Bonus points for a non-unique UEFI UUID that is already enrolled in some random company's Microsoft Intune / Windows Autopilot instance so when you fire it up off a fresh Windows install it begs you to sign into $RANDOM_COMPANY_WITH_BAD_IT_CONTROLS.

Triple-points if the vendor includes a sticker telling you to complete Windows OOBE without connecting it to the Internet to avoid this.

I still can't believe that microsoft allows companies to essentially brick machines they don't even own like that. Seems criminal to me.

More criminal than hard coding UUID for some other device?

You can do whatever you want with your device. Microsoft is also doing whatever they want with your device.

If the OEM hadn't messed up and reused UUIDs, it would be "Microsoft letting companies do whatever they want with their device", which is not unreasonable. OEMs reusing UUIDs for some ridiculous reason is breaking down the chain of "whose device is it".

Forget about the OEM. If you find out someone else's UUID you can spin up a VM with your UUID set to theirs and then add it to your system and brick their machine?

Mistakes happen. It is inevitable at scale. So maybe we need softer recovery processes?

I’m fairly sure my expensive ASUS ROG motherboard (ergo: not even their budget line) also had a “to be filled in by OEM” string that I couldn’t even override. (ASUS have a utility but it’s not publicly available, probably just for computer shops)

But that's exactly the point. Computer shops that sell complete systems are supposed to put their name in the "system manufacturer" field. If you bought the mainboard yourself and built your own system, then who do you think should have replaced that string?

I get that, but I'd expect it to be a setting I can change in BIOS, or at least default to the motherboard's model number. Instead, if I build my own, I just can't change it ever because ASUS refuse to release it publicly. Hell, even the shop I used for the previous PC didn't have such a tool. (And if you change it in Windows, it's rewritten from SMBIOS every boot)

I worked in PC stores for a long time and never had any such access to such a tool. Sounds like something only the big OEM's would get honestly.

It's mentioned in some ASUS docs, but it's not available on their support anywhere. Probably reserved for big OEMs, yeah.

I stumbled upon that feature in the (MS-DOS based) bios flashing utility for some mainboard, via some command line option. Just don't remember which one it was, it was ages ago.

Okay but we're talking about consumer-grade boards sold at retail here. It's not like these are boards that fell off a truck. ASUS sells them this way, but then doesn't give consumers a way to alter that field.

How about set it to default "Asus", and computer shop has tool to override it

Then you can't tell it apart from systems that were actually built by Asus. But given that most smaller shops don't seem to have access to the tool anyways, we'd then just have the opposite situation.

Need I remind you of the ASUS Zenbook UX21 from 2011, almost the first machine to be branded an “Ultrabook”, that experienced sudden shutdowns under Linux (but not Windows) because its ACPI firmware scribbled over random places of I/O space in an attempt to initialize a SATA controller the SSD-based machine did not physically have? (Can’t find the link now, sorry.)

If you buy a motherboard to build your own (or any, even if it is for someone else) PC, you are the OEM.

That's basically my experience for 2 other "gaming" motherboard brands that aren't ASUS as well. My guess is that people who build their own PCs probably don't care about SMBIOS serial numbers being properly populated, so why bother?

I would care if I could change it, but you need a proprietary tool that you can't obtain. (Every other way I found involved patching the UEFI and turning off Secure Boot)

    # Manufacturer: Micro-Star International Co., Ltd.
    # Product Name: PRO Z790-A WIFI (MS-7E07)

    $ sudo cat /sys/firmware/dmi/tables/DMI | strings | grep -i filled | wc -l
    10

Sigh...

But this is correct, if the Mainboard was bought as is and was not part of a complete system, the system manufacturer is obviously not filled out as there is none.