Did you manually update your Secure Boot Keys ?


Secure boot etc is an abomination for anybody other than coprporate / office users and bog standard home users. Most people on these types of Forums like experimenting / testing things with their computers - in which case secure boot just gets in the way.

cheers
jimbo
 

My Computer

System One

  • OS
    Windows XP,11 Linux Fedora Rawhide pre-release 45
    Computer type
    PC/Desktop
    CPU
    2 X Intel i7
    Screen Resolution
    4KUHD X 2
I wish I had not gone ahead and revoked the Production PCA 2011 certificate. I now realize that any form of in-place repair will reinstall the older 2011-signed bootloader files into the EFI partition, and the system will not boot with Secure Boot enabled. So, if I have to do an in-place repair, I will have to disable Secure Boot first, and then the repair is complete, manually install copies of the 2023-signed bootloader into the EFI partition. This will all be fixed in June 2026. But in the meantime, I seem to have made my life more difficult. At least, I am protected from BlackLotus!
This shouldn't be a worry for long since Microsoft is planning to start revoking trust in 2011 boot files starting in January of '26 anyway, the "Enforcement Phase". When they start that it seems obvious they'd have a way to deal with those that are revoked.
How many people have screwed up their PCs following the above instructions? I'm waiting to see what is issued via Windows update.
Anyone with a reasonably late model device should check their motherboard mfr's support website for an updated BIOS. One dated August or later of this year is quite likely to have the 2023 certificates as defaults, which can make this almost completely irrelevant.

And none of these things are likely to completely screw up anybody's PC. Trust me, if they could be so easily screwed up I would have done it since I've made every mistake possible futzing about with this on my systems. As I've found, all they ever have to do is disable Secure Boot and they're back in Windows and functioning. And BTW, that's exactly where it will end up eventually if it happens to be one Microsoft has determined can't be updated automatically.

At any rate, most of the drama here revolves around the scripts used to report out contents of the secure boot variables in firmware and which don't make changes to firmware or Windows boot files. As far as I can tell, the Microsoft commands (registry adds and scheduled tasks) being used to do the actual updates are the same ones Microsoft will use to roll out updates automatically. Any system they have problems running on correctly, e.g., it's not getting an updated signed KEK because their system/motherboard OEM isn't furnishing one, is quite likely to be left running with SB disabled in the future anyway without some sort of intervention.
 
Last edited:

My Computers

System One System Two

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 5800X
    Motherboard
    Gigabyte B550M Aorus Pro
    Memory
    GSkill 3200, 2x8GB
    Graphics Card(s)
    MSI RX 6800 XT Gaming Z
    Sound Card
    on-board Realtek
    Monitor(s) Displays
    MSI 180hz
    Screen Resolution
    1440p
    Hard Drives
    Samsung 980 Pro, Samsung 870 Evo, generic PCIe NVME, WD 1TB 2.5" laptop spinner
    PSU
    Corsair RM 650
    Case
    mATX
    Cooling
    BeQuiet 240mm AIO and a bunch of case fans
    Keyboard
    one that clacks softly
    Mouse
    logitech
    Internet Speed
    bunches of bps
    Browser
    Firefox
    Antivirus
    Windows' own
  • Operating System
    Win11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 1700
    Motherboard
    GA-AB350M G-3
    Memory
    16GB DDR4
    Graphics card(s)
    RX-480
    Sound Card
    In-Built Realtek
    Monitor(s) Displays
    Samsung
    Screen Resolution
    1440p
    Hard Drives
    NVME/SSD's
    PSU
    Thermaltake BX1 550W
    Case
    Some junky thing
    Cooling
    ThermalTake Assassin(?)
    Browser
    FF/Edge
    Antivirus
    Whatever Windows does
    Other Info
    Secure Boot enabled updated to 2023 CA keys, TPM2.0 enabled with system drive Bitlocker'd.
I wish I had not gone ahead and revoked the Production PCA 2011 certificate. I now realize that any form of in-place repair will reinstall the older 2011-signed bootloader files into the EFI partition, and the system will not boot with Secure Boot enabled. So, if I have to do an in-place repair, I will have to disable Secure Boot first, and then the repair is complete, manually install copies of the 2023-signed bootloader into the EFI partition. This will all be fixed in June 2026. But in the meantime, I seem to have made my life more difficult. At least, I am protected from BlackLotus!

