Windows 11 25H2 (26200.8457)

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

BIOS Firmware
-------------
    LENOVO 20W6CT01WW
    Version: N34ET69W (1.69 )
    Date: 2025-11-26

Factory Default UEFI PK Cert
----------------------------
    Lenovo Ltd. PK CA 2012

UEFI PK Cert
------------
    Lenovo Ltd. PK CA 2012

Factory Default UEFI KEK Certs
------------------------------
    Microsoft Corporation KEK CA 2011
    Lenovo Ltd. KEK CA 2012
    Microsoft Corporation KEK 2K CA 2023

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Lenovo Ltd. KEK CA 2012
    Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    ThinkPad Product CA 2012
    Lenovo UEFI CA 2014
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    ThinkPad Product CA 2012
    Lenovo UEFI CA 2014
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
    Debian Secure Boot Signer
    Canonical Ltd. Secure Boot Signing
    EFI_CERT_SHA256_GUID Signatures: 430

UEFI DBX Certs
--------------
    Debian Secure Boot Signer
    Canonical Ltd. Secure Boot Signing
    Windows BootMgr SVN is MISSING.
    EFI_CERT_SHA256_GUID Signatures: 432

UEFI Variables
--------------
    SBAT (Linux only): sbat,1,2024010900 / shim,4 / grub,3 / grub.debian,4

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.322, SVN 8.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.


REQUIRED ACTION
===============

OPTION 1:  DO NOTHING AND WAIT.  Windows will apply the UEFI updates (PC has supported BIOS).

OPTION 2:  To install [UEFI CA 2023] certs WITHOUT REVOKING the [PCA 2011] cert, run the commands:

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x4800 /f
    powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"


OPTION 3:  To install [UEFI CA 2023] certs and REVOKE the [PCA 2011] cert, run the commands:

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x4a80 /f
    powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"