ASUS Machine winload.efi with CA 2011 Cert - Needs CA 2023 Cert - I think

My ongoing problem, this ASUS desktop won't boot when using updated USB Bootmedia, Media that boots OK on my 2 laptops. The cert showing on the ASUS Windows\System32\Boot]winload.efi shows the CA 2011 cert.

On the USB Media the EFI\Boot\bootx64.efi file has the CA 2023 cert. In the D:\EFI\Microsoft\Boot\ there is a bootmgfw.efi with the CA 2023 cert and a bootmgr.efi file with the CA 2011 cert.

The ASUS machine has just had Garlin's Updates (the latest revision) put on it but has yet to have the CA 2011 cert revoked.

And yet the only way I can get the Hasloe or Macrium Reflect rescue disks to boot on the ASUS is to clear all Secure Boot Keys.

Even though both rescue disks boot fine on my 2 laptops.

And the HP laptop C:\Windows\System32\Boot folder with the winload.efi has just the CA 2011 cert in that file! And I have revoked the CA 2011 cert on both laptops.

If the bottom line means I need to disable Secure Boot on the ASUS just to be able to use the rescue media I can live with that; it is no great effort to reapply Garlin's scripts to update to the CA 2023 certs.

But this is really annoying I can't figure out what is so different with the ASUS machine compared to the laptops.

1. The Secure Boot certs will restrict which boot files are allowed to boot, based on the boot file's signing cert.

2. If you have revoked CA 2011 (still optional for now), the boot manager is also restricted by the SVN (which a minimum version number).

After you have applied a recent Monthly Update, the SVN might have gone up (June 2026 for example to SVN 9.0), and older versions of the boot file found on system or USB drives will be blocked. You need to copy a newer version of the boot file in place.

3. If you have Virtualization Based Security (VBS) and use an optional SkuSiPolicy.p7b file for additional protection, it can block older versions of winload.efi from running (right during boot). The solution is to remove the SkuSiPolicy.p7b file, or find an updated WinPE/WinRE image which is compatible.

This means the boot.wim needs to be patched. You can't simply swap out the winload.efi file from somewhere else. When winload.efi has changed, it implies that other key Windows files should be updated at the same time. Therefore you want to find an updated boot.wim.

If you backup vendor has an outdated boot.wim (which hasn't been updated), then temporarily remove SkuSiPolicy.p7b from the EFI.


Now you should be able to boot the USB drive.

garlin said:

If you backup vendor has an outdated boot.wim (which hasn't been updated), then temporarily remove SkuSiPolicy.p7b from the EFI.

Code:

mountvol S: /s
del S:\EFI\Microsoft\Boot\SkuSiPolicy.p7b
mountvol S: /d

Now you should be able to boot the USB drive.

Click to expand...

I ran the code and the bottom line is that it WORKED!!! After a hiccup. The first boot to the USB I got caught up in a BIOS loop. After I got it to shut down, then cleared the Secure Boot certs and then ran your Update script w/ the -bootmedia and verbose flags, I rebooted to set the update then rebooted, Secure Boot enabled, with the Hasleo recovery USB and got into the recovery software! I wonder if this will work with the Macrium Reflect Rescue Disk. I'll have to give that a try. Thanks very much for your help . . . again!