You just need to make your Windows 11 installation media bootable with CA 2023. Here's how:

Insert your Win 11 installation USB. Make note of the drive letter.

Execute the three commands from an elevated command prompt, one at a time.

Replace D with your USB drive letter.

COPY D:\EFI\MICROSOFT\BOOT\BCD D:\EFI\MICROSOFT\BOOT\BCD.BAK

bcdboot c:\windows /f UEFI /s D: /bootex

COPY D:\EFI\MICROSOFT\BOOT\BCD.BAK D:\EFI\MICROSOFT\BOOT\BCD

On the third command, say yes to replacing existing file. Now your drive is bootable.

Source

EDIT: See post #1265
 
Last edited:

My Computers

System One System Two

  • OS
    Win 11 Pro 25H2 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self Built
    CPU
    Intel® Core™ i7-14700K
    Motherboard
    ASUS TUF Z690-PLUS WIFI BIOS 4505 11/29/25
    Memory
    G.SKILL Ripjaws S5 Series 64GB (2 x 32GB) DDR5
    Graphics Card(s)
    ASUS GeForce RTX 4070 Super 12GB
    Sound Card
    Sound Blaster AE-5 Plus
    Monitor(s) Displays
    ASUS TUF Gaming 27" 2K HDR Gaming
    Screen Resolution
    2560 x 1440
    Hard Drives
    Samsung 990 Pro 1TB NVMe (Win 11 25H2)
    SK hynix P41 500GB NVMe 25H2 DEV/Games
    SK hynix P41 2TB NVMe (x3)
    Crucial P3 Plus 4TB
    PSU
    Corsair RM850x Shift
    Case
    Antec Dark Phantom DP502 FLUX
    Cooling
    Corsair Nautilus 360 RS AIO
    Keyboard
    Logitech MK 320
    Mouse
    Razer Basilisk V3
    Internet Speed
    350Mbs
    Browser
    Firefox
    Antivirus
    Winows Security
    Other Info
    MR 8.1 Home

    System 3 Specs
    Win 11 Pro 25H2 26200.8524
    ASUS PRIME Z370-P II BIOS 3004 7/12/21
    Intel Core i7-8700 CPU @ 3.20GHz
    32GB DDR4 RAM (4x8)
    iGPU Intel UHD Graphics 630
  • Operating System
    Win 11 Pro 25H2 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self Built
    CPU
    Intel Core i7-11700F
    Motherboard
    Asus TUF Gaming Z590 Plus WiFi (BIOS 2803)
    Memory
    64 GB DDR4
    Graphics card(s)
    MSI GeForce RTX 3060 Ventus 2X 12GB
    Sound Card
    SoundBlaster Audigy Fx V2
    Monitor(s) Displays
    Samsung F27T350
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 980 Pro 1TB
    Samsung 970 EVO Plus 2TB
    Samsung 870 EVO 500GB SSD
    PSU
    Corsair HX750
    Case
    Cougar MX330-G Window
    Cooling
    Thermalright Frozen Edge 240 Black AIO
    Internet Speed
    350Mbps
    Browser
    Firefox
    Antivirus
    Windows Security
You just need to make your Windows 11 installation media bootable with CA 2023. Here's how:

Insert your Win 11 installation USB. Make note of the drive letter.

Execute the three commands from an elevated command prompt, one at a time.

Replace D with your USB drive letter.

COPY D:\EFI\MICROSOFT\BOOT\BCD D:\EFI\MICROSOFT\BOOT\BCD.BAK

bcdboot c:\windows /f UEFI /s D: /bootex

COPY D:\EFI\MICROSOFT\BOOT\BCD.BAK D:\EFI\MICROSOFT\BOOT\BCD

On the third command, say yes to replacing existing file. Now your drive is bootable.

