Did you manually update your Secure Boot Keys ?

RJARRRPCGP · Sep 8, 2025

FIREMEDIC2700 said:
om;y issue is that card is a ddr 5 and mine is ddr 3 .

That's the better VRAM. GDDR5 is not related to DDR5 system RAM. GDDR5 was from long before DDR5 came out. We're talking about the later-2010s!

DDR5=late-GDDR6-era and GDDR7 era.

Chronology-wise, it's like this:

GDDR5=When DDR4 started, pretty much.

And when a video card has GDDR5, and you have DDR3, that's perfectly OK. Because that's the RAM on the discrete graphics.

The numbers of VRAM generations don't align with system RAM generations.

DJNelson · Sep 8, 2025

Secure boot seems more like a backhanded way of creating a kill switch than a security measure. Just my opinion, but still glad I just got a new laptop and got rid of the dinosaur from 2010. (A Thinkpad with a 1st gen i7)

garlin · Sep 14, 2025

garlin said:
Run this PowerShell script as Admin:

Code:

powershell -nop -ep bypass -f Check_EFIBootFile.ps1

The script will report which CA certificates have been added to the DB & DBX lists, and which boot file you currently have installed for the system drive.

I've updated my check script with several changes:
1. Fixed a few bugs related to the correct path of EFI files
2. Added reporting for KEK certs
3. Replaced the registry check of AvailableUpdates with WindowsUEFICA2023Capable (which is more useful)
4. Added scanning of boot file and boot manager files on mounted DVD or USB drives with Windows install media

Code:

PS C:\Users\GARLIN\Downloads> .\Check_EFIBootFile.ps1
Secure Boot: OFF
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011

UEFI DBX Certs
--------------

EFI Files
---------
    Disk 0: Boot Manager [Production PCA 2011] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 0
        [Windows UEFI CA 2023] is not in UEFI DB.

Code:

PS C:\Users\GARLIN\Downloads> .\Check_EFIBootFile.ps1
Secure Boot: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011

EFI Files
---------
    Disk 0: Boot Manager [Windows UEFI CA 2023] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] is in UEFI DB, and Windows is starting from CA 2023 Boot Manager.

Bootable Media
--------------
    DVD D: "26200.5733"
        Boot File [Windows UEFI CA 2023] is ALLOWED.
        boot.wim:2    Boot Manager [Windows UEFI CA 2023] is PRESENT.
        install.wim:1 Boot Manager [Windows UEFI CA 2023] is PRESENT.

starchase · Sep 14, 2025

Here is my result from just now:

Code:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
                                                                                                                        Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows                                                                                                                                                       PS C:\WINDOWS\system32> cd c:\temp                                                                                      PS C:\temp> powershell -nop -ep bypass -f Check_EFIBootFile_ver_2.ps1
Secure Boot: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Windows UEFI CA 2023

UEFI DBX Certs
--------------

EFI Files
---------
    Disk 0: Boot Manager [Production PCA 2011] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 1
        [Windows UEFI CA 2023] is in UEFI DB.

Bootable Media
--------------
    USB D: "MACRIUMBOOT"
        Boot File [Production PCA 2011] is ALLOWED.

PS C:\temp>

garlin · Sep 14, 2025

Thanks. I forgot to mention the script reports if you've (optionally) suspended BitLocker for [N] reboots.
h/t to @hsehestedt

bikemanAMD · Sep 14, 2025

And Here is My Results

Code:

Secure Boot: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011

EFI Files
---------
    Disk 0: Boot Manager [Windows UEFI CA 2023] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] is in UEFI DB, and Windows is starting from CA 2023 Boot Manager.

RJARRRPCGP · Sep 14, 2025

Code:

PS C:\chkuefi> .\Check_EFIBootFile.ps1
Secure Boot: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Windows UEFI CA 2023

UEFI DBX Certs
--------------

EFI Files
---------
    Disk 0: Boot Manager [Production PCA 2011] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 1
        [Windows UEFI CA 2023] is in UEFI DB.
PS C:\chkuefi>

FIREMEDIC2700 · Sep 14, 2025

can some one tell me what this means and how do i fix it

secure Boot: OFF
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011

UEFI DBX Certs
--------------

EFI Files
---------
Disk 0: Boot Manager [Production PCA 2011] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 0
[Windows UEFI CA 2023] is not in UEFI DB.

garlin · Sep 14, 2025

bikemanAMD said:
And Here is My Results

@bikemanAMD is done with CA 2023 migrations. Congrats!

@starchase and @RJARRRPCGP are halfway thru the process. They've entrusted CA 2023, but haven't banned CA 2011. But this is exactly where MS expects most users to be.

Some users will receive a "Microsoft KEK 2K CA 2023" certificate from a recent BIOS update.

Some users won't, because their vendor has abandoned their PC or motherboard model. You can manually add the Microsoft CA 2023 KEK, but generally its better if your vendor provides it.

RJARRRPCGP · Sep 14, 2025

garlin said:
@starchase and @RJARRRPCGP are halfway thru the process. They've entrusted CA 2023, but haven't banned CA 2011. But this is exactly where MS expects most users to be.

I don't! Does this mean I'm toast?! I don't know where to go next, due to risk of running wrong script.

garlin · Sep 14, 2025

FIREMEDIC2700 said:
can some one tell me what this means and how do i fix it

You can try @Sheikh's batch script on GitHub. In most cases it should work, but if it doesn't nothing will be broken since you have Secure Boot disabled (no security enforcement of banned boot files).

