As far as I can tell, protected boot was enabled by default, but notlocked, on the machine in question.