Act now: Secure Boot certificates expire in June 2026

uncyler825 · Jul 30, 2025

When SVN mechanism is active. Even after replacing the bootmgr.efi with the new certificate, it still fails to pass the verification. In my test, in addition to checking ".\efi\boot\bootx64.efi", there is also the ".\bootmgr.efi" file in the root directory. And you need the correct bootmgr.efi to boot. This is why my WinPE always has security violations. I hate SVN!

uncyler825 · Jul 30, 2025

This is very strange. If I create an autounattend.xml file and put it in the ISO, will this be a security violation? Is there some hidden mechanism to verify this?

If SVN is disabled, it can be installed normally. Very weird.

gunrunnerjohn · Jul 31, 2025

uncyler825 said:
This is very strange. If I create an autounattend.xml file and put it in the ISO, will this be a security violation? Is there some hidden mechanism to verify this?

If SVN is disabled, it can be installed normally. Very weird.

I can't shake the feeling that this is still an unfinished story from Microsoft.

uncyler825 · Jul 31, 2025

I have been testing what is causing Windows to still install the old Boot Manager during installation. I think I have found the likely cause of this problem. Microsoft needs to update and improve the Windows Setup program to install the correct Boot Manager file according to the system certificate.

There is an issue with Windows Setup in Windows 11 24H2. If you use Modern Windows 11 Setup, Setup will incorrectly installing the old Boot Manager to causing a security violation.

https://i.meee.com.tw/BThVnhy.gif

Switching to Previous Windows 11 Setup works fine, and Setup can correctly install the new Boot Manager.

I used Windows Setup (Windows Installation Media) from Windows 10 22H2 19045.6159 to install the previous Windows 11 23H2, and it was able to correctly install the new Boot Manager. Because installing a previous Windows using Windows Setup of Windows 11 24H2 will cause an error.

uncyler825 · Aug 1, 2025

If I revoke the CA 2011 certificate. I don't need to disable Secure Boot during the installation process. Older versions of Windows 10 Setup can correctly install the new Boot Manager.

Useing Windows Setup (From the Installation Media with Windows 10 22H2 19045.6159) + Windows 11 23H2 22631.5699 install.wim

uncyler825 · Aug 1, 2025

If you revoke the CA 2011 certificate. And want to create an Installation Media that can correctly install the new Boot Manager. You can try the following steps:

1. Download Feature update to Windows 10, version 22H2 (19045.6159) amd64
2. Open ConvertConfig.ini and change UpdtBootFiles=0 to 1.
3. Start uup_download_windows.cmd.
4. Use ISO Edit tool to open ISO, And replace the install.wim(ISO:\sources\install.wim) file of Windows 11 you want to install.

uncyler825 · Aug 1, 2025

I recommend that users who have revoked CA 2011 certificates should use Previous Windows 11 Setup. Because Modern Windows 11 Setup has many bugs.

This is the Modern Windows 11 Setup installation log:

Code:

2025-08-02 05:46:06, Error                 MOUPG  CUnattendManager::Initialize(90): Result = 0x80070490[gle=0x00000002]
2025-08-02 05:46:06, Error                 MOUPG  CMoSetupOneSettingsHelperT<class CEmptyType>::InitializeSettings(324): Result = 0x80072EE7
2025-08-02 05:46:06, Error                 MOUPG  CSetupHost::InitializeOneSettings(1551): Result = 0x80072EE7
2025-08-02 05:46:06, Error                 MOUPG  SetupHost: OneSettings initialization failed: [0x80072EE7]
2025-08-02 05:46:06, Error                 MOUPG  CSetupManager::GetWuIdFromRegistry(12498): Result = 0x80070002
2025-08-02 05:46:12, Error                 MOUPG  CDlpActionProductKeyValidate::ReportDownlevelInstallChannel(3648): Result = 0x80070490
2025-08-02 05:46:12, Error                 MOUPG  ProductKey: Failed to report Host OS channel to telemetry.
2025-08-02 05:46:20, Error                 CONX   hwreqchk: ERROR,Windows::Compat::HardwareRequirements::HardwareRequirementSettings::IsMeteredConnection,29,Failed to get NetworkCostType assuming metered network [0x80040154].

2025-08-02 05:46:20, Error                 CONX   hwreqchk: ERROR,Windows::Compat::HardwareRequirements::HardwareRequirementSettings::GetSettingsFromEndpoint,244,Failed to retrieve Sqm DeviceId: [0x80070002].