Source
The issue is not about making the installation drive bootable. The issue is that a new or repaired installation will have bootloaders that are signed with a revoked certificate, and Secure Boot will prevent the new installation (or repaired installation) from booting. The default bootloaders are still the old ones. This will be the case for some months.
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    iBUYPOWER
    CPU
    Intel i9-13900KF
    Motherboard
    ASUS ROG Maximus Z790 Hero
    Memory
    32 GB Corsair Vengeance DDR5-6000 MHz
    Graphics Card(s)
    ASUS Dual GeForce RTX 4070
    Sound Card
    none
    Monitor(s) Displays
    Dell U2412M
    Screen Resolution
    1920 x 1200
    Hard Drives
    WD Black SN850X NVMe SSD - 1 TB
    PSU
    Thermaltake Toughpower GF3 1000W
    Case
    Fractal Design Meshify 2 RGB
    Cooling
    Corsair H150i RGB Elite
    Keyboard
    Deck Hassium Pro
    Mouse
    Logitech MX Master 4
    Internet Speed
    1500 Mbps download, 40 Mbps upload
    Browser
    Firefox
    Antivirus
    Bitdefender Internet Security
The issue is that a new or repaired installation will have bootloaders that are signed with a revoked certificate

I'm sorry, I should have elaborated more clearly. The above procedure I posted replaces the revoked certificate with the
new certificate, so it will install (or repair) Windows with the new certificate and update the bootloader accordingly.

1761718403987.webp
 

My Computers

System One System Two

  • OS
    Win 11 Pro 25H2 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self Built
    CPU
    Intel® Core™ i7-14700K
    Motherboard
    ASUS TUF Z690-PLUS WIFI BIOS 4505 11/29/25
    Memory
    G.SKILL Ripjaws S5 Series 64GB (2 x 32GB) DDR5
    Graphics Card(s)
    ASUS GeForce RTX 4070 Super 12GB
    Sound Card
    Sound Blaster AE-5 Plus
    Monitor(s) Displays
    ASUS TUF Gaming 27" 2K HDR Gaming
    Screen Resolution
    2560 x 1440
    Hard Drives
    Samsung 990 Pro 1TB NVMe (Win 11 25H2)
    SK hynix P41 500GB NVMe 25H2 DEV/Games
    SK hynix P41 2TB NVMe (x3)
    Crucial P3 Plus 4TB
    PSU
    Corsair RM850x Shift
    Case
    Antec Dark Phantom DP502 FLUX
    Cooling
    Corsair Nautilus 360 RS AIO
    Keyboard
    Logitech MK 320
    Mouse
    Razer Basilisk V3
    Internet Speed
    350Mbs
    Browser
    Firefox
    Antivirus
    Winows Security
    Other Info
    MR 8.1 Home

    System 3 Specs
    Win 11 Pro 25H2 26200.8524
    ASUS PRIME Z370-P II BIOS 3004 7/12/21
    Intel Core i7-8700 CPU @ 3.20GHz
    32GB DDR4 RAM (4x8)
    iGPU Intel UHD Graphics 630
  • Operating System
    Win 11 Pro 25H2 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self Built
    CPU
    Intel Core i7-11700F
    Motherboard
    Asus TUF Gaming Z590 Plus WiFi (BIOS 2803)
    Memory
    64 GB DDR4
    Graphics card(s)
    MSI GeForce RTX 3060 Ventus 2X 12GB
    Sound Card
    SoundBlaster Audigy Fx V2
    Monitor(s) Displays
    Samsung F27T350
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 980 Pro 1TB
    Samsung 970 EVO Plus 2TB
    Samsung 870 EVO 500GB SSD
    PSU
    Corsair HX750
    Case
    Cougar MX330-G Window
    Cooling
    Thermalright Frozen Edge 240 Black AIO
    Internet Speed
    350Mbps
    Browser
    Firefox
    Antivirus
    Windows Security
You just need to make your Windows 11 installation media bootable with CA 2023. Here's how:

Insert your Win 11 installation USB. Make note of the drive letter.

Execute the three commands from an elevated command prompt, one at a time.

Replace D with your USB drive letter.

COPY D:\EFI\MICROSOFT\BOOT\BCD D:\EFI\MICROSOFT\BOOT\BCD.BAK

bcdboot c:\windows /f UEFI /s D: /bootex

COPY D:\EFI\MICROSOFT\BOOT\BCD.BAK D:\EFI\MICROSOFT\BOOT\BCD

On the third command, say yes to replacing existing file. Now your drive is bootable.

Source
You can make Windows 11 installation media bootable with CA 2023 using latest Rufus 4.11 also.

Manu
 

My Computers

System One System Two

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom Made
    CPU
    Intel 14100
    Motherboard
    Gigabyte B760M D2H
    Memory
    G.Skill Trident Z5 Neo RGB 32GB (2x16GB) DDR5 6000
    Graphics Card(s)
    Integrated
    Sound Card
    Built-in
    Monitor(s) Displays
    40Inch Blaupunkt 1920X1080 & Acer 24Inch 1920X1080
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung 990Pro 1TB &
    Western Digital WD Black SN850X NVMe 1TB
    PSU
    550W Corsair
    Case
    Chiptronix
    Cooling
    Default
    Keyboard
    Logitech Wireless
    Mouse
    Logitech Wireless
    Internet Speed
    500Mbps
    Browser
    Brave
    Antivirus
    Kaspersky Premium
  • Operating System
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom Built
    CPU
    Intel G7600
    Motherboard
    Asus PRIME-H610M-E-D4
    Memory
    16GB Corsair Vengeance
    Graphics card(s)
    Integrated
    Sound Card
    In Built
    Monitor(s) Displays
    Samsung 22Inch
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung Evo 970 Pro 500GB
    PSU
    CoolerMaster 450W
    Case
    Normal
    Cooling
    Default
    Keyboard
    Logitech Wireless
    Mouse
    Logitech Wireless
    Internet Speed
    500Mbps
    Browser
    Brave
    Antivirus
    Kaspersky Total Security
It means the "Windows UEFI CA 2023" cert is updated. That's one of the four certs needed to replace those expiring in 2026.

Look back for a post by @Scott, #1104, for two commands that update all four and as well installs 2023 signed boot files. Once successfully completed it also resolves the ID 1801 error.

Or just wait and let Microsoft run the update for you according to the schedule they've put your system on.
Thanks!
I ran these commands from that post.
So, basically as long as I do not update my BIOS (effectively resetting CMOS to factory), then I should in theory be good?
 

My Computer

System One

  • OS
    Win 11 23H2 Enterprise
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self-Built
    CPU
    Ryzen 9800X3D
    Motherboard
    MSI MAG X870 Tomahawk WiFi
    Memory
    G.Skill Trident Z RGB 6200MT CL30
    Graphics Card(s)
    MSI RTX 5090 Suprim SoC
    Sound Card
    Sound Blaster G8
    Monitor(s) Displays
    LG C2 42 Main Desktop, 3x Gigabyte FI32Q in a triple array for gaming simulations
    Screen Resolution
    3840x2160, 2560x1440 (3)
    Hard Drives
    WD SN850X 2TB M.2 NVME (OS Drive), WD SN850X 2TB M.2 NVME, 2x Crucial 2TB SSD, Crucial 1TB SSD, Seagate Barracuda 2TB HDD
    PSU
    NZXT C1200 Gold ATX 3.1-Fully Modular/Low-Noise-1200 Watts-12V-2x6 Connector-Zero Fan Mode-100% Japanese Capacitors
    Case
    NZXT H7
    Cooling
    EK AIO Elite 360mm Elite
    Keyboard
    Razer Huntsman V3 Pro
    Mouse
    Logitech G502X
    Internet Speed
    1GB
    Browser
    Edge Chromium
    Antivirus
    Windows Defender
as long as I do not update my BIOS (effectively resetting CMOS to factory), then I should in theory be good
I think that depends on your particular BIOS behavior, it did when I tested it on my MoBo but some others have said it didn't on theirs. It's probably a good idea to assume it will though, at least for the first time, to be ready for it.

If it does ever get reset to default keys and Windows doesn't fix itt itself then boot up with Secure Boot disabled and re-run to two commands to re-install the certs and your back in business. But hopefully Microsoft will do this for us.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 5800X
    Motherboard
    Gigabyte B550M Aorus Pro
    Memory
    GSkill 3200, 2x8GB
    Graphics Card(s)
    MSI RX 6800 XT Gaming Z
    Sound Card
    on-board Realtek
    Monitor(s) Displays
    MSI 180hz
    Screen Resolution
    1440p
    Hard Drives
    Samsung 980 Pro, Samsung 870 Evo, generic PCIe NVME, WD 1TB 2.5" laptop spinner
    PSU
    Corsair RM 650
    Case
    mATX
    Cooling
    BeQuiet 240mm AIO and a bunch of case fans
    Keyboard
    one that clacks softly
    Mouse
    logitech
    Internet Speed
    bunches of bps
    Browser
    Firefox
    Antivirus
    Windows' own
  • Operating System
    Win11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 1700
    Motherboard
    GA-AB350M G-3
    Memory
    16GB DDR4
    Graphics card(s)
    RX-480
    Sound Card
    In-Built Realtek
    Monitor(s) Displays
    Samsung
    Screen Resolution
    1440p
    Hard Drives
    NVME/SSD's
    PSU
    Thermaltake BX1 550W
    Case
    Some junky thing
    Cooling
    ThermalTake Assassin(?)
    Browser
    FF/Edge
    Antivirus
    Whatever Windows does
    Other Info
    Secure Boot enabled updated to 2023 CA keys, TPM2.0 enabled with system drive Bitlocker'd.
You can make Windows 11 installation media bootable with CA 2023 using latest Rufus 4.11 also.

