LAC> As far as I can tell, protected boot was enabled by default, but not
LAC> locked, on the machine in question.

This is probably going to be the default from now on so something else
we need to do before dual-booting or even replacing Windows totally.