2025-08-02 05:46:20, Error                 CONX   hwreqchk: ERROR,Windows::Compat::HardwareRequirements::HardwareRequirementSettings::GetSettings,94,Failed to get settings from endpoint [0x80070002].

2025-08-02 05:46:20, Error                 CONX   hwreqchk: ERROR,ProcessJson,606,Unable to GetSettings [0x80070002]

2025-08-02 05:46:20, Error                 CONX   hwreqchk: ERROR,Windows::Compat::HardwareRequirements::HardwareRequirementSettings::IsMeteredConnection,29,Failed to get NetworkCostType assuming metered network [0x80040154].

2025-08-02 05:46:20, Error                 CONX   hwreqchk: ERROR,Windows::Compat::HardwareRequirements::HardwareRequirementSettings::GetSettingsFromEndpoint,244,Failed to retrieve Sqm DeviceId: [0x80070002].

2025-08-02 05:46:20, Error                 CONX   hwreqchk: ERROR,Windows::Compat::HardwareRequirements::HardwareRequirementSettings::GetSettings,94,Failed to get settings from endpoint [0x80070002].

2025-08-02 05:46:20, Error                 CONX   hwreqchk: ERROR,ProcessJson,606,Unable to GetSettings [0x80070002]

2025-08-02 05:46:33, Error                 SP     CNewSystem::PreInitialize: FveCheckSuspendBitLockerOnUpgrade failed: 0x8031004a, assuming auto-unlock is not supported
2025-08-02 05:51:01, Error                 IBSLIB     BCD: Failed to add system store from file. File: \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD Status: c000000f[gle=0x00000002]
2025-08-02 05:51:01, Error                 SP         BFSVC: AddBootmgrLast and PreserveBootOrder options are ignored when custom volume is specified
2025-08-02 05:51:01, Error                 SP         BFSVC: AddBootmgrLast and PreserveBootOrder options are ignored when custom volume is specified

A critical error "BCD failed" occurs, which is also a security violation when using Modern Windows 11 Setup. This is because it cannot correctly apply the new Boot Manager.

Code:

2025-08-02 05:51:01, Info                  SP         The entry to add already exists with GUID {B8EB9745-6FA7-11F0-A2EA-F598F8CD221D}. We will recreate it keeping the same GUID.
2025-08-02 05:51:01, Info                  SP         CAddBootEntry::DoExecute: Default entry GUID: {B8EB9745-6FA7-11F0-A2EA-F598F8CD221D}
2025-08-02 05:51:01, Warning               SP         CAddBootEntry::DoExecute: BCD failed to retrieve current boot entry. Error: 0x00000002
2025-08-02 05:51:01, Info                  SP         CAddBootEntry::DoExecute: BCD will not be synced with firmware because this is not a new store.
2025-08-02 05:51:01, Info                  SP         Boot flags used: 0x00021148

Previous Windows 11 Setup worked fine without any issues. In the Previous Windows 11 Setup log, you can find a message indicating that the Boot Manager was successfully updated:

Code:

