Table of Contents

Introduction

Sometimes I hear people saying “Virtualization removes the need for dual booting”, however I still like to run my Operating Systems on bare metal. Whether it is for pleasure, performance or security reasons knowing how to properly set up a dual boot system is a valuable skill even in 2024.

In this article we will explore how to install Linux Fedora 40 in dual boot with Windows starting from a brand new EFI laptop with Microsoft Windows 11 already installed and Secure Boot active.

To be fair the performance penalty of a virtualized system is greatly reduced after the introduction of the Hardware-assisted virtualization technologies (Intel’s VT-x and AMD’s AMD-V) [1], however the other two reasons to have a dual-boot system are still valid.

Note also that it is not mandatory to have Secure Boot enabled, but the choice we made with this guide is to support the widest range of users. It also adds another challenge to our quest and makes it more fun.

Step 1: Running Fedora 40 (Live CD)

Download your favorite flavor of Fedora 40 [2] and copy the ISO image on a USB Drive (check this article if you don’t know how to do it).

We have our laptop switched off, our USB key is inserted and we are ready for the most difficult task: find out the correct key to press to boot from USB. It depends on the manufacturer and the configuration of your EFI firmware, so multiple options are possible. My steps are:

  • From Windows turn off “Fast Startup”
  • Insert the USB Stick with Fedora and reboot
  • press furiously F12 on the keyboard to access the EFI Boot Manager and select the USB Drive
  • or, alternatively, press furiously F2 to access the EFI Menu and change the order of the Boot Devices

Step 2: Partitioning

It’s time to make space for Fedora on the Hard Drive. Open GParted and resize the biggest partition (WARNING: if you are not an expert backup your data before proceeding, keep your laptop attached to the charger and be aware this is a very risky operation).

Create a new partition on the free space and take note of the new partition’s name. In my case I have resized /dev/nvme0n1p3 and created /dev/nvme0n1p6. My partition table looks like this:

/dev/nvme0n1p1      2048    206847    204800   100M EFI System
/dev/nvme0n1p2    206848    239615     32768    16M Microsoft reserved
/dev/nvme0n1p3    239616 216623103 216383488 103.2G Microsoft basic data
/dev/nvme0n1p4 498819072 500115455   1296384   633M Windows recovery environment
/dev/nvme0n1p5 216623104 237594623  20971520    10G Microsoft basic data
/dev/nvme0n1p6 237594624 342452223 104857600    50G Linux filesystem

Step 3: Installation in a chroot environment

Connect to the internet and execute the following script [3]:

#!/bin/bash

BLOCK_DEVICE="$1"
[ -z "$BLOCK_DEVICE" ] && echo "Usage: $0 /dev/sdXN" && exit -1

## Thanks to the following guys:
# https://rudd-o.com/linux-and-free-software/how-to-make-a-minimal-fedora-chroot
# https://github.com/glacion/fedora-chroot-installation/blob/master/docs/VM-Install.md

echo "This script will destroy everything on $BLOCK_DEVICE"
echo -n "Proceed (y/n)?"
read RESP
if [ "$RESP" != "y" ]; then
	echo "Abort."
	exit 0
fi
unset RESP

if [ ! -e $BLOCK_DEVICE ]; then
	echo "Error: $BLOCK_DEVICE does not exist"
	exit -1
fi


umount $BLOCK_DEVICE
mkfs.ext4 -O ^has_journal -L fed $BLOCK_DEVICE
mount $BLOCK_DEVICE /mnt/


mkdir -p /mnt/proc /mnt/sys
mount --bind /proc /mnt/proc
mount --bind /sys /mnt/sys


dnf install \
    --installroot=/mnt \
    --releasever=40 \
    --setopt=install_weak_deps=False \
    --setopt=keepcache=False \
    --assumeyes \
    --nodocs \
    systemd dnf glibc-langpack-en passwd rtkit \
    kbd zchunk sudo audit \
    vim-minimal systemd-udev rootfiles less iputils deltarpm sqlite lz4 \
    dhcp-client wpa_supplicant kernel \
alsa-sof-firmware.noarch \
amd-gpu-firmware.noarch \
amd-ucode-firmware.noarch \
atheros-firmware.noarch \
brcmfmac-firmware.noarch \
cirrus-audio-firmware.noarch \
intel-audio-firmware.noarch \
intel-gpu-firmware.noarch \
iwlegacy-firmware.noarch \
iwlwifi-dvm-firmware.noarch \
iwlwifi-mvm-firmware.noarch \
libertas-firmware.noarch \
linux-firmware.noarch \
linux-firmware-whence.noarch \
mt7xxx-firmware.noarch \
nvidia-gpu-firmware.noarch \
nxpwireless-firmware.noarch \
realtek-firmware.noarch \
tiwilink-firmware.noarch
    #NetworkManager policycoreutils firewalld selinux-policy-targeted \

