BIOS vs UEFI: Differences, MBR vs GPT and the A+ Settings

BIOS and UEFI are both firmware: the code that tests a PC's hardware and starts its operating system. UEFI (Unified Extensible Firmware Interface) replaced legacy BIOS, and Windows 11's minimum requirements call for it, even though setup screens and people still call it "the BIOS". For CompTIA A+, Core 1 (220-1201) objective 3.5 lists the BIOS/UEFI settings to know, and Core 2 (220-1202) objective 1.2 lists GPT and MBR partitioning.

BIOS vs UEFI at a glance

UEFI is a specification, not a product. The UEFI Forum maintains it (the current version is 2.11, from December 2024), and each board maker writes firmware that follows it. It grew out of Intel's EFI specification, which is why names like the EFI System Partition still say EFI.

How each one boots

• Legacy BIOS: after POST, the BIOS reads the first sector of the boot drive, the master boot record, and runs the boot code stored there. That code finds the partition marked active and starts its boot loader.
• UEFI: after POST, the firmware reads its boot order from settings stored on the motherboard. Each entry points to a boot loader file, such as Windows Boot Manager, on the EFI System Partition, a small partition formatted FAT32. A USB drive or disc doesn't need an entry of its own: the firmware looks for a standard fallback file, \EFI\BOOT\BOOTX64.EFI on a 64-bit PC.
• Secure Boot (UEFI only): before running each piece of boot software, including add-in card firmware and the boot loader, the firmware checks its digital signature against keys stored in the firmware. Anything not signed by a trusted key, or on the revoked list, doesn't run, which helps block bootkits, malware that replaces the boot loader so it loads before Windows.
• The boot mode and the disk must match: Windows boots from a GPT disk in UEFI mode and from an MBR disk in legacy BIOS mode. Start Windows Setup in UEFI mode on an MBR disk and Setup won't install to it and shows "The selected disk is not of the GPT partition style".

MBR vs GPT

MBR (master boot record) keeps the partition table in the disk's first sector and uses 32-bit sector addresses, so with standard 512-byte sectors it can address only 2 TB (about 2.2 TB in the decimal units on a drive's box). It holds 4 primary partitions; more need an extended partition holding logical drives.

GPT (GUID partition table) uses 64-bit sector addresses, so disk size stops being a limit, and Windows allows up to 128 partitions on it. GPT keeps a backup copy of its partition table at the end of the disk, and a protective MBR at the start so older disk tools see the disk as in use, not empty.

CSM and Legacy mode

Many UEFI boards include a Compatibility Support Module (CSM), which emulates a legacy BIOS so older operating systems can boot and add-in cards with only legacy firmware still work. Setup screens usually call it CSM or Legacy. Secure Boot only works with CSM turned off, and Intel stopped supporting legacy boot on client platforms launched from 2020, so newer Intel-based PCs may not offer CSM at all.

Changing the boot mode doesn't convert the disk. Switch a PC whose Windows is on a GPT disk to Legacy mode, or an MBR install to UEFI, and the firmware can't find a boot loader, so the PC reports that there's no boot device. "Bootable device not found" is one of the symptoms in Core 1 objective 5.2.

The BIOS/UEFI settings in A+ objective 3.5

Core 1 (220-1201) objective 3.5 lists eight BIOS/UEFI settings. What each one does:

• Boot options: the boot order (which drive, USB device or network boot to try first) and, on UEFI boards, the boot mode.
• USB permissions: turn USB ports or USB booting off, so nobody can boot a flash drive to get around Windows sign-in or copy data off the PC.
• TPM security features: turn on the Trusted Platform Module (TPM), a chip or firmware feature that stores encryption keys and boot measurements for BitLocker and Windows 11. A firmware TPM may be labelled Intel PTT or AMD fTPM.
• Fan considerations: fan speed profiles that trade noise for cooling, and warnings when a fan stops or slows.
• Secure Boot: let only signed, trusted boot software run. It needs UEFI mode with CSM turned off.
• Boot password: asked for before the PC will start an operating system. Some firmware calls it a power-on or user password.
• BIOS password: asked for before anyone can change firmware settings. It's also called a setup, administrator or supervisor password, and without it, anyone can turn USB booting back on or Secure Boot off.
• Temperature monitoring: CPU and system temperature readings, often with a warning or shutdown temperature you can set.

The same objective lists virtualization support and encryption (TPM and hardware security modules) after these settings, and Core 2 (220-1202) objective 2.7 lists BIOS/UEFI passwords as a way to harden a workstation.

Windows 11 needs UEFI

Windows 11's minimum requirements include UEFI firmware that's Secure Boot capable and TPM 2.0. Capable means the PC has to support Secure Boot; Microsoft recommends turning it on. Core 2 (220-1202) objective 1.3 lists TPM and UEFI as Windows hardware requirements. A PC still running Windows from an MBR disk in Legacy mode needs converting, below, before it meets them.

How to check which one a PC uses

• System Information: run msinfo32 and read BIOS Mode on the System Summary page. It shows UEFI or Legacy. Secure Boot State, a few lines down, shows whether Secure Boot is on.
• Partition style in PowerShell: Get-Disk lists each disk with its Partition Style, GPT or MBR.
• Partition style in diskpart: in an admin Command Prompt, run diskpart, then list disk. An asterisk in the Gpt column marks a GPT disk.
• Secure Boot in PowerShell: in an admin PowerShell window, Confirm-SecureBootUEFI returns True when Secure Boot is on and False when it's off. On a legacy BIOS PC it reports that the cmdlet isn't supported on this platform.

Converting from MBR to GPT

Windows includes MBR2GPT, which converts a system disk from MBR to GPT without deleting data. In an admin Command Prompt in Windows:

• Suspend BitLocker first. MBR2GPT converts a BitLocker disk only while protection is suspended. Afterwards, delete and recreate the BitLocker protectors to turn BitLocker back on.
• Check the disk: mbr2gpt /validate /allowFullOS runs the checks without changing anything. The disk needs three or fewer primary partitions and no extended partition.
• Convert it: mbr2gpt /convert /allowFullOS runs the same checks, then converts the disk and adds an EFI System Partition.
• Switch the firmware to UEFI before Windows starts again, or it won't boot. Then turn Secure Boot on.

The /allowFullOS switch is only for running MBR2GPT inside Windows; you don't need it in Windows PE. Diskpart's convert gpt command is no substitute, because it only works on an empty disk: you'd have to back up and delete every partition first.

What to know for the exam

For Core 1, know objective 3.5's eight settings, what each one protects, and that Secure Boot is a UEFI feature. For Core 2, know that objective 1.2 lists GPT and MBR under partitioning, that Windows needs GPT in UEFI mode, and MBR's 2 TB limit. The full lesson walks through the startup process from POST to the boot loader, and the BIOS/UEFI glossary entry has the short definition.

Then practise it: the free Harden the Workstation Firmware lab has you set a BIOS password, turn USB booting off and turn Secure Boot on, on a simulated workstation.