2025-08-02 05:58:17, Info       [0x060228] IBS    Callback_UpdateBootFiles:Successfully updated Windows boot files.
2025-08-02 05:58:17, Info                  IBSLIB ModifyBootEntriesLegacy: Not in first boot. No actions to perform. SetupPhase[2]
2025-08-02 05:58:17, Info                  IBSLIB ModifyBootEntriesBCD:Setup phase is [2]
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: BfsInitializeBcdStore flags(0x00000008) RetainElementData:n DelExistinObject:n
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: VolumePathName for F:\Windows is F:\
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: SystemRoot is \Windows
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: Opening template from \Device\HarddiskVolume7\Windows\System32\config\BCD-Template.
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: Reopening system store.
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: Creating General objects.
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: Creating Resume object.
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: Creating MemTest object.
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: Creating OsLoader object.
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: OsLoader identifier: {4df36efd-6fa8-11f0-ab3a-a0d474eab694}
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: Create BOOTMGR object RetainBootDefault:n
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: Setting {default} to {4df36efd-6fa8-11f0-ab3a-a0d474eab694}
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: Cleaning up debugger settings.
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: Cleaning up hypervisor settings.
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: Opening recovery store from \Device\HarddiskVolume5\EFI\Microsoft\Recovery\BCD
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: Creating new recovery store \Device\HarddiskVolume5\EFI\Microsoft\Recovery\BCD
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: Creating General objects.
2025-08-02 05:58:17, Info                  IBSLIB BFSVC: Create BOOTMGR object RetainBootDefault:y
2025-08-02 05:58:17, Info       [0x060215] IBS    CallBack_MungeBootEntries:Successfully modified boot entries
2025-08-02 05:58:17, Info       [0x06021f] IBS    Callback_UpdateBootCode: Current Setup phase 2
2025-08-02 05:58:17, Info       [0x060222] IBS    Callback_UpdateBootCode: Preparing drive 'D:\' to boot Windows (updating disk's MBR, volume's boot sector)
2025-08-02 05:58:17, Info       [0x060245] IBS    PrepareSystemToBootWindows: There's no need to update the boot record on this architecture.
2025-08-02 05:58:17, Info       [0x06412c] IBSLIB SetCheckpoint: Checkpoint("WinPEBootSectorRestoreCheckpoint") in progress...
2025-08-02 05:58:17, Info       [0x06412e] IBSLIB SetCheckpoint: Checkpoint "WinPEBootSectorRestoreCheckpoint" successfully set.
2025-08-02 05:58:17, Info                  IBS    Callback_UpdateBootCode:Successfully updated boot code.
2025-08-02 05:58:17, Info       [0x064226] IBSLIB RecordCurrentDrivePath: Recording drive path [F:] for well-known volume (ID = 5f117537-1560-4e1e-84ac-1031b9ab80cb)
2025-08-02 05:58:17, Info       [0x064226] IBSLIB RecordCurrentDrivePath: Recording drive path [D:] for well-known volume (ID = aca8262a-801b-49de-9346-9ede500344dc)
2025-08-02 05:58:17, Info       [0x060001] IBS    Callback_RecordDrivePaths:Successfully stamped the requested logical drives.
2025-08-02 05:58:17, Info       [0x090093] PANTHR WdsEnableExit called!  When group #82 is empty, execution will stop, and the queue will be saved.

Almighty1 · Aug 30, 2025

uncyler825 said:

I improved the Check_EFIBootFile.ps1 script.

And thanks to the original author who created this script:
DESCRIPTION
Original Author: Matthew Graeber (@mattifestation)
Modified By: Jeremiah Cox (@int0x6)
Modified By: Joel Roth (@nafai)
Additional Source: A basic "dbx" UEFI variable parser to dump blacklisted UEFI bootloader hashes
Additional Source: SplitDbxContent 1.0
License: BSD 3-Clause

Added KEK certificate.
Added Try {} catch {} to DB, KEK and DBX certificate detection.
Mount the EFI partition to verify the actual Windows Boot Manager certificate.

Modified 1:

Code:

try {
$db_Certs = @((Get-SecureBootUEFI db | Get-UefiDatabaseSignatures).SignatureList.SignatureData.Subject | where { $_ -match 'Microsoft' } | foreach { $null = $_ -match $CN_regex; $Matches[2] })
} catch {
$db_Certs = $false
}
if ( $db_Certs -eq $false) {
Print-Header 'EFI DB Certificates'
} else {
Print-Header 'EFI DB Certificates'
foreach ($Cert in $db_Certs) {
    "    {0}" -f $Cert
}
}

try {
$kek_Certs = @((Get-SecureBootUEFI kek | Get-UefiDatabaseSignatures).SignatureList.SignatureData.Subject | where { $_ -match 'Microsoft' } | foreach { $null = $_ -match $CN_regex; $Matches[2] })
} catch {
$kek_Certs = $false
}
if ( $kek_Certs -eq $false) {
Print-Header 'EFI KEK Certificates'
} else {
Print-Header 'EFI KEK Certificates'
foreach ($Cert in $kek_Certs) {
    "    {0}" -f $Cert
}
}

try {
$dbx_Certs = @((Get-SecureBootUEFI dbx | Get-UefiDatabaseSignatures).SignatureList.SignatureData.Subject | where { $_ -match 'Microsoft' } | foreach { $null = $_ -match $CN_regex; $Matches[2] })
} catch {
$dbx_Certs = $false
}
if ( $dbx_Certs -eq $false) {
Print-Header 'EFI DBX Certificates'
} else {
Print-Header 'EFI DBX Certificates'
foreach ($Cert in $dbx_Certs) {
    "    {0}" -f $Cert
}
}

