Mini PC BIOS Settings for a 24/7 Homelab

A mini PC arrives configured for the person who bought it as a desktop: it waits for a button press, it sleeps, its radios are on, and its virtualization extensions are off. None of those defaults suit a box that will sit on a shelf, headless, for the next three years.

Every setting below is worth changing once, in a single pass, before the OS goes on — afterwards it costs a reboot, which is never as convenient on a machine already running services. Reaching the firmware is Del or F2 on most N100-class boards, F10 on HP thin clients, F2 on Dell Wyse units, and Enter then F1 on Lenovo Tiny desktops.

1. AC power recovery — the one that actually bites

Set the “after power loss” behaviour to Power On, not “Stay Off” and not “Last State”. It is disabled by default on essentially every consumer mini PC, and it is the reason a homelab stays dark after a two-second outage while every other device in the house comes back.

The menu name changes by vendor: After Power Failure on Intel NUC hardware (Intel’s support article names the exact submenu), State After G3 or Restore AC Power Loss on the AMI and Insyde firmware used by Beelink, GMKtec, Trigkey and Minisforum, AC Recovery on Dell, After Power Loss on HP and Lenovo. The vendor-by-vendor menu paths, the two failure modes the setting does not fix, and how to test it without abusing the wall socket are covered in full in the power-outage BIOS fix.

The box where this matters most is whichever one everything else depends on. If a mini PC is running pfSense or OPNsense as the house router, it staying dark after an outage takes the whole network with it, including any remote access you would use to investigate.

One thing to note here rather than there: a firmware update usually resets this to the default. If a BIOS flash is part of your maintenance, re-check this setting immediately afterwards, before you walk away.

2. Wake-on-LAN, and the deep-sleep setting that breaks it

Enable Wake on LAN, sometimes listed as Power On by PCIe/PCI or Resume by LAN. It gives you the reverse of the previous setting: the ability to deliberately power a box down and bring it back without walking to it.

Two traps sit next to it:

• Deep Sleep / ErP / EuP mode cuts standby power to the NIC to meet European standby-draw rules, so the network card is unpowered when the machine is off and no magic packet ever arrives. Disable it if you want WoL to work. The cost is a few tenths of a watt in a state a 24/7 box is never in.
• The OS disarms it. Linux distributions frequently reset the NIC’s wake flag on boot. Confirm with ethtool <iface> that it reports Wake-on: g, and arm it with ethtool -s <iface> wol g if it reports d. The ethtool manual page documents the full flag set; g is magic-packet wakeup and is the one nearly everyone wants. Make it survive reboots with a systemd unit or a NetworkManager dispatcher script, because a manual ethtool call is forgotten by the next kernel update.

While in this area, look for RTC Wake or Wake on Alarm. It powers the machine on at a set time of day, which is genuinely useful for a box that only needs to exist during a nightly backup window.

3. Virtualization: VT-x now, VT-d if you might ever want it

Intel Virtualization Technology (VT-x) is off by default on a surprising number of budget boards. Turn it on. Without it, Proxmox and KVM refuse to start guests, and the error message points at the hypervisor rather than the firmware, which costs an evening.

VT-d / IOMMU is the separate one, usually a line or two below, sometimes called Intel VT for Directed I/O. The N100 supports both, per Intel’s own specification page, but plenty of boards ship with the VT-d line hidden or disabled. It is the prerequisite for assigning a physical device to a VM; the Proxmox passthrough documentation treats it as non-negotiable.

Worth knowing before you spend time on it: the most common reason people want passthrough on a mini PC is hardware video transcoding, and that job does not need IOMMU at all. A container reaches the integrated GPU through a device node, which is a far simpler path than passing the whole device through. Enable VT-d anyway — it costs nothing and you cannot enable it remotely later — but do not choose hardware on that criterion alone. The broader hypervisor decisions that follow are in Proxmox on a mini PC.

4. Boot mode and boot order

Set UEFI only and disable CSM (legacy BIOS compatibility). Every current homelab OS installs in UEFI mode, and a board left in “UEFI + Legacy” will occasionally pick the wrong path after a firmware reset and boot to a black screen.

Secure Boot is a judgement call. Proxmox VE has shipped a signed shim bootloader since version 8.1 (November 2023), so leaving it on is workable, but any out-of-tree kernel module (some NIC drivers, ZFS on distributions that do not sign it, virtualization tooling) then needs to be signed or it will not load. If a module refuses to load with a cryptic key error, Secure Boot is the first thing to check. For a headless box behind a locked door, turning it off removes a category of debugging that offers little in return.

Then prune the boot order: put the internal NVMe first and disable the boot entries you do not use — PXE/network boot especially. Each unused entry adds a timeout to every boot, and on a machine that reboots after a nightly kernel update that time is spent every night. Disabling network boot also removes an easy path onto the machine for anything already on your LAN.

5. C-states and ASPM — the two or three watts nobody sets

This is where idle wattage is won. Look for and enable:

• CPU C-states and Package C-State Limit set to the deepest available (C10 on Alder Lake-N boards, or “Auto”). A board limited to C3 or C6 can sit several watts above the same hardware allowed to reach C8 or C10.
• PCIe ASPM (Active State Power Management) set to L1 or Auto, plus native ASPM if the option exists. NVMe drives and 2.5GbE controllers only drop into their low-power states when the link allows it.
• ErP/EuP — noted above as a WoL problem, but if you never use Wake-on-LAN, enabling it trims standby draw.

Do not trust the labels. Firmware routinely advertises settings it does not honour, and two boards with the same chip can idle four watts apart because of board design. The only verdict that counts comes from a plug-in energy meter such as the Kill A Watt P3 P4400: change one setting, note the reading after ten quiet minutes, change the next. The full method, including why a spec sheet’s TDP figure has almost nothing to do with wall draw, is in how to measure mini PC idle wattage, and the arithmetic that turns those watts into an annual number is in the power consumption math.

6. Memory settings: boring on purpose

Leave memory at its JEDEC defaults. XMP and EXPO profiles buy a few percent in benchmarks and cost stability on a machine expected to run for months without a reboot, and mini PC boards are not built for memory tuning. A homelab host that reboots itself once a fortnight from a memory error is worth far less than one that is three percent slower.

Two things to check rather than change: that the installed capacity is fully detected (a partially seated SODIMM shows up as half the RAM), and whether the board is running single or dual channel. Most cheap N100 boxes have one SODIMM slot and are single channel by construction — a real limit on how much you can eventually run, and one of the specs the N100 buying guide treats as decisive. If you are still choosing hardware, the ThinkCentre Tiny versus N100 comparison is largely an argument about exactly this: two SODIMM slots and a real vendor BIOS, against lower idle draw and a warranty.

7. Fans and thermals

If the board exposes a fan curve, set the quietest profile that still keeps the CPU below roughly 80°C under sustained load. A fully passive setting on an actively cooled chassis is not silence, it is throttling, and a throttled host is slow at exactly the wrong moment.

Leave the thermal shutdown thresholds alone, but do check any performance/power limit profile: boards aimed at desktops sometimes ship with a raised PL1/PL2 that gains nothing on a machine idling 95% of the time, and dropping to the default lowers noise and heat for no practical loss. If genuine silence is the goal, the hardware choice matters more than the curve — see quiet and fanless mini PC builds.

8. Turn off what the box will never use

Each of these saves a little power and removes a little attack surface: the Wi-Fi and Bluetooth radios on a box that lives on Ethernet, onboard audio on a headless server, unused SATA ports with nothing attached, and the serial/COM port unless it is your console. None is dramatic alone. Together they are worth a watt or so and one less driver to keep patched.

9. Set a supervisor password, then write down what you changed

A firmware password stops an accidental reset, and stops anyone with physical access from quietly turning network boot back on. Set it, then store it somewhere you will still have in two years.

Then record the settings. A photo of each changed screen is enough. Two situations make this pay: a firmware update that resets everything to default, and a dead CMOS battery — a common event on the used thin clients that make such good cheap homelab hosts, where a flat coin cell silently reverts the box to “stay off after power loss”. If you are running one of those, keep this list with the Wyse 5070 notes and check the battery when the clock starts drifting.

Verifying the pass, from the OS

After the OS is installed, five commands confirm the firmware actually did what its menus claimed:

1. lscpu | grep -i virtual — expect VT-x under virtualization.
2. dmesg | grep -i -e DMAR -e IOMMU — expect IOMMU lines if VT-d is enabled.
3. ethtool <iface> | grep Wake-on — expect g.
4. powertop or cat /sys/devices/system/cpu/cpuidle/state*/name — expect deep C-states present, and the residency counters climbing on an idle box.
5. The wall meter, after ten minutes of idle. It is the only measurement that includes the board, the PSU brick and the drive.

Then do the physical test that nothing in software can fake: pull the power brick, wait thirty seconds, plug it back in, and see whether the box returns on its own.

TL;DR

• Power On after AC loss, and re-check it after every firmware update.
• Wake-on-LAN on, Deep Sleep off, then arm the NIC with ethtool and make that persistent.
• VT-x on always, VT-d on if the board offers it — you cannot enable either remotely later.
• UEFI only, CSM off, unused boot devices disabled to reclaim the boot timeout.
• Deepest C-state, ASPM on, then verify with a meter rather than trusting the label.
• JEDEC memory defaults, a quiet-but-real fan curve, radios off, supervisor password set.

Fifteen minutes in the firmware buys three years of a machine that comes back on its own, virtualizes properly, and idles where the review said it would. To sanity-check the box you are about to configure against the workload you actually plan to run, the mini PC picker and TCO calculator ranks candidates on five-year total cost rather than sticker price.

Related across the network

• Solar Panels for a Homelab: How Many Do You Need? — solarhomelabs.com