Recent content by t2s50

You wouldn't change the vbios of the iGPU by this procedure, it's an integrated part of the main firmware. It seems the only way to find out (and repair) is using a programmer like one of those https://www.aliexpress.com/w/wholesale-CH341.html Most firmware from these times can quite easily...

Well, the bootmgrfw.efi file is still the latest available for 'stock'- installations and you're text referes to EFI files and to this file directly. So the file isn't 'banned' itself but the environment isn't rigged yet to keep secure boot up to date since the KEK is missing. Since you compare...

That was the reason I attached the files, but there's no need, except for KEKUpdateCombined.bin (and BucketConfidenceData.cab) the files from May and April are identical.

OK, thanks. I did have a different understanding of "banned" since for a bootmanager to boot it has to be signed with a non revoked cert stored in DB, no more no less- if there aren't any other revocations installed. Thanks for the explanation, I do know that stuff, and it should work as you...

Thanks a lot, this version did run and write the logfile. Sorry for Samsung, don't know if there are many (and newer) firmware revisions with special signs from other vendors out there! (But the main question still is why I can only install two of three revocations after April 2026 MCUs? It...

No, that's not correct. It's supported, but the KEK isn't installed yet. As written this is the output exactly after recovering from an unsuccessfull revocation-update when secure boot no longer was possible. I did: 1) Disable secure boot in bios settings 2) Restore factory (2011-) secure boot...

Old laptop (Samsung NP300E5C, Phoenix P09RAP, HM75, Ivy Bridge) doesn't like the latest DBXUpdate2024.bin (together with latest DBXUpdateSVN.bin). All other updates can be installed. The older PCA2011 cert already was revoked and the SVN8(?) update was manually installed. Tried to reinstall the...

I'm sorry, but I don't understand what MS is doing here. There has to be a meaning that the *2024 files exist, and now there's the legacy 'line' of dbx updates in addition. What would be the meaning of a line with PCA2011 signed updates with latest SVNs? One would still need a non- expired KEK...

I don't think so, see registry after last reboot for april updates, 'Available updates' is on 0x4000, but there were some remarks [UploadedForCurrentBootCycle] [RestartRequiredForKeyRolling] [RestartRequiredForVSMBFSVCAI] [SBInstalledInCurrentBootCycle] "SBUpdateType"=dword:00000002 But even...

For older Powershell versions (5.1 on 2016 server and default on W10) Get-Volume_DevicePath seems not known: Otherwise I'm not completely sure if this is generally true, but the April updates updated the bootmanager to SVN 8 and updated the SVN binary in \securebootupdates to SVN 8 3 3 (and...

Thanks a lot! Should've checked myself, Sorry! But I think this might get you some additional questions? Seems that MS didn't update the minimal SVN / revoke SVN 7 for the boot manager in the latest update. How do you interpret the *Legacy.bin files in securebootupdates? DBXUpdateSVNLegacy...

Windows 10 ESU has now got the new Secure boot message, too:

I wonder a little bit why your script proposes to revoke the PCA2011 cert while it lists the PCA2011 already in the dbx? (Read the latest posts and didn't find that covered. Did I overlook something?)

Thank you! Changing line 1177 to $SystemDrive = (Get-CimInstance -ClassName Win32_OperatingSystem).SystemDrive worked for me. Now both PS versions (5.1. and 7.4.14) have the same output.

Just for your information: W10 ESU, Powershell 7.4.14 LTS gives a small error in the beginning and displays Bitlocker state of all drives (possibly since it can't determine the system drive): Powershell 7.4.14 LTS is installed parallely to the standard Powershell 5.1 where the script works...