echo nameserver 8.8.8.8 > /mnt/etc/resolv.conf
chattr +i /mnt/etc/resolv.conf

systemd-firstboot \
    --root=/mnt \
    --locale=en_US.UTF-8 \
    --keymap=us \
    --timezone=Europe/Dublin \
    --hostname=fed \
    --setup-machine-id


wget https://github.com/glacion/genfstab/releases/download/1.0/genfstab; chmod +x genfstab
./genfstab -L /mnt >> /mnt/etc/fstab

cat <<"EOF" > /mnt/root/firstconfig.sh
#!/bin/bash
useradd -m -s /bin/bash user
echo user:test |   chpasswd
echo root:test |   chpasswd

KVER=$(ls /lib/modules)
cp /lib/modules/${KVER}/vmlinuz /boot
#dracut --force --no-hostonly    --kver ${KVER}
dracut --force --no-hostonly /boot/initrd.img ${KVER}
EOF
chroot /mnt bash root/firstconfig.sh

umount /mnt/proc
umount /mnt/sys
umount /mnt

echo "Basic Fedora 40 installed successfully"

For example I ran this script with the following parameter:

./install_fed40_chroot.sh /dev/nvme0n1p6

Read the script and customize it to your needs. The code should be simple enough, but a brief description is:

  • create an Ext4 filesystem (remove -O ^has_journal if you don’t want the Journal to be disabled)
  • prepare the chroot environment
  • install the basic packages of Fedora
  • set the default DNS to 8.8.8.8 and set the immutable flag of the file
  • run the first configuration of the new system with systemd-firstboot
  • create the fstab file
  • create a script in the chroot environment and execute it:
    • created a regular user called user
    • set the password to test for both root and user
    • generate the initrd for the kernel of the new system
  • unmount the partition

Step 4: Bootloader Configuration

The new system is now installed and can be booted from the command line of Grub if you use the USB stick. Feel free to skip this validation step.

To make the new system bootable we need:

  1. mount the EFI partition
  2. create a folder with SHIM, Grub and grub.cfg
  3. configure the EFI Boot Manager with a new entry

For the first point check the partition table with fdisk -l and take note of the line where you read EFI System in the column Type. Mount that partition under /mnt, create an empty folder and put the relevant files:

mount dev/nvme0n1p1 /mnt/
mkdir /mnt/EFI/fed

wget -O /mnt/EFI/fed/BOOTX64.EFI https://mirror.telepoint.bg/fedora/releases/40/Everything/x86_64/os/EFI/BOOT/BOOTX64.EFI
wget -O /mnt/EFI/fed/grubx64.efi https://mirror.telepoint.bg/fedora/releases/40/Everything/x86_64/os/EFI/BOOT/grubx64.efi
wget -O /mnt/EFI/fed/mmx64.efi https://mirror.telepoint.bg/fedora/releases/40/Everything/x86_64/os/EFI/BOOT/mmx64.efi
wget -O /mnt/EFI/fed/grub.cfg https://mirror.telepoint.bg/fedora/releases/40/Everything/x86_64/os/EFI/BOOT/grub.cfg
# You can use also copy the files from the ISO image of Fedora if you don't
# want to download them from internet with wget

In theory only grubx64.efi is required, but when Secure Boot is enabled the firmware of the laptop tries to validate the signature of the bootloader and the kernel using Microsoft’s keys. Since the validation will fail and it is not practical or economically sustainable to sign with Microsoft service for every new Grub and/or kernel upgrade, the solution was to sign the simplest version of an EFI program (Shim) and use it to inject additional custom keys so the next call Grub (and then the kernel) will pass the validation.

In our folder /mnt/EFI/fed we have:

  • BOOTX64.EFI which is SHIM [4]
  • mmx64.efi that is used by Shim to inject new keys
  • the Grub bootloader

Note that the bootloader still needs to be signed, but thanks to Shim now Grub can be signed by Fedora (for example).

