Recent content by garlin

Last time I played with the free Hasleo, their Secure Boot support looked good for knowing where to find the CA 2023 files. But I think they'll get tripped up by the SVN number, once everyone's done the CA 2011 revocation. In the post-revocation world, the Monthly Update can randomly bump the...

1. The Secure Boot certs will restrict which boot files are allowed to boot, based on the boot file's signing cert. 2. If you have revoked CA 2011 (still optional for now), the boot manager is also restricted by the SVN (which a minimum version number). After you have applied a recent...

You didn't follow the instructions correctly. 1. From diskpart, you assigned the 104 MB EFI volume to drive letter S. The volume is readable now from S: 2. From "mountvol S: /s", you asked Windows to re-assign S: to your active EFI volume. Don't use "mountvol /S" for the other volume...

Have you tried it with SkuSiPolicy unchecked?

Which SkuSiPolicy file did you delete? From the EFI volume on the first or second disk? If you made a second disk with its own EFI volume, that is a different copy of SkuSiPolicy than the first one. If you picked a specific boot manager or specific boot device, then the EFI volume that...

winload.efi error is because your SkuSiPolicy doesn't match what Windows Update was last applied. This is what I warned about. This setup can work, but you have to invest extra time to make sure you're updating everything. Windows is applying a layered defense, so a failure in one security...

"mountvol [letter] /S" will only mount the EFI volume used by the currently booted system drive. It doesn't mount the separate EFI volume on the other drive. @suatcini54 specifically mentioned he has two "standalone" drives. While you can find out the other EFI volume's GUID and pass that to...

There are two different types of default Windows apps. 1. Removable Windows apps can be uninstalled by the user. These apps can be re-installed from the Store, and are updated separately from the Monthly Updates. You can check for new versions of the app on the Store. 2. Non-removable...

You don't need to boot Linux. Boot from the working Windows. 1. From Disk Manager or diskpart, assign a temporary drive letter to the second disk's EFI volume. 2. Replace the boot manager. copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi S:\EFI\Boot\Microsoft\bootmgfw.efi

You mean Dave Plummer, the retired MS dev who wrote the original Task Manager? He's doing it for fun. Tech sites, on the other hand, are just spamming pretend "articles".

Disable Secure Boot, boot from the other disk, run the update script. You only have to do this when the boot manager changes. It's not every month, but the last times were October 2025, April 2026, June 2026.

The Secure Boot certs are written to the UEFI's NVRAM memory, they exist in the BIOS and outside of Windows. You can wipe the disk or replace the drive and the certs will stay the same. After the certs are applied once, the only way to delete them is from the BIOS menu, or using a highly...

If you have separate EFI volumes, and picked a different boot device in the UEFI boot list, then you have to check the other disk's SVN. Only the Secure Boot certs and the SVN is global across all the boot devices on the PC. Temporarily disable Secure Boot, boot from the other drive, run the...

It's assembly in the source code. No AI is vibe'ing that... They used Copilot for a code review (you can see it in the commit log).

Just beware: enabling SkuSiPolicy is more secure, but not always the best! If you're dual-booting Windows or creating Macrium drives, it might block the other instance from booting, if that device hasn't been updated yet. Secure Boot certs block the wrong Windows boot manager. SkuSiPolicy...