Small correction to my own post above — I wrote “automatic, no touch” and then said it still needs a firmware visit, which reads as a contradiction. Let me untangle it, because the distinction is actually useful.
There is one Enroll Secure Boot task. What it manages to do depends on the state the client is in when it runs:
Client state
What the task does
Setup Mode (platform key cleared)
Enrols outright. Nothing to confirm, nobody at the keyboard.
Normal (keys present, Secure Boot off)
FOS stages the MOK request itself, non-interactively. Someone answers the blue MokManager screen once on the next reboot.
Already enforcing Secure Boot
Cannot run — the machine will not boot FOS in the first place. Use the live USB route for those.
So the task always removes the USB stick and the live image, which is the part that matters when you have 200 machines. Putting a machine in Setup Mode first removes the MokManager keystrokes as well.
Setup Mode is one visit to the firmware screen per machine, once — and it can be the same visit where you turn Secure Boot on afterwards. It is not the same as turning Secure Boot off: a machine with Secure Boot disabled still has a platform key and still refuses the database write. In the firmware, look for “Erase all Secure Boot settings”, “Clear Secure Boot keys” or “Custom mode”.
One practical note if you go the MokManager route: that blue screen has timeouts FOG cannot change. It gives up and boots normally if nothing is pressed within about 10 seconds of appearing, and it reboots if left idle partway through. Do not walk away from it.
None of this changes the answer for your existing fleet, @Valer — your key is already enrolled on those 200 machines, so you just pass it to the installer and they carry on as they are. The above is for machines you enrol from here on.
