@dev_ric No, it doesn't line up with that. It's before the POST so Windows has no involvement. The only thing it could have done is to modify the UEFI settings somehow so that on next POST it does something different; it's not actively involved at that point