I am sure that a question like this already exists and has probably been answered. I just couldn't find any results (probably due to my inability to word my question correctly).

We use laptops at work which require a hardware key (a USB) to boot the computer along with a username/password. It then boots to Windows and a different USB/Username/Password combination is required.

I am already aware on how to implement the second security feature (the windows login requiring USB as well) but can't find any information on implementing a USB requirement to pass through the boot-up process. It's very similar to having a BIOS password, though requires a USB/Username/Password combination and therefore more secure as requiring a physical token.

I am trying to implement this to provide higher than usual BIOS level security. I don't want the machine to be able to be used WITHOUT the physical access token and am not concerned with HDD security (i.e, the OS itself) as I have already implemented significant security onto that already.

i.e if somebody connects an external HDD and tries to boot onto that instead of the build in HDD (which has OS-level security), I want them to require a physical token to do so along with a username and password

The startup process should therefore go like this:

    1. Power on
    2. Insert USB (this is my issue)
    3. Enter Username/Password
    4. Boot to Windows
    5. Insert seperate USB
    6. Enter Windows username/password
    7. Login
  • I have never heard of anything like what you describe. It's theoretically possible with UEFI (especially if you have a TPM to store the public key for the dongle) but I'm not aware of any such system. The system that you describe your employer using simply sounds like BitLocker, which is of course disk encryption.
    – CBHacking
    Jun 22, 2019 at 21:32
  • Can you not simply ask at work how they enabled this? I see little reason for them not to tell you (unless it only offers an illusion of security that could be bypassed if you knew how it worked).
    – TripeHound
    Jun 24, 2019 at 10:03
  • @TripeHound I don't have contact with the people that setup the systems we use. And I was just curious on how it all works behind the scenes so wanted to try setting it up on my own personal laptop.
    – RM101
    Jul 14, 2019 at 14:00

1 Answer 1


There are several FDE (Full-Disk-Encryption) solutions that implement a pre-boot authentication (PBE) layer. I personally only have experience with Sophos SafeGuard Easy. They are used mainly in security aware environments like military or public security.

The replace the standard boot-loader whichs provided by Windows or Linux with their own bootloader. After sucessful authentication the PBA decrypts the volumes and starts the normal bootloader.

There are several authentication methods possible, either with a smart card, a username/password combination or a YubiKey. In the Sophos SGE solution a sync with all domain accounts on the machine is done and you can authenticate with your domain password.

In the YubiKey solution a USB-Stick is used. YubiKey with FDE

The same or another yubikey can then be used for the Windows-Logon with One-Time-Passwords.

For your process a look at the mentioned EgoSecure Solution on the Link provided may be useful.

For preventing boot from an external hard drive, the standard solution would be deactivating boot from USB in the BIOS Settings.

  • Thank you. The link you provided is a very similar system to what we have implemented (although we have more stuff on top of that as well), and replacing the bootloader makes a lot of sense. I work in the military, which is where I've found this. Thanks again, this answered my question.
    – RM101
    Jul 14, 2019 at 13:59
  • I used to work there too, that's why i knew SGE. 😉 please accept the answer then so it gets the green marker. Thank you for your service. Jul 14, 2019 at 16:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .