A common method of injecting viruses into systems is via the boot sector of the system drive. While it is impossible to protect it completely, enabling this option will prevent the most common methods for injection from being used. When the parameter is set to "Normal", no protection is enabled. Since the boot sector must be written during the installation of an operating system (O/S - Windows, Linux, etc.; in order to support booting to this O/S), you must have this parameter set to "Normal" during the installation process. Once installation is complete, you can set this parameter to "Write Protect" to enable this protection. It is a very good practice to do so.
Hope this helps,
Quick follow up questions:
1. Does service packs installations also requires setting this to Normal again?
Or the only scenario this need to be set to normal is the initial OS installation for the hard-drive ?
2. How do this effects other fixed disks on the system? say in a scenario which i add a new M2 drive and need to format it?