# Boot Guard

> Report Intel Boot Guard provisioning state, profile (0, 3, 4, or 5), and Verified/Measured Boot modes. Use when asked about Boot Guard, BtG profiles, or firmware root of trust.

- Skill: `open-edge-platform/boot-guard` (Agent Skill)
- Install (CLI): `npx skillmds@latest add open-edge-platform/boot-guard`
- Raw SKILL.md: https://api.skillmd.com/api/skills/open-edge-platform/boot-guard/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: open-edge-platform (https://skillmd.com/u/open-edge-platform)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/open-edge-platform/boot-guard

---


# Intel Boot Guard Configuration Skill

## Purpose

This skill reports the current Intel Boot Guard configuration on the target system.

## What to Report

- Boot Guard provisioning status (Provisioned/Not Provisioned)
- Profile number (0, 3, 4, or 5)
- Verified Boot mode (Enabled/Disabled)
- Measured Boot mode (Enabled/Disabled)

## Background

### Boot Guard Profiles

| Profile | Verified Boot | Measured Boot | Description |
|---------|--------------|---------------|-------------|
| 0 | No | No | Not provisioned |
| 3 | No | Yes | Measured Boot only |
| 4 | Yes | No | Verified Boot only |
| 5 | Yes | Yes | Verified + Measured Boot |

## Commands

### Read Boot Guard MSR

```bash
# Load MSR module
sudo modprobe msr

# Read Measured (bit 5) and Verified (bit 6) Boot bits together
sudo rdmsr --bitfield 6:5 0x13A

```

**Interpreting `--bitfield 6:5` output:**

| Value | Verified Boot | Measured Boot | Profile |
|-------|--------------|---------------|---------|
| 0 | Disabled | Disabled | 0 |
| 1 | Disabled | Enabled | 3 |
| 2 | Enabled | Disabled | 4 |
| 3 | Enabled | Enabled | 5 |

### Check PCR0 (Boot Guard measurements)

```bash
tpm2_pcrread sha256:0
```

## Output Format

```
INTEL BOOT GUARD
  Status: Provisioned/Not Provisioned
  Profile: 5 (Verified + Measured Boot)
  Verified Boot: Enabled/Disabled
  Measured Boot: Enabled/Disabled
  PCR0: Has measurements / Empty
```

## Dependencies

- `msr-tools` package (for rdmsr)
- `tpm2-tools` package
- Root/sudo access

## Notes

Boot Guard is provisioned at manufacturing by the OEM. It cannot be enabled by the end user after system manufacture.