Customize the content of grub.cfg at will. Mine looks like this:

menuentry 'fed (Fedora 40) - on the disk' {
        set root=(hd0,gpt6)
        linux   /boot/vmlinuz root=LABEL=fed ro selinux=0 3
        initrd  /boot/initrd.img
}

To perform the last point - configure the EFI Boot Manager with a new entry - we could use efibootmgr, but when I tried it seemed to work at first until you boot Windows again (Windows restore its configuration removing whatever you have done with efibootmgr. The solution is to configure the EFI Boot Manager from Windows using its tool called bcedit [5].

Please check this wonderful blog for details.

Boot Windows and open the Command Prompt as Administrator. You can check the current EFI configuration with:

bcdedit /enum ALL
bcdedit /v

The procedure that worked for me was to copy the Windows boot entry and customize the copied one:

bcdedit /copy {bootmgr} /d "Grub"
bcdedit /set  {09d06208-3047-11ee-b0c9-a14a285baee3} path \EFI\fed\BOOTX64.efi
bcdedit /set  {fwbootmgr} timeout 30
bcdedit /timeout 30

Substitute {09d06208-3047-11ee-b0c9-a14a285baee3} with your entry identifier (use the command bcdedit /enum ALL to see it). Check the Appendix to see example of outputs from bcdedit.

Step 5: Configure the internet connection and install additional software

Reboot the system and log in with root (password test). Then check what are your network interface names and connect to the internet with:

ifconfig -a

# if you use Ethernet
dhclient enp0s31f6

# if you use Wifi
wpa_supplicant -Dnl80211 -i wlp9s0 -c <(wpa_passphrase '<WIFI_ID>' '<WIFI_PASSWORD>') &
dhclient wlp9s0

Now you are free to customize the installation at will. For example you can check the group name to install the Desktop Environment LXQt:

# list the available group names
dnf group list
dnf group info 'LXQt Desktop'
dnf group install 'LXQt Desktop' 

Conclusion

I hope to have collected in this guide all the small bits and pieces required to install a dual boot system Windows/Linux on a modern EFI system with Secure Boot active.

The indirect benefit of reading this guide is that (hopefully) it shed also some light on how the installation process of an OS works under the hood:

  • partitioning
  • creating relevant files and folders
  • configuring the system
  • configuring the boot loader

The second step of the process can be very simple like invoking the package manager of your distribution, can involve the copy of an entire filesystem from a disk image or can require downloading sources and compiling packages from scratch (see Linux From Scratch [6]).

If you are configuring a system that does not use systemd, only the chroot part is required.

If Secure Boot is disabled, our guide still works and you can decide to skip Shim and use directly grubx64.efi.

References

[1] https://windowsreport.com/cpu-virtualization/

[2] https://fedoraproject.org/workstation/download or https://fedoraproject.org/workstation/download

[3] https://rudd-o.com/linux-and-free-software/how-to-make-a-minimal-fedora-chroot https://github.com/glacion/fedora-chroot-installation/blob/master/docs/VM-Install.md

[4] https://github.com/rhboot/shim

[5] https://www.rodsbooks.com/efi-bootloaders/index.html

[6] https://www.linuxfromscratch.org/lfs/view/stable/

Appendix

Example of bcdedit commands and outputs:

C:\Windows\System32>bcdedit /enum  {09d06208-3047-11ee-b0c9-a14a285baee3}

Windows Boot Manager
--------------------
identifier              {09d06208-3047-11ee-b0c9-a14a285baee3}
device                  partition=\Device\HarddiskVolume1
path                    \EFI\fed\shimx64.efi
description             Grub
locale                  en-GB
inherit                 {globalsettings}
default                 {current}
resumeobject            {09d06204-3047-11ee-b0c9-a14a285baee3}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30


##################################################################################################################################

C:\Windows\System32>bcdedit /enum

Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=\Device\HarddiskVolume1
path                    \EFI\MICROSOFT\BOOT\BOOTMGFW.EFI
description             Windows Boot Manager
locale                  en-GB
inherit                 {globalsettings}
default                 {current}
resumeobject            {09d06204-3047-11ee-b0c9-a14a285baee3}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30

Windows Boot Loader
-------------------
identifier              {current}
device                  partition=C:
path                    \Windows\system32\winload.efi
description             Windows 11
locale                  en-GB
inherit                 {bootloadersettings}
recoverysequence        {09d06206-3047-11ee-b0c9-a14a285baee3}
displaymessageoverride  Recovery
recoveryenabled         Yes
isolatedcontext         Yes
allowedinmemorysettings 0x15000075
osdevice                partition=C:
systemroot              \Windows
resumeobject            {09d06204-3047-11ee-b0c9-a14a285baee3}
nx                      OptIn
bootmenupolicy          Standard


##################################################################################################################################


C:\Windows\System32>bcdedit /v

Windows Boot Manager
--------------------
identifier              {9dea862c-5cdd-4e70-acc1-f32b344d4795}
device                  partition=\Device\HarddiskVolume1
path                    \EFI\MICROSOFT\BOOT\BOOTMGFW.EFI
description             Windows Boot Manager
locale                  en-GB
inherit                 {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
default                 {09d06205-3047-11ee-b0c9-a14a285baee3}
resumeobject            {09d06204-3047-11ee-b0c9-a14a285baee3}
displayorder            {09d06205-3047-11ee-b0c9-a14a285baee3}
toolsdisplayorder       {b2721d73-1db4-4c62-bf78-c548a880142d}
timeout                 30

Windows Boot Loader
-------------------
identifier              {09d06205-3047-11ee-b0c9-a14a285baee3}
device                  partition=C:
path                    \Windows\system32\winload.efi
description             Windows 11
locale                  en-GB
inherit                 {6efb52bf-1766-41db-a6b3-0ee5eff72bd7}
recoverysequence        {09d06206-3047-11ee-b0c9-a14a285baee3}
displaymessageoverride  Recovery
recoveryenabled         Yes
isolatedcontext         Yes
allowedinmemorysettings 0x15000075
osdevice                partition=C:
systemroot              \Windows
resumeobject            {09d06204-3047-11ee-b0c9-a14a285baee3}
nx                      OptIn
bootmenupolicy          Standard

##################################################################################################################################

C:\Windows\System32>bcdedit /set  {09d06208-3047-11ee-b0c9-a14a285baee3} path \EFI\fed\BOOTX64.efi
The operation completed successfully.

C:\Windows\System32>bcdedit /enum  {09d06208-3047-11ee-b0c9-a14a285baee3}

Windows Boot Manager
--------------------
identifier              {09d06208-3047-11ee-b0c9-a14a285baee3}
device                  partition=\Device\HarddiskVolume1
path                    \EFI\fed\BOOTX64.efi
description             Grub
locale                  en-GB
inherit                 {globalsettings}
default                 {current}
resumeobject            {09d06204-3047-11ee-b0c9-a14a285baee3}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30

C:\Windows\System32>bcdedit /enum all

Firmware Boot Manager
---------------------
identifier              {fwbootmgr}
displayorder            {bootmgr}
                        {09d061f5-3047-11ee-b0c9-a14a285baee3}
                        {09d061f6-3047-11ee-b0c9-a14a285baee3}
                        {09d061fd-3047-11ee-b0c9-a14a285baee3}
                        {09d061fe-3047-11ee-b0c9-a14a285baee3}
                        {09d061ff-3047-11ee-b0c9-a14a285baee3}
                        {09d06200-3047-11ee-b0c9-a14a285baee3}
                        {09d06201-3047-11ee-b0c9-a14a285baee3}
                        {09d06202-3047-11ee-b0c9-a14a285baee3}
                        {09d06203-3047-11ee-b0c9-a14a285baee3}
                        {09d061f7-3047-11ee-b0c9-a14a285baee3}
                        {09d06208-3047-11ee-b0c9-a14a285baee3}
timeout                 0

Windows Boot Manager
--------------------
identifier              {09d06208-3047-11ee-b0c9-a14a285baee3}
device                  partition=\Device\HarddiskVolume1
path                    \EFI\fed\BOOTX64.efi
description             Grub
locale                  en-GB
inherit                 {globalsettings}
default                 {current}
resumeobject            {09d06204-3047-11ee-b0c9-a14a285baee3}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30

Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=\Device\HarddiskVolume1
path                    \EFI\MICROSOFT\BOOT\BOOTMGFW.EFI
description             Windows Boot Manager
locale                  en-GB
inherit                 {globalsettings}
default                 {current}
resumeobject            {09d06204-3047-11ee-b0c9-a14a285baee3}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30

Firmware Application (101fffff)
-------------------------------
identifier              {09d061eb-3047-11ee-b0c9-a14a285baee3}
description             Setup

Firmware Application (101fffff)
-------------------------------
identifier              {09d061ec-3047-11ee-b0c9-a14a285baee3}
description             Boot Menu

Firmware Application (101fffff)
-------------------------------
identifier              {09d061ed-3047-11ee-b0c9-a14a285baee3}
description             Diagnostic Splash Screen

Firmware Application (101fffff)
-------------------------------
identifier              {09d061ee-3047-11ee-b0c9-a14a285baee3}
description             Lenovo Diagnostics

Firmware Application (101fffff)
-------------------------------
identifier              {09d061ef-3047-11ee-b0c9-a14a285baee3}
description             Asset Information

Firmware Application (101fffff)
-------------------------------
identifier              {09d061f0-3047-11ee-b0c9-a14a285baee3}
description             Regulatory Information

Firmware Application (101fffff)
-------------------------------
identifier              {09d061f1-3047-11ee-b0c9-a14a285baee3}
description             ThinkShield secure wipe

Firmware Application (101fffff)
-------------------------------
identifier              {09d061f2-3047-11ee-b0c9-a14a285baee3}
description             Startup Interrupt Menu

Firmware Application (101fffff)
-------------------------------
identifier              {09d061f3-3047-11ee-b0c9-a14a285baee3}
description             Rescue and Recovery

Firmware Application (101fffff)
-------------------------------
identifier              {09d061f4-3047-11ee-b0c9-a14a285baee3}
description             MEBx Hot Key

Firmware Application (101fffff)
-------------------------------
identifier              {09d061f5-3047-11ee-b0c9-a14a285baee3}
description             USB CD

Firmware Application (101fffff)
-------------------------------
identifier              {09d061f6-3047-11ee-b0c9-a14a285baee3}
description             USB FDD

Firmware Application (101fffff)
-------------------------------
identifier              {09d061f7-3047-11ee-b0c9-a14a285baee3}
description             Other HDD

Firmware Application (101fffff)
-------------------------------
identifier              {09d061f8-3047-11ee-b0c9-a14a285baee3}
description             USBR BOOT CDROM

Firmware Application (101fffff)
-------------------------------
identifier              {09d061f9-3047-11ee-b0c9-a14a285baee3}
description             USBR BOOT Floppy

Firmware Application (101fffff)
-------------------------------
identifier              {09d061fa-3047-11ee-b0c9-a14a285baee3}
description             ATA HDD

Firmware Application (101fffff)
-------------------------------
identifier              {09d061fb-3047-11ee-b0c9-a14a285baee3}
description             ATAPI CD

Firmware Application (101fffff)
-------------------------------
identifier              {09d061fd-3047-11ee-b0c9-a14a285baee3}
description             NVMe0

Firmware Application (101fffff)
-------------------------------
identifier              {09d061fe-3047-11ee-b0c9-a14a285baee3}
description             ATA HDD0

Firmware Application (101fffff)
-------------------------------
identifier              {09d061ff-3047-11ee-b0c9-a14a285baee3}
description             USB HDD

Firmware Application (101fffff)
-------------------------------
identifier              {09d06200-3047-11ee-b0c9-a14a285baee3}
description             PXE BOOT

Firmware Application (101fffff)
-------------------------------
identifier              {09d06201-3047-11ee-b0c9-a14a285baee3}
description             LENOVO CLOUD

Firmware Application (101fffff)
-------------------------------
identifier              {09d06202-3047-11ee-b0c9-a14a285baee3}
description             ON-PREMISE

Firmware Application (101fffff)
-------------------------------
identifier              {09d06203-3047-11ee-b0c9-a14a285baee3}
description             Other CD

Windows Boot Loader
-------------------
identifier              {current}
device                  partition=C:
path                    \Windows\system32\winload.efi
description             Windows 11
locale                  en-GB
inherit                 {bootloadersettings}
recoverysequence        {09d06206-3047-11ee-b0c9-a14a285baee3}
displaymessageoverride  Recovery
recoveryenabled         Yes
isolatedcontext         Yes
allowedinmemorysettings 0x15000075
osdevice                partition=C:
systemroot              \Windows
resumeobject            {09d06204-3047-11ee-b0c9-a14a285baee3}
nx                      OptIn
bootmenupolicy          Standard

