Recent content by garlin

Appears to be common with cheap Mini PC's. Secure Boot not enabled in new MiniPC - Win 11 setup without Secure Boot

Add -AutoSize to the end of ft (Format-Table), so PowerShell displays the entire line (instead of cutting it off). Get-ChildItem -Path "C:\" -Force -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.LinkType -ne $null -and $_.LinkType -ne "HardLink" } | ft FullName,Linktype,LinkTarget...

You're done.

You would have to check from the UEFI settings.

Strangely there's two different MS docs. The Enterprise version claims you can save one reboot, by combining two reboot steps into one (0x280 vs 0x200).

Does it have an option for BIOS factory reset?

@pseymour's point is the built-in Administrator can be renamed to something else.

Sounds like a BIOS issue. Check if your Mini PC has a BIOS update you can reflash with.

I think you have reboot at least once. AvailableUpdates is a reg value (with different specific flags) which informs Windows you want it to proceed. After Windows has done its thing, AvailableUpdates value should be change to 0x0.

You can now revoke the CA 2011 certs by running: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x280 /f Restart Windows.

Either way, if you're allowed to disable Secure Boot then Windows can still work. Of course, some work environments have a mandatory policy requiring Secure Boot at all times so that's why the advisory is being repeated in advance.

What happens when you run this command as Administrator? powershell -C "Get-SecureBootUEFI db" Whether SecureBoot is enabled or not, the UEFI settings for DB & DBX should be readable. Unless you got some weird BIOS problems. Does the same command work if you temporarily enabled Secure Boot?

If you're joining late, we've reviewed the main points in another thread. 1. MS intended to replace these certs in a normal Monthly Update last year, but some PC partners advised MS they had serious issues to fix before MS could automatically roll them out. 2. Therefore this is an early...

MS can't sign new boot files after October 2026 without everyone adding the CA 2023. So you might as well go through this process. New boot files are typically created to address recently discovered security holes.

Everyone who runs Windows has different feature or app requirements. Someone might never use a Windows feature, so they don't notice if specific services are disabled. Same thing for apps. The only universal rule for debloating is "don't get greedy". You're at the stage where you're rapidly...