Did you manually update your Secure Boot Keys ?

garlin · Aug 1, 2025

Sheikh said:
Or just use the IoT Enterprise LTSC !

Are you condoning software piracy? Because LTSC isn't a legitimate option for 95% of the users on this forum.

RD Mercer · Aug 1, 2025

garlin said:
Are you condoning software piracy? Because LTSC isn't a legitimate option for 95% of the users on this forum.

You don't have to necessary pirate LTSC, if you know an IT person that works for a Hospital or Hospital system, you can get it that way. It may not be the correct legit way, but it's certainly not piracy.

garlin · Aug 1, 2025

RD Mercer said:
You don't have to necessary pirate LTSC, if you know an IT person that works for a Hospital or Hospital system, you can get it that way. It may not be the correct legit way, but it's certainly not piracy.

And you're asking said friend for licensing help, because that's the piracy part. Everyone dances around that aspect, but as a public forum (run by a MVP) you'd have to expect the mods to keep it clean.

RD Mercer · Aug 1, 2025

garlin said:
And you're asking said friend for licensing help, because that's the piracy part. Everyone dances around that aspect, but as a public forum (run by a MVP) you'd have to expect the mods to keep it clean.

Personally, I didn't ask anyone for any licensing help, blaming folks for these things are just as bad, on a forum (run by a MVP) you should keep your blaming clean.

pseymour · Aug 1, 2025

I believe garlin was using you as an impersonal pronoun, the same way that you did ("You don't have to necessary pirate LTSC, if you know an IT person that works for a Hospital or Hospital system, you can get it that way").

RD Mercer · Aug 1, 2025

pseymour said:
I believe garlin was using you as an impersonal pronoun, the same way that you did ("You don't have to necessary pirate LTSC, if you know an IT person that works for a Hospital or Hospital system, you can get it that way").

I understand, but if you buy, or given a computer from a hospital, or anyone for that matter, and the OS is tied to the OEM machine/hardware there is nothing illegal here. I'm guessing he probably wasn't thinking about this, or maybe just didn't know. Jumping to a conclusion, without knowing the details is what I had an issue with.

pseymour · Aug 1, 2025

Well I'm not sure about the legality of reselling OEM licenses; I've never looked into it. Just saying I don't think garlin meant you specifically; he was using it generically. I don't want to be in the position of defending garlin though; he still hates me for my excessive shilling for ProcMon. :winkt:

RD Mercer · Aug 1, 2025

pseymour said:
Well I'm not sure about the legality of reselling OEM licenses; I've never looked into it. Just saying I don't think garlin meant you specifically; he was using it generically. I don't want to be in the position of defending garlin though; he still hates me for my excessive shilling for ProcMon.

I'm not upset at him, I understand, we all can make mistakes, but IT people are "usually" not dumb, they normally know the legality of these things.

garlin · Aug 1, 2025

Let's remove the corner cases, a vast majority of non-IT users talking about LTSC or Enterprise will eventually realize they can't legitimately license the product. Purchasing LTSC from an OEM reseller its a grey area, if they're not a MS Partner.

My point is it's bad suggesting to everyday users, that they should switch to LTSC just to solve a different problem with Windows.

RD Mercer · Aug 1, 2025

garlin said:
Purchasing LTSC from an OEM reseller its a grey area, if they're not a MS Partner.

Not that I need to explain any further, but I will. I was given "not bought" 5 outdated machines from a hospital, that was being put to rest, these are machines were bought with this OS on them from the mfg. There is no grey area here, if so please can you link me to something regarding this?

garlin · Aug 1, 2025

Your situation is an unique case. Most people are not friends with someone disposing or transferring PC's with existing licenses. A more typically scenario is a hospital (or a large organization) sends their outdated PC's for PC recycling or to a reseller of refurbished PC's.

I'm not try to offend you, but pointing out this isn't the norm. And your first reply didn't explain you acquired an entire PC and not LTSC separately.

RD Mercer · Aug 1, 2025

garlin said:
Your situation is an unique case. Most people are not friends with someone disposing or transferring PC's with existing licenses. A more typically scenario is a hospital (or a large organization) sends their outdated PC's for PC recycling or to a reseller of refurbished PC's.

I'm not try to offend you, but pointing out this isn't the norm. And your first reply didn't explain you acquired an entire PC and not LTSC separately.

No problem, I'm not upset with you, and you're right, my case is a unique case, and I knew that. Yes, my first post was pretty vague, but I really had no idea it was going to bring down the house.

starchase · Aug 1, 2025

suatcini54 said:
In powershell console opened as administrator, you must run the following commands, one at a time:

Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot” -Name “AvailableUpdates” -Value 0x40

Start-ScheduledTask -TaskName “\Microsoft\Windows\PI\Secure-Boot-Update”

After you run the commands, you have to restart your PC twice for the update to take effect.

To check if the update is successful, you must run the following command in a powershell console with admin privileges:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’

I just followed these instruction which resulted in a False report. I did run both of the first 2 commands separately using Powershell in Administer mode then restarted twice as stated above, and ran the check command also in Administrator mode using Powershell.

My system in unsupported being an HP Spectre 360 13" from February 2016.. Windows 11 24H3 build 26100.4652 Secure Boot is enabled.

I noticed in the thread's supporting documentation a requirement seems to be for "Supported PCs." Is this why the instructions above didn't work for me?

AncientParadise · Aug 1, 2025

I will apply for the extra year of security updates to Windows 10, when the option has appeared in my Control Panel.

