No boot after PBA loading, and solution

[ChubbyAnt]

On an Lenovo ThinkBook Intel 1165G7 UEFI bios with no CMS BIOS option available with a Samsung 970 EVO Plus NVME drive running Windows 10, I ran into a problem where after loading the PBA, on boot the boot cycle froze. It would not load to BIOS, and would not load any device. The only solution was to remove the NVME drive, remove encryption via SEDutil command line sedutil.exe via USB, and try again.

The solution was to create a new boot entry pointing to the SEDutil shadow MBR BEFORE enabling encryption, then setting up the SEDutil PBA as usual. The UEFI BIOS records this boot entry even though it does not yet exist.

Here is the solution:

BACK UP ALL DATA FIRST - THIS COULD DESTROY YOUR DATA

(1) From an admin command prompt: bcdedit /enum firmware
(2) bcdedit /copy {bootmgr} /d "UEFI Shell"
(3) bcdedit /set {COPIED_ID} path EFI\boot\bootx64.efi
(4) verify the new entry on the boot list: bcdedit /enum firmware
(5) Setup the SEDutil preboot PBA as usual

Hopefully this helps.

On the ThinkBook in the BIOS, Secure Boot and Self Healing BIOS settings had to be disabled.