Photo of Surface Laptop UEFI Interface

By Evan Forrest (SurfaceTip)

UEFI or Unified Extensible Firmware Interface is a new motherboard firmware standard that allows your PC to boot faster and has more security features. Starting with Surface Pro 4, Microsoft has developed its own UEFI firmware for use with its future devices. This new Surface UEFI is currently used on newer devices, including Surface Go, Surface Pro, Surface Laptop, Surface Book, Surface Laptop Studio, and Surface Studio.

In this article, you will learn how to enter the Surface Laptop UEFI settings. You will also learn how to configure the UEFI settings to improve the device security, check your device information, and more.

Table of Contents

  1. How do you access Surface Laptop UEFI settings?
  2. How do you check your Surface Laptop Device Information via UEFI Settings?
  3. Configuring device boot order
  4. Managing device components
  5. Changing system date and time
  6. How to protect UEFI settings with a password
  7. What is Secure Boot Control?
  8. What is the Trusted Platform Module (TPM)?
  9. Other Surface UEFI Settings

How do you access Surface Laptop UEFI settings?

You can only enter the Surface Laptop UEFI setup screen while your device starts. Here is how you do that:

  1. Shut down your Surface Laptop.
  2. Press and hold the Volume Up (F4) key on your Surface, then press and release the Power Key next to the Del key.
  3. When you see the Surface logo appear, release the Volume Up button. The Surface UEFI screen will appear in a few seconds.How to Enter Surface Laptop 3/4 UEFI/BIOS Settings

After you have made any changes to the UEFI settings, you can restart your Surface by:

  • In the Surface UEFI menu, choose Exit, and click on Restart Now
    Surface Laptop 3 UEFI - Exit

How do you check your Surface Laptop Device Information via UEFI Settings?

When you enter UEFI settings, the PC information page is the first page you see. This page provides important details about your device, including its Model, System UUID (Universally Unique Identifier), Serial Number, and Asset Tag. Additionally, it displays other critical system information and component versions that can be useful for troubleshooting.

Surface Laptop 3 UEFI - PC Information

See also: How to manage asset tag on Surface Laptop.

Configuring device boot order

To change the alternate system boot order on your Surface Laptop :

  1. Enter Surface UEFI settings as per the instructions above.
  2. In the Surface UEFI menu, go to the Boot Configuration page as below:Surface Laptop 3 UEFI - Boot Configuration

On the “Configure boot device order” page, you can:

  • Rearrange the boot order by dragging and dropping any available boot option.
  • Turn any boot option on or off by using the checkbox
  • Remove available boot options permanently by using the trash button.
Note If you accidentally delete Windows Boot Manager from your Master Boot Record, restart your Surface, and Windows Boot Manager will reinstall it automatically.

Managing device components

Surface Laptop lets you deactivate some of your surface device components and features to meet your security requirements. You can turn those components on or off by:

  1. Access Surface UEFI settings as per the instructions above.
  2. In the Surface UEFI menu, go to Devices, and you will see the following options:Surface Laptop 3 UEFI - Devices
  3. In my Surface Laptop 3 with System UEFI version 6.22.140, you can choose to turn on or off the following device’s components or ports:
    1. Docking USB Port
    2. All Cameras (Front Camera and IR Camera)
    3. On-board Audio
    4. Wi-Fi & Bluetooth
    5. Bluetooth

Changing system date and time

The new Surface UEFI lets you set your Surface Laptop’s date and time on the UEFI settings page. To check or set a date and time for your Surface Laptop:

  1. Enter Surface UEFI settings as per the instructions above.
  2. In the Surface UEFI menu, go to the Date and Time page as below:Surface Laptop 3 UEFI - Date and Time
  3. To set a new date and time, select the edit box and type your new date and time.
  4. Press Enter to apply changes.

How to protect UEFI settings with a password

You can prevent others from changing your UEFI settings by setting an Administrator Password in UEFI settings. To do that:

  1. Enter Surface UEFI settings as per the instructions above.
  2. Go to the Security section below:
    Surface Laptop 3 UEFI - Security 01
  3. To set the UEFI password, click on the Add or Change button, and you will see the following requirements:Surface Laptop 3 UEFI - Security 02
  • You will need to enter a password in the box with your keyboard or the on-screen keyboard with the following criteria:
    • Minimum Length: 6 characters
    • Maximum Length: 128 characters
    • It may contain a combination of letters, numbers, and special characters.
  • If you have set the password before and want to remove it, leave the password box blank.
Note If you enter the administrator password incorrectly three times, you’ll be locked out of the UEFI. Restart your Surface to enter the password again.

Important If you set a password for the UEFI, record it in a safe place. If you forget the password, you won’t be able to access the UEFI settings. You can only reset the administrator password from within the UEFI.

What is Secure Boot Control?

Surface Laptop 3 UEFI - Security 03

The Secure Boot is a technology that blocks the loading of uncertified bootloaders and drives. It helps to prevent your Surface from being loaded with unauthorized operating systems and malicious software applications.

Surface Laptop 3 UEFI - Security 04

If you desire to install other operating systems like Ubuntu or other Linux distributions, you may need to turn off this feature in the UEFI settings above.

What is the Trusted Platform Module (TPM)?

Surface Laptop 3 UEFI - Security 05

The Trusted Platform Module (TPM) technology significantly advances BIOS in hardware-based security features. It is a specialized chip that stores RSA encryption keys specific to each Surface device for hardware authentication.

TPM technology is a requirement of BitLocker disk encryption. The TPM helps you encrypt/decrypt the entire disk without requiring complex long passphrases. It means the encryption and decryption keys are stored within the TPM chip. So, your encrypted disks can’t be accessed on other devices.

Other Surface UEFI Settings

We have also covered this topic for other Surface PCs as well. To learn more about other Surface UEFI settings, check the link below: