I don't know of a way to prevent Windows from writing to the NVRAM and modifying EFI variables; however, there are other things you could do....
See my answer to this question for some tools that might help. bcdedit
is most likely to be useful in this respect. You could also try EasyUEFI, which I'd not used when I wrote that earlier response.
Another option would be to create system startup and/or shutdown scripts that automatically restore the desired boot configuration. You'd use bcdedit
for this in Windows, but I'm not enough of a Windows user to provide details. Doing this in Linux is unlikely to be necessary, since Linux isn't the culprit; but if it were, you could use efibootmgr
-- or for a somewhat lighter touch, you could use the refind-mkdefault
script, which I'll add to the next version of rEFInd. By default, this script sets rEFInd as the default boot program, but if you pass it the name (filename or description) of another tool via the -L
option, the script will set it as the default instead.
In a worst-case scenario, you can rename or move the Windows boot loader file (EFI\Microsoft\Boot\bootmgfw.efi
on the ESP) to something else and put Shim in its place, with a copy of GRUB there. This will cause GRUB to launch instead of the Windows boot loader. You'll need to reconfigure your GRUB setup to launch the Windows boot loader correctly, though. The Boot Repair tool can do this automatically; the option is on the Advanced menu, and is called something along the lines of "back up and replace Windows boot files" (I don't recall the exact name). The main drawback to this approach is that, if and when Windows updates its boot loader, you'll need to re-apply this fix. It's also confusing; the disk filenames and NVRAM boot entries will be misleading, which could complicate future repairs.