When that year has passed, I will attempt to install Windows 11, because people say Microsoft unofficially supports the version of my "TPM" (1.2).

I noticed that Windows 11 costs $139 USD, here:
https://www.microsoft.com/en-us/d/windows-11-home/dg7gmgf0krt0

That's cheaper than buying a new computer.

My current computer can play my favorite games smoothly, even very recent ones, so I would need to pay much more than $139 to buy an equal-or-better computer.

I wouldn't use an "LTSC" version of Windows 10 because it's illegal, and I am afraid of the possibility of a virus being in a thief's file. And even if that stolen file doesn't have a virus, Microsoft could discover that it is stolen and disable my copy, so buying Windows 11 is the only real answer.

Windows 11 - Wikipedia

"There also exists an official bypass method provided directly by Microsoft (whereas the installation itself remains unofficially supported)."

cheaterslick · Aug 1, 2025

garlin said:
W10 22H2 has the same changes provided in the current Monthly Update. The difference is retail W10 will enter End-of-Life in October, unless you've signed up for the ESU promotion with MS points. It's not clear if MS will force the revocation on W10 PC's with time running out.

Nope, I got the update for it right here:

July 8, 2025—KB5062554 (OS Builds 19044.6093 and 19045.6093) - Microsoft Support

support.microsoft.com

It took about 10 minutes to complete. End-of-life or no, they're still updating it.

I do plan to do ESR for both machines when it comes out.

uncyler825 · Aug 1, 2025

starchase said:
I just followed these instruction which resulted in a False report. I did run both of the first 2 commands separately using Powershell in Administer mode then restarted twice as stated above, and ran the check command also in Administrator mode using Powershell.

My system in unsupported being an HP Spectre 360 13" from February 2016.. Windows 11 24H3 build 26100.4652 Secure Boot is enabled.

I noticed in the thread's supporting documentation a requirement seems to be for "Supported PCs." Is this why the instructions above didn't work for me?

Have you checked the CA 2023 certificate? Check_EFIBootFile.ps1?

Any hardware with secure boot will support the new certificate.

antspants · Aug 1, 2025

This is what I did:

Open Powershell as Administrator
Run the following commands, one at a time:
- Click commands below to copy to the clipboard & paste into Powershell

Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot” -Name “AvailableUpdates” -Value 0x40

Start-ScheduledTask -TaskName “\Microsoft\Windows\PI\Secure-Boot-Update”

After you run the commands, you have to restart your PC twice for the update to take effect.
To check if the update is successful, openPowersherll as Administrator and run:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’

Ran the following:

Powershell:

powershell -nop -ep bypass -f "C:\TEMP\Check_EFIBootFileUpdated.ps1"

Returned result:

Powershell:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows

PS C:\Users\*****> powershell -nop -ep bypass -f "C:\TEMP\Check_EFIBootFileUpdated.ps1"
Secure Boot: ENABLED

EFI DB Certificates
-------------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Windows UEFI CA 2023

EFI KEK Certificates
--------------------
    Microsoft Corporation KEK CA 2011

EFI DBX Certificates
--------------------

AvailableUpdates: 0x0
---------------------
Mount the EFI partition to label X:
The directory is not empty.
Get-PfxCertificate : Command cannot find any of the specified files.
At C:\TEMP\Check_EFIBootFileUpdated.ps1:164 char:14
+     $null = (Get-PfxCertificate -FilePath $FileName).Issuer -match $C ...
+              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (:) [Get-PfxCertificate], FileNotFoundException
    + FullyQualifiedErrorId : GetPfxCertCommandNoneOfTheFilesFound,Microsoft.PowerShell.Commands.GetPfxCertificateComm
   and

Validate that X:\EFI\Microsoft\Boot\bootmgfw.efi file is signed by the Microsoft Corporation KEK CA 2011 certificate!
Unmount X: EFI partition!

EFI Files
---------
Boot Manager [Microsoft Corporation KEK CA 2011] on Disk  is banned.

PS C:\Users\*****>

And this is where I like to get technical; I have no idea what I am doing.

starchase · Aug 1, 2025

I don't haven't a file: Check_EFIBootFileUpdated.ps1 I have, though, installed Check_EFIBootFile.ps1 to check if Secure Boot is enabled and it is enabled.

starchase · Aug 1, 2025

uncyler825 said:
Have you checked the CA 2023 certificate? Check_EFIBootFile.ps1?

Any hardware with secure boot will support the new certificate.

Yes, it only shows the 2011 cert

Dwarfr66 · Aug 2, 2025

AncientParadise said:
I will apply for the extra year of security updates to Windows 10, when the option has appeared in my Control Panel.

When that year has passed, I will attempt to install Windows 11, because people say Microsoft unofficially supports the version of my "TPM" (1.2).

I noticed that Windows 11 costs $139 USD, here:
https://www.microsoft.com/en-us/d/windows-11-home/dg7gmgf0krt0

That's cheaper than buying a new computer.

My current computer can play my favorite games smoothly, even very recent ones, so I would need to pay much more than $139 to buy an equal-or-better computer.

I wouldn't use an "LTSC" version of Windows 10 because it's illegal, and I am afraid of the possibility of a virus being in a thief's file. And even if that stolen file doesn't have a virus, Microsoft could discover that it is stolen and disable my copy, so buying Windows 11 is the only real answer.

Windows 11 - Wikipedia

What? LTSC is NOT illegal, otherwise why would MS have it as a product?

Did you manually update your Secure Boot Keys ?

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computers

My Computers