Did you manually update your Secure Boot Keys ?

garlin · Sep 21, 2025

This is "3. Enable the revocation." in the MS docs.

Code:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x80 /f
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

itsme1 · Sep 21, 2025

I read up to page 5, I'll continue later.
I'll wait a few months, it will be updated via Windows Update, according to what I read in the beginning of this thread.
I hope a BIOS update won't be required because it's possible that Dell, and more generally all OEMs, will abandon older computers that support Windows 11.

gunrunnerjohn · Sep 21, 2025

garlin said:
This is "3. Enable the revocation." in the MS docs.

Code:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x80 /f Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

That's it? Just add that key, start the task, and reboot?

Dumb question. If this somehow doesn't work, I can just disable Secure Boot and then fix things, right?

gunrunnerjohn · Sep 21, 2025

itsme1 said:
I read up to page 5, I'll continue later.
I'll wait a few months, it will be updated via Windows Update, according to what I read in the beginning of this thread.
I hope a BIOS update won't be required because it's possible that Dell, and more generally all OEMs, will abandon older computers that support Windows 11.

I'm guessing from reading the Microsoft blurb that a lot of machines will fall through the cracks if you don't manually do some updates.

garlin · Sep 21, 2025

The specific key value triggers an unique action from the task, in each step they have you set a different value.
You can always disable Secure Boot if your PC refuses to boot.

gunrunnerjohn · Sep 21, 2025

I guess I'll give it a shot, I'd like to have this behind me.

gunrunnerjohn · Sep 21, 2025

It looks like it added it correctly, but how do I add the Microsoft Windows Production PCA 2011 to the UEFI DBX list? I'm presuming I'd want to disallow that one as well.

itsme1 · Sep 21, 2025

gunrunnerjohn said:
I'm guessing from reading the Microsoft blurb that a lot of machines will fall through the cracks if you don't manually do some updates.

Okay, thanks. I'll do it if necessary. I want to wait until almost the last minute to be sure what to do manually.
Hopefully, Microsoft makes a simple tutorial, or that there's one in this thread or another.
I've read up to five pages, and apparently the two commands in the first post wouldn't be enough.

gunrunnerjohn · Sep 21, 2025

itsme1 said:
Okay, thanks. I'll do it if necessary. I want to wait until almost the last minute to be sure what to do manually.
Hopefully, Microsoft makes a simple tutorial, or that there's one in this thread or another.
I've read up to five pages, and apparently the two commands in the first post wouldn't be enough.

There have been many helpful posts on getting these keys updated, my main machine is now booting with Secure Boot enabled and using the 2023 certificates. Just have to do it to three other machines!

I used MOSBY to add the keys initially.

Scott · Sep 21, 2025

Both my systems are up to speed, as well as my bootable media.

Scott · Sep 21, 2025

gunrunnerjohn said:
It looks like it added it correctly, but how do I add the Microsoft Windows Production PCA 2011 to the UEFI DBX list? I'm presuming I'd want to disallow that one as well.

Exactly what @garlin posted above, from step 3 in the MS doc.

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

itsme1 · Sep 21, 2025

gunrunnerjohn said:
There have been many helpful posts on getting these keys updated, my main machine is now booting with Secure Boot enabled and using the 2023 certificates. Just have to do it to three other machines!

I used MOSBY to add the keys initially.

I'll check out MOSBY on GitHub if I'm not mistaken.
Before I do, I'll reread this post in this thread:

Act now: Secure Boot certificates expire in June 2026

Windows IT Pro Blog: Prepare for the first global large-scale certificate update to Secure Boot. The Microsoft certificates used in Secure Boot are the basis of trust for operating system security, and all will be expiring beginning June 2026. The way to automatically get timely updates to new...

www.elevenforum.com

Same BIOS as mine on a Dell laptop, there seem to be problems.

OldNavy · Sep 21, 2025

I tried the Mosby thing and got some error message so after a slight panic I've decided to wait until MS bring something out for numpties i can use.

gunrunnerjohn · Sep 21, 2025

Scott said:
Exactly what @garlin posted above, from step 3 in the MS doc.

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

View attachment 146106

I did that, it didn't add the Microsoft 2011 certificate to the DBX database.

Almighty1 · Sep 21, 2025

OldNavy said:
I tried the Mosby thing and got some error message so after a slight panic I've decided to wait until MS bring something outr for numpties i can use.

What error did you get in Mosby? Are you talking about the security violation error?

Almighty1 · Sep 21, 2025

gunrunnerjohn said:
I did that, it didn't add the Microsoft 2011 certificate to the DBX database.