Modified 2

Code:

Write-Host "Mount the EFI partition to label X:" -ForegroundColor Green
$command = 'mountvol X: /s'
Start-Process -FilePath "cmd.exe" -ArgumentList "/c $command" -NoNewWindow -Wait

$BootMgr_File = "X:\EFI\Microsoft\Boot\bootmgfw.efi"
$BootMgr_Cert = Get-PFXCert $BootMgr_File
Write-Host "Validate that $BootMgr_File file is signed by the $BootMgr_Cert certificate!" -ForegroundColor Green
Write-Host "Unmount X: EFI partition!" -ForegroundColor Green
$command = 'mountvol X: /d'
Start-Process -FilePath "cmd.exe" -ArgumentList "/c $command" -NoNewWindow -Wait

Code:

powershell -nop -ep bypass -f Check_EFIBootFileUpdated.ps1

This is what mines shows:

How do I get the:
1) Microsoft UEFI CA 2023 under DFI DB Certificates?
2) Microsoft Corporation KEK 2K CA 2023 under EFI KEK Certificates?

I'll try what's mentioned in the comment here:

Act now: Secure Boot certificates expire in June 2026

Windows IT Pro Blog: Prepare for the first global large-scale certificate update to Secure Boot. The Microsoft certificates used in Secure Boot are the basis of trust for operating system security, and all will be expiring beginning June 2026. The way to automatically get timely updates to new...

www.elevenforum.com

which has a link to:

Windows Secure Boot Key Creation and Management Guidance

learn.microsoft.com

Thanks!

Almighty1 · Aug 30, 2025

gunrunnerjohn said:
Question: What is this certificate?

View attachment 140907

I'm presuming that since I still only have this under EFI Files, that I should wait for Windows Update to update the boot partition?

Boot Manager [Microsoft Windows Production PCA 2011] on Disk is allowed.
View attachment 140908

According to Act now: Secure Boot certificates expire in June 2026 - Windows IT Pro Blog

garlin · Aug 30, 2025

In principle, your motherboard maker should have provided a recent UEFI update which pushed out the KEK 2023 keys.
Unless it's been abandoned as too old for updates.

Almighty1 · Aug 30, 2025

garlin said:
In principle, your motherboard maker should have provided a recent UEFI update which pushed out the KEK 2023 keys.
Unless it's been abandoned as too old for updates.

The Dell XPS 15 9570 notebook has been abandoned since the last BIOS update was in 2022 or 2021. The Dell Precision 5530 which shares the same motherboard and firmware is still current and the last BIOS update was in December 2024 which I had been using for last 2 weeks and of course, it does not have the KEK 2023 keys.

garlin · Aug 30, 2025

Almighty1 said:
The Dell XPS 15 9570 notebook has been abandoned since the last BIOS update was in 2022 or 2021. The Dell Precision 5530 which shares the same motherboard and firmware is still current and the last BIOS update was in December 2024 which I had been using for last 2 weeks and of course, it does not have the KEK 2023 keys.

You may have try @Akeo's Mosby.

Almighty1 · Aug 31, 2025

garlin said:
You may have try @Akeo's Mosby.

Mosby appears to be probably the only way to do it because I tried what @uncyler825 mentioned of using the .der files from secureboot_objects/PreSignedObjects at main · microsoft/secureboot_objects on my Dell XPS 15 9570 notebook and this is what it shows when trying the KEK and DB Amending:

It doesn't like the .der files as that's the response for each one. When I turned off Enable Custom Mode, it deleted the Windows UEFI CA 2023 certificate so the system will not boot unless Secure Mode is off.

My two identical Ventoy USB was not working for most things as other than Hiren's BootCD, everything including Macrium Reflect 8's Rescue Disk, DiskGenius Pro v6.0.1.1645 WinPE - English version, WinPE11_10_Sergei_Strelec_x64_2025.05.22_English.iso which are all under Ventoy as ISO files are BSOD's with a Kernel Security Check Failure during bootup.

I got Secure Boot working again by following How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support and did this:

Before, I fixed it by using EaseUS Partition Master's Boot Repair while in Sergei Strelec's WinPE ISO but since that won't boot, I decided to try the above instead.

which did allow the Secure Boot to work again:

Anyone know what files I need to replace and what tool to use to modify the ISO's?