Manu
I just looked into this, and wanted to create a bootable USB Win 11 installation of the latest Win 11 23H2 Enterprise build I got from UUP Dump.
I have successfully updated this PC (target machine I am creating the bootable drive on) with the CA 2023 certificates using the guide @Scott provided, verifying with the 'True' results.

I have the latest Rufus 4.11p (portable), and I let it grab whatever updates it needed to get when it first opened.
Supposedly, this latest Rufus update should add the last option just before creating the bootable ISO to include the latest CA 2023 certificates, however it does not?

1761750467760.webp

I'm guessing this is because the ISO I'm using has the outdated CA 2011 certificates (as per the pop-up just before creating), so how would I be able to use Rufus to build a bootable ISO according to your assertions?
Perhaps this only works for building a 25H2 ISO that already has the updates certificates built into the ISO?Otherwise, I would have to use the method described by @Scott to change these files before using Rufus?
 

My Computer

System One

  • OS
    Win 11 23H2 Enterprise
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self-Built
    CPU
    Ryzen 9800X3D
    Motherboard
    MSI MAG X870 Tomahawk WiFi
    Memory
    G.Skill Trident Z RGB 6200MT CL30
    Graphics Card(s)
    MSI RTX 5090 Suprim SoC
    Sound Card
    Sound Blaster G8
    Monitor(s) Displays
    LG C2 42 Main Desktop, 3x Gigabyte FI32Q in a triple array for gaming simulations
    Screen Resolution
    3840x2160, 2560x1440 (3)
    Hard Drives
    WD SN850X 2TB M.2 NVME (OS Drive), WD SN850X 2TB M.2 NVME, 2x Crucial 2TB SSD, Crucial 1TB SSD, Seagate Barracuda 2TB HDD
    PSU
    NZXT C1200 Gold ATX 3.1-Fully Modular/Low-Noise-1200 Watts-12V-2x6 Connector-Zero Fan Mode-100% Japanese Capacitors
    Case
    NZXT H7
    Cooling
    EK AIO Elite 360mm Elite
    Keyboard
    Razer Huntsman V3 Pro
    Mouse
    Logitech G502X
    Internet Speed
    1GB
    Browser
    Edge Chromium
    Antivirus
    Windows Defender
The issue is not about making the installation drive bootable. The issue is that a new or repaired installation will have bootloaders that are signed with a revoked certificate, and Secure Boot will prevent the new installation (or repaired installation) from booting. The default bootloaders are still the old ones. This will be the case for some months.
Shouldn't this work exactly the same for a mounted ISO?
I tried running an elevated command prompt changing the 'D' to the mounted drive letter I have 'L' and got access denied on the first command.
I then tried from an elevated terminal opened within the mounted ISO and got pretty much the same (below).
Any ideas? This is the latest UUPDUMP of Win 1123H2 Enterprise that I intend to use all the way through Nov 2026 since I'm perfectly happy with 23H2, want to skip the 24H2 dumpster fire and 'hope' in a year that 25H2 is actually decent!

1761751479524.webp
 

My Computer

System One

  • OS
    Win 11 23H2 Enterprise
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self-Built
    CPU
    Ryzen 9800X3D
    Motherboard
    MSI MAG X870 Tomahawk WiFi
    Memory
    G.Skill Trident Z RGB 6200MT CL30
    Graphics Card(s)
    MSI RTX 5090 Suprim SoC
    Sound Card
    Sound Blaster G8
    Monitor(s) Displays
    LG C2 42 Main Desktop, 3x Gigabyte FI32Q in a triple array for gaming simulations
    Screen Resolution
    3840x2160