I did it a few times, once with the old motherboard where the capacitor burn down and killed the motherboard and a few times with the replacement motherboard after I delete all the keys and reset the keys the past week and it always added it correctly, I just haven't done it yet after using Mosby.

You can also do it with Mosby by using the -x option:

Code:

Mosby -x

-x: Install the Microsoft update that invalidates Microsoft Windows Production PCA 2011. You should only use this if you know what you are doing, as you you may not be able to boot or reinstall Windows otherwise. You have been warned!

There is one certificate that's in the DB database you have to manually add in the BIOS after using Mosby as well. See my earlier post, it's the one with the word option ROM in it which is also one of the certificates most people don't have but in the spec.

According to Act now: Secure Boot certificates expire in June 2026 - Windows IT Pro Blog

There are 4 certificates in the Updated certificate column:

Mosby's author said he had plans to add Microsoft Option ROM UEFI CA 2023 in the next version of Mosby:

Security Violation on Dell XPS 15 9570 Notebook · Issue #6 · pbatard/Mosby

I am having the following problem with using Mosby on the Dell XPS 15 9570 Notebook In the UEFI BIOS, this is what I tried: Secured Mode Enabled which has two modes Audit and Deployed, I had on Aud...

github.com

starchase · Sep 21, 2025

I'll address the elephant in the room since I don't see any of these threads mention it, i.e., those of us who have unsupported Windows 11 systems, machines that are too old to have the manufacturer supply a BIOS fix. It looks like to me Microsoft's own fix will not work with our machines, and the fixes in these threads won't do anything for us either. Of course I may be missing something in these threads, which is why I agree with the comment about there being a dire need for a tutorial on elevenforums about how to fix Secure Boot come 2026. Though it may be too early in the process for a definitive tutorial. But I've given up following this with any hope of what it means for my unsupported systems except for switching to Secure Boot disabled, which, I should say, I'm not afraid of doing.

I should add, while I'm at it, that I went to the Mosby site on github and don't find any instructions on what to do with any, some, or all of the files listed there. Which is a tad perplexing since I read of those who've used Mosby with success!

I know I'm probably the only one who is this confused but I wanted to add my 2 cents.

Dirtyflash · Sep 21, 2025

starchase said:
I know I'm probably the only one who is this confused but I wanted to add my 2 cents.

No, you're not the only one, there's too many ongoing threads on the topic and no clear definitive process. It's all garbage in - garbage out posts.

Almighty1 · Sep 21, 2025

starchase said:
I'll address the elephant in the room since I don't see any of these threads mention it, i.e., those of us who have unsupported Windows 11 systems, machines that are too old to have the manufacturer supply a BIOS fix. It looks like to me Microsoft's own fix will not work with our machines, and the fixes in these threads won't do anything for us either. Of course I may be missing something in these threads, which is why I agree with the comment about there being a dire need for a tutorial on elevenforums about how to fix Secure Boot come 2026. Though it may be too early in the process for a definitive tutorial. But I've given up following this with any hope of what it means for my unsupported systems except for switching to Secure Boot disabled, which, I should say, I'm not afraid of doing.

I should add, while I'm at it, that I went to the Mosby site on github and don't find any instructions on what to do with any, some, or all of the files listed there. Which is a tad perplexing since I read of those who've used Mosby with success!

I know I'm probably the only one who is this confused but I wanted to add my 2 cents.

With Mosby, all you do is make the USB flash drive using Rufus.

And then you boot from the USB Flash Drive and then issue the command:

Code:

Mosby

and answer allow it to run.

If you get security violation, all you need to do is go into the BIOS and delete the PK (Platform Key) which is what Setup Mode really is and then do the above again.
then when it asks if you want to get back into the UEFI Bios at the end, answer N

Code:

Mosby -x

this adds the DBX part.

after that, you still need to manually add Microsoft Option ROM UEFI CA 2023 in the BIOS.

The other thing is I don't think Mosby does the bootmanager and SVN part which are steps 2 and 4 either so you have to do that manually:

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

starchase · Sep 21, 2025

"All you do is . . . . " Well, yeah. Mosby's instruction for Rufus is to click the arrow that's to the right of "Select" - but there is no down arrow. Copilot agreed with me that it wasn't there and made a suggestion that seemed incorrect for the most recent Rufus I was using. So, sorry to prolong the agony but I'll politely pass on all that work. :boom:

Did you manually update your Secure Boot Keys ?

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Similar threads