I will be trying Mosby later today after I do a repair in-place install after building a Windows Beta ISO from UUPDump as I think some of the things on my system got corrupted one way or another a few months ago when the capacitor was causing the system to randomly power cycle anywhere from a few minutes to hours randomly for 2 months before the capacitor burned down as well as took some other component on the other side with it on the notebook motherboard and I had the motherboardreplaced with a i9-8950HK from the original i7-8750H. Will report back on my experience with Mosby. A question for @Akeo - can Mosby be used to sign a .efi file so it will work with Secure Boot as someone else told me to sign the .efi file with sbctl except I run all the Linux Live ISO's under Ventoy.

On my Dell, there is not Setup or User Mode but rather a Deployed and Audit mode. So hopefully I am correct that Audit=Setup and Deployed=User mode?

gtspeck · Sep 5, 2025

HP advised me not to manually update the certificate. They couldn't provide a date when it will be updated.

garlin · Sep 5, 2025

gtspeck said:
HP advised me not to manually update the certificate. They couldn't provide a date when it will be updated.

That sounds like a crap tech support answer. HP clearly understands the Oct. 2026 deadline is approaching.

They've had several years to prepare a new BIOS update, or should inform you that your PC is too old to be supported. If it's the latter, you can run with Secure Boot disabled. It's not ideal, but you continue to have a working Windows unless you want to play newer games that have anti-cheat software.

gtspeck · Sep 6, 2025

garlin said:
That sounds like a crap tech support answer. HP clearly understands the Oct. 2026 deadline is approaching.

They've had several years to prepare a new BIOS update, or should inform you that your PC is too old to be supported. If it's the latter, you can run with Secure Boot disabled. It's not ideal, but you continue to have a working Windows unless you want to play newer games that have anti-cheat software.

I agree! This is just another reason I will not by an HP product again.

gunrunnerjohn · Sep 6, 2025

In general, I've been happiest with building my own from parts. I get to select the capabilities of each part and match it to my requirements vs. accepting the configuration that some company thought was a good idea. Sadly, while the specifications of some of the major brands look great, when the reality of actually examining them in detail, you frequently find they cut corners to make maximum profit.

andyc56 · Sep 6, 2025

First-time poster here. I've been reading this thread with great interest and have learned a whole ton of stuff. I'm not an IT guy, but I hate doing things I don't understand. This thread has helped tremendously in my understanding. Thanks to everyone participating!

I wanted to share my experience with a home-built system having an MSI motherboard with secure boot enabled. I'm still on Win10, but will be switching to Win11 in a couple of weeks. I decided to try the changes in the MS articles linked in the first post of this thread. I used the Check_EFIBootFileUpdated.ps1 script uploaded in an earlier post of this thread to make sure the results were as expected.

I applied all the changes, including the 2011 certificate revocation via the EFI DBX. The Check_EFIBootFileUpdated.ps1 showed that the revocation had indeed taken place. Then I began to have second thoughts. I wondered if this revocation would cause my Macrium recovery USB stick to fail to boot in secure mode. I was almost sure it wouldn't boot in fact. Yet when I tried to boot it, there was no problem. "What's going on?" I thought. "Is this a bug in the MSI secure boot implementation?" Both my desktop machines have this same motherboard, but then I realized I could try it on my laptop, to which I had also applied the 2011 certificate revocations via the EFI DBX.

The Macrium recovery media would not boot in the laptop, instead giving me a security violation. This is exactly what I expected the revocation to do. So what's going on with the MSI motherboard? I double-checked to make sure secure boot was enabled, which it was. Meanwhile, my second thoughts about the revocation began to bother me. I wondered if I could "revoke the revocation" as it were.

So I went into the Secure Boot section of the MSI BIOS setup. "Secure Boot Mode" was set to "Standard", and all other options were disabled. I changed it from "Standard" to "Custom", which then enabled some other options, one of which allowed me to reset the DBX certificate data back to the default, which I did. Changing "Secure Boot Mode" to "Custom" also enabled a menu called "Secure Boot Preset". In this menu, there were two options: "Hardware/OS Compatibility" and "Maximum Security". The default was "Hardware/OS Compatibility", so I left that as-is.

