Did you manually update your Secure Boot Keys ?

Yes i can manually put keys in but i can't seem to find the keys anywhere

1. Download the scripts from here, and run:
garlin's PowerShell scripts for updating Secure Boot CA 2023


2. A copy of the KEK CA 2023 cert file will be copied to the system drive's EFI volume. When adding the KEK key, browse for the folder "EFI\Certs". Under the folder, you should see the file.

3. After adding the key, restart Windows. Run the update script again.

4. If the update script successfully added new certs, run the check script and post the output:

paulhauth25 said:

Yes i can manually put keys in but i can't seem to find the keys anywhere

Click to expand...

The whole point of the @garlin supplied scripts!

It won't execute that bat command though I've tried that too. I can manually update them through the bios if I knew which file they were in on windows 11

EOSL Dell Inspiron 5559, BIOS 1.9.0 (final). After the 2023 db certs landed, BitLocker TPM protector failed with 0x80310002, PCR7 Binding Not Possible, Event 813 naming 'dbx', Event 1796 “BIOS did not correctly communicate with the TPM.”

Cause is not a dead TPM. This BIOS has a ~32 KiB TCG event log. Full db + current dbx overflows it. Firmware stops writing the log but keeps extending PCRs, so Windows cannot bind PCR 7.

Workaround that restored PCR 7,11: delete dbx in Expert Key Management. Do not clear the TPM. Windows servicing will try to put the full dbx back; HighConfidenceOptOut = 1 stopped that here.

Write-up and MeasuredBoot parser: GitHub - Sizzlechest/inspiron-5559-tcg-log-overflow: Dell Inspiron 5459/5559/5759 BIOS 1.9.0: ~32KiB TCG event log buffer silently truncates measured boot and breaks BitLocker PCR7

Same family: 5459 / 5559 / 5759. If anyone else on BIOS 1.9.0 can check dir C:\Windows\Logs\MeasuredBoot -Force and whether the newest log’s firmware portion dies right after db, that would confirm scope.