Windows Boot Loader
-------------------
identifier              {09d06206-3047-11ee-b0c9-a14a285baee3}
device                  ramdisk=[\Device\HarddiskVolume4]\Recovery\WindowsRE\Winre.wim,{09d06207-3047-11ee-b0c9-a14a285baee3}
path                    \windows\system32\winload.efi
description             Windows Recovery Environment
locale                  en-gb
inherit                 {bootloadersettings}
displaymessage          Recovery
osdevice                ramdisk=[\Device\HarddiskVolume4]\Recovery\WindowsRE\Winre.wim,{09d06207-3047-11ee-b0c9-a14a285baee3}
systemroot              \windows
nx                      OptIn
bootmenupolicy          Standard
winpe                   Yes

Resume from Hibernate
---------------------
identifier              {09d06204-3047-11ee-b0c9-a14a285baee3}
device                  partition=C:
path                    \Windows\system32\winresume.efi
description             Windows Resume Application
locale                  en-GB
inherit                 {resumeloadersettings}
recoverysequence        {09d06206-3047-11ee-b0c9-a14a285baee3}
recoveryenabled         Yes
isolatedcontext         Yes
allowedinmemorysettings 0x15000075
filedevice              partition=C:
custom:21000026         partition=C:
filepath                \hiberfil.sys
bootmenupolicy          Standard
debugoptionenabled      No

Windows Memory Tester
---------------------
identifier              {memdiag}
device                  partition=\Device\HarddiskVolume1
path                    \EFI\Microsoft\Boot\memtest.efi
description             Windows Memory Diagnostic
locale                  en-GB
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS Settings
------------
identifier              {emssettings}
bootems                 No

Debugger Settings
-----------------
identifier              {dbgsettings}
debugtype               Local

RAM Defects
-----------
identifier              {badmemory}

Global Settings
---------------
identifier              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Boot Loader Settings
--------------------
identifier              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisor Settings
-------------------
identifier              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Resume Loader Settings
----------------------
identifier              {resumeloadersettings}
inherit                 {globalsettings}

Device options
--------------
identifier              {09d06207-3047-11ee-b0c9-a14a285baee3}
description             Windows Recovery
ramdisksdidevice        partition=\Device\HarddiskVolume4
ramdisksdipath          \Recovery\WindowsRE\boot.sdi


##################################################################################################################################

C:\Windows\System32>bcdedit /enum {fwbootmgr}

Firmware Boot Manager
---------------------
identifier              {fwbootmgr}
displayorder            {bootmgr}
                        {09d061f5-3047-11ee-b0c9-a14a285baee3}
                        {09d061f6-3047-11ee-b0c9-a14a285baee3}
                        {09d061fd-3047-11ee-b0c9-a14a285baee3}
                        {09d061fe-3047-11ee-b0c9-a14a285baee3}
                        {09d061ff-3047-11ee-b0c9-a14a285baee3}
                        {09d06200-3047-11ee-b0c9-a14a285baee3}
                        {09d06201-3047-11ee-b0c9-a14a285baee3}
                        {09d06202-3047-11ee-b0c9-a14a285baee3}
                        {09d06203-3047-11ee-b0c9-a14a285baee3}
                        {09d061f7-3047-11ee-b0c9-a14a285baee3}
                        {09d06208-3047-11ee-b0c9-a14a285baee3}
timeout                 0

C:\Windows\System32>bcdedit /set {fwbootmgr} timeout 30
The operation completed successfully.

C:\Windows\System32>bcdedit /enum {fwbootmgr}

Firmware Boot Manager
---------------------
identifier              {fwbootmgr}
displayorder            {bootmgr}
                        {09d061f5-3047-11ee-b0c9-a14a285baee3}
                        {09d061f6-3047-11ee-b0c9-a14a285baee3}
                        {09d061fd-3047-11ee-b0c9-a14a285baee3}
                        {09d061fe-3047-11ee-b0c9-a14a285baee3}
                        {09d061ff-3047-11ee-b0c9-a14a285baee3}
                        {09d06200-3047-11ee-b0c9-a14a285baee3}
                        {09d06201-3047-11ee-b0c9-a14a285baee3}
                        {09d06202-3047-11ee-b0c9-a14a285baee3}
                        {09d06203-3047-11ee-b0c9-a14a285baee3}
                        {09d061f7-3047-11ee-b0c9-a14a285baee3}
                        {09d06208-3047-11ee-b0c9-a14a285baee3}
timeout                 30