I went back and re-ran the Check_EFIBootFileUpdated.ps1. It showed what I had hoped, that the 2011 certificate revocation was no longer shown in the EFI DBX section. But then I began to wonder about the "Secure Boot Preset" options "Hardware/OS Compatibility" and "Maximum Security", so I did some searching.

Holy moly. I found a couple of articles about questionable MSI Secure Boot BIOS implementations here and here. I looked in some other places too, and those sources said that the "Secure Boot Preset" option had to be set to "Maximum Security" for Secure Boot to work correctly. This option is not the default. So I went back and re-enabled the 2011 certificate revocations and verified them with Check_EFIBootFileUpdated.ps1. The 2011 certificates were revoked again.

Next, I went back into the BIOS and set the "Secure Boot Preset" option to "Maximum Security". Then I tried to boot the Macrium recovery media. Finally, it was rejected with a security violation, unlike before. This indicated to me that Secure Boot was doing what it was supposed to do, at least in this specific instance.

So the bottom line is this: with at least some machines (maybe all?) based on an MSI motherboard, you must go into the BIOS, change "Secure Boot Mode" from "Standard" to "Custom", then set "Secure Boot Preset" to "Maximum Security". Otherwise it won't actually implement the revocation of the 2011 certificates in the DBX.

Now that I feel comfortable dealing with all this crazy stuff and know how to get myself out of the woods if need be, I think I'll leave the 2011 certificate revocation in place in the DBX. I did try the fix to the Macrium recovery media that was described earlier in this thread. It worked just dandy, so thanks for that.

Edit: My motherboard is an MSI B450m Bazooka with the latest beta BIOS from MSI, dated 2024-08-09.

Almighty1 · Sep 11, 2025

KevTech said:
Now have the Windows UEFI CA 2023 on the boot media.
In the steps on MS site about checking the update.

mountvol s: /s
copy S:\EFI\Microsoft\Boot\bootmgfw.efi c:\bootmgfw_2023.efi

I then took that bootmgfw_2023.efi renamed it to bootx64.efi then replaced the bootx64.efi file on USB "drive:\efi\boot\bootx64.efi" with the updated file.
I can boot Macrium or Terabyte recovery media with secure boot on and the Windows Production PCA 2011 revoked.

View attachment 140476

Thanks for the pointer. I have a slightly different issue as the things I am booting are all .ISO files running under VenToy, what can I use to replace the file in a .ISO file?

Update: One can use PowerISO or any other ISO Image editor to replace the file.

Almighty1 · Sep 14, 2025

KevTech said:
Now have the Windows UEFI CA 2023 on the boot media.
In the steps on MS site about checking the update.

mountvol s: /s
copy S:\EFI\Microsoft\Boot\bootmgfw.efi c:\bootmgfw_2023.efi

I then took that bootmgfw_2023.efi renamed it to bootx64.efi then replaced the bootx64.efi file on USB "drive:\efi\boot\bootx64.efi" with the updated file.
I can boot Macrium or Terabyte recovery media with secure boot on and the Windows Production PCA 2011 revoked.

View attachment 140476

I gave this a test try on the VenToy USB by replacing the bootx64.efi for VenToy itself and this is what it showed instead of VenToy booting:

Expiration date	Expiring certificate	Updated certificate	What it does	Storing location
June 2026	Microsoft Corporation KEK CA 2011	Microsoft Corporation KEK 2K CA 2023	Signs updates to DB and DBX	KEK
June 2026	Microsoft Corporation UEFI CA 2011 (or third-party UEFI CA)*	a) Microsoft Corporation UEFI CA 2023 b) Microsoft Option ROM UEFI CA 2023	a) Signs third-party OS and hardware driver components b) Signs third-party option ROMs	DB
Oct 2026	Microsoft Windows Production PCA 2011	Windows UEFI CA 2023	Signs the Windows bootloader and boot components	DB

Act now: Secure Boot certificates expire in June 2026

Recap: Why Secure Boot requires updating​

The change: Expiring certificates​

The impact and implications​

Take action today​

Enterprise IT-managed systems that send diagnostic data​

Enterprise IT-managed systems that don't send diagnostic data​

Systems with Secure Boot disabled​

Change management considerations​

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

Recap: Why Secure Boot requires updating

The change: Expiring certificates

The impact and implications

Take action today

Enterprise IT-managed systems that send diagnostic data

Enterprise IT-managed systems that don't send diagnostic data

Systems with Secure Boot disabled

Change management considerations

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer