device for hardware authentication.

The TPM technology is a requirement of BitLocker disk encryption. The TPM helps you to encrypt/decrypt the entire disk without requiring your complex long passphrases. It means that the encryption key and decryption key are stored within the TPM chip. So your encrypted disks can’t be accessed on other devices.

3 What is Secure Boot Control?

The Secure Boot is a technology that blocks the loading of uncertified bootloaders and drives. It helps to prevent your Surface from being loaded with unauthorized operating systems and malicious software applications.

If you desire to install other operating systems like Ubuntu, or other Linux distributions, you may need to disable this feature in the UEFI settings above.

4 How to Check Your Surface 3 Device Information via UEFI settings?

Through UEFI settings, you can find out more information about your device identities such as System UUID, Serial Number, and Asset Tag. To check that information:

• Enter Surface UEFI settings as per the instructions above.
• In the UEFI settings menu, choose Device Information and you will see the following information:

See also: How to manage asset tag on Surface 3.

5 How to Change System Boot Order on Surface 3?

To change the alternate system boot order on your Surface 3:

• Enter Surface UEFI settings as per the instructions above.
• In the UEFI settings menu, you will see Configure Alternate System Boot Order as below:

• Select the option and choose one of the following options:
  • SSD only
  • Network -> USB -> SSD

6 How to Manage Device Security on Surface 3 UEFI Settings?

Surface 3 allows you to disable some of your surface device components and features to meet your specific Security requirements. You can enable or disable those security options by:

• Enter Surface UEFI settings as per the instructions above.
• In the UEFI settings menu, choose Advanced Device Security and you will see the following options:
  
• In my Surface 3 with UEFI Version 2.17.1246, there are the following advanced security options:
  • Side USB – enable/disable the ability to boot from a USB device. However, the side USB port remains enabled in Windows.
  • Front Camera – enable/disable the front-facing camera.
  • Rear Camera – enable/disable the main rear camera.
  • On-Board Audio – enable/disable internal audio or speakers.
  • SD Port – enable/disable the microSD port.
  • WiFi – enable/disable Wi-Fi. It will also disable Bluetooth if you disable the WiFi option.
  • Bluetooth – enable/disable the internal Bluetooth.

7 How to Protect UEFI settings with a password on Surface 3?

You can prevent others from changing your UEFI settings by setting an Administrator Password in UEFI settings. To do that:

• Enter Surface UEFI settings as per the instructions above.
• In the UEFI settings menu, choose Administrator Pass and you will see the following requirements:
  
• You will need to enter a password in the box with your keyboard or the on-screen keyboard with the following criteria:
  • Minimum Length: 4 characters
  • Maximum Length: 20 characters
  • Alphanumeric values only

Other Surface UEFI Settings

We have also covered this topic for other Surface PCs as well, to learn more about other Surface’s UEFI settings check the link below:

• Surface Go UEFI Settings
• Surface 3 UEFI Settings
• Surface Pro 3 UEFI Settings
• Surface Pro 4 UEFI Settings
• Surface Pro (2017) UEFI Settings
• Surface Book UEFI Settings