Release Release v1.0.0 · Sheikh98-DEV/Microsoft-Secure-Boot-Keys-Updater-Script

garlin · Sep 14, 2025

RJARRRPCGP said:
I don't! Does this mean I'm toast?! I don't know where to go next, due to risk of running wrong script.

Give me about a day, I'll go figure out how to safely script this for your orphaned PC's.

RJARRRPCGP · Sep 14, 2025

garlin said:
Give me about a day, I'll go figure out how to safely script this for your orphaned PC's.

No 2023 KEK showing! I got a new BIOS update, too! In fact, updating the BIOS, also resulted in any 2023 key getting removed!

It showed "False" last night, after updating the BIOS. I added those commands again (at Microsoft web site) last night and it's now showing "True".

Looked at the batch file. No KEK being added. It doesn't look any different than the commands I already used days ago.

Feels almost like they think mine's a pre-Pinnacle Ridge! If that's the case, then they are as wrong as they can be!

I would expect this to happen on a B450 gen motherboard. Getting left out, even with a B550 motherboard!

FIREMEDIC2700 · Sep 14, 2025

garlin : that script did not do nothing. does secure boot have to be enabled to run the script. i know have the current bios installed its a old computer. i know hp and the motherboard mfgr are done with it
or is it time to set it the backyard and empty some 45 acp rounds from tustry MR glock into it for some long over due stress relief .

RJARRRPCGP · Sep 14, 2025

FIREMEDIC2700 said:
garlin : that script did not do nothing. does secure boot have to be enabled to run the script. i know have the current bios installed its a old computer. i know hp and the motherboard mfgr are done with it
or is it time to set it the backyard and empty some 45 acp rounds from tustry MR glock into it for some long over due stress relief .

Of course, they won't update diddly squat! Because it's a 4th-gen Core i system. Microsoft doesn't even support anything less than 8th-gen Intel.

DarkShadowMD · Sep 14, 2025

Code:

D:\Users\FerchogtX\Downloads>powershell -nop -ep bypass -f .\Check_EFIBootFile.ps1
Secure Boot: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Windows UEFI CA 2023

UEFI DBX Certs
--------------

EFI Files
---------
    Disk 0: Boot Manager [Production PCA 2011] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 1
        [Windows UEFI CA 2023] is in UEFI DB.

D:\Users\FerchogtX\Downloads>

Does this mean I'm good? I used the bat script posted few messages above mine...
Any other step I need to do? This is for my HP 15 eh3000la laptop...
Good thing is, that error 1796 about TPM is now gone from event viewer... but I dunno if this is good or not...

RJARRRPCGP · Sep 14, 2025

FerchogtX said:

Code:

D:\Users\FerchogtX\Downloads>powershell -nop -ep bypass -f .\Check_EFIBootFile.ps1
Secure Boot: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Windows UEFI CA 2023

UEFI DBX Certs
--------------

EFI Files
---------
    Disk 0: Boot Manager [Production PCA 2011] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 1
        [Windows UEFI CA 2023] is in UEFI DB.

D:\Users\FerchogtX\Downloads>

Does this mean I'm good? I used the bat script posted few messages above mine...
Any other step I need to do? This is for my HP 15 eh3000la laptop

It's the same as mine.

FIREMEDIC2700 · Sep 14, 2025

RJARRRPCGP said:
It's the same as mine.

i would assume all of yall are good since it shows installed .
however looks like a might have to stick a fork in mine and say its done lol.
only other option is to try it with secure boot enabled if that dont work i am u know what lol.
garlin seems to be really up to date with this .

bo elam · Sep 14, 2025

I like to run Garlin's script but I have a couple questions, perhaps someone can answer. Is Double clicking the script the way to run it? And question 2: Are the results auto generated into a text file that is created at the desktop, or how do I get them. Thank's.

Bo

garlin · Sep 14, 2025

Here's a PowerShell script for downloading & copying the Microsoft KEK CA 2023 (DER) certificate to your system drive's EFI partition. You could copy the same file to a mounted USB drive, but that's more of a hassle since the file is tiny (less than 2K).

After the script is successful, shutdown your PC and enter the BIOS setup screens.

Under Secure Boot, there should be a menu option to add KEK certificates. From the selection, browse the available filesystems. One of them should be your system drive's EFI partition. Under the path \EFI\Microsoft\Boot, find the "Microsoft Corporation KEK 2K CA 2023" certificate and add it.

Restart Windows, and you should see KEK CA 2023 reported now.

Code:

PS C:\Users\GARLIN\Downloads> .\CopyKEK2023_to_EFI.ps1
Successful copy of KEK CA 2023 cert to the EFI partition.

Shutdown Windows, and enter your BIOS's Secure Boot setup screen.
Browse the system drive's EFI partition.

Look under the "EFI\Microsoft\Boot" folder, and select "Microsoft Corporation KEK 2K CA 2023.der" cert.
Restart Windows.

PS C:\Users\GARLIN\Downloads>

Did you manually update your Secure Boot Keys ?

Well-known member

My Computers

Well-known member

My Computer

Well-known member

Attachments

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Peaceful Citizen

My Computers

Well-known member

My Computers

Well-known member

My Computer

Active member

My Computer

Well-known member

Attachments

My Computer

Similar threads