Recent content by hottroc

Ah thanks for the clarification (and to DirtyFlash too). I deliberately did not want to revoke anything in case it blocked something from working (unless it was the cause of the problem itself). So do you have any suggestion on the "somewhere else" or would it be better to ask in a different topic?

Sorry that went over my head a little. So please just tell me what I should do? Or nothing? And would this be any factor in my boot problems? Thank you for your help btw, really appreciate your efforts.

Thanks for the suggestion. I followed your instruction and deleted the SkuSiPolicy file that was present but it made no difference, still won't boot with both Secure Boot and Virtualisation enabled. I've added the file back now by copying it from C:\Windows\System32\SecureBootUpdates. Any other...

Thanks for the reply and sorry for the delay, I've been away from home. Unfortunately that suggestion made little difference. HOWEVER I have discovered that I CAN boot with boot mode set to "UEFI boot" and hence Secure Boot enabled.... providing "Intel (VMX) Virtualization Technology" is...

Thank you for your suggestion. I have tried reflashing the BIOS and unfortunately it made no difference. This might be a BIOS bug? I have emailed Asus support but no reply so far, possibly because they no longer support this model of motherboard.

Please see the result below after running the update script and manually loading the PK per instructions. However note that Secure Boot is Disabled. If I enable it I get the boot failure. .\check_UEFI-CA2023.ps1 -Verbose -audit Windows 11 25H2 (26200.8457) Secure Boot: OFF (Audit Report runs...

So I had to clear the keys again in order to reboot. Setting boot mode to "Other OS" would also have worked but some advice seems to think that "Windows UEFI" mode without keys is very slightly more secure than "Other OS". I didn't load optimized defaults this time but as I said I tried that...

I have done that, but was unable to boot. I didn't manually update the KEK though.

Ah I see what you mean. I'll have a look and see what options there are for a factory reset. Note though I have already done a "Load Optimized Defaults" and also a full CMOS reset with the button battery removed for an hour before that.

I'm happy to try, but doesn't the ("AFTER") check script prove that the update has already been successful?

Thanks for your replies. Appreciate your time. I've attached the screenshots requested. I do have the option to Append in all but the PK key management. But I'm not sure if I need to do that. The check script seems to show that the keys were successfully installed, does it not? As for the BIOS...

Thanks. My bios is identical in appearance to the link you provided. Mine is a Z390E Gaming so maybe a little later but the bios looks the same. And from that link I can tell that my secure boot mode is "Customer" so SB should be ON, basically I have tried all those settings to turn on Secure...

Err, yes, I guess so. How? (The state is User automatically if Keys are present it seems. OS type in UEFI mode will not boot with keys. There is no Customer/Standard setting, Key Management is per your scripts and there is no separate SB on/off setting). (And also thank you so much for your...

But if I leave it in "Other OS" mode then Secure Boot is not enabled, which is the point of updating the keys. The BIOS is from early 2024, not mega old.

Sorry about the delay, I was away from home yesterday. So the only way to disable SB in my bios is to turn Boot Mode from "Windows UEFI" to "Other OS". So I did that and then ran the check script, then the update script, then added the PK per the readme, rebooted (still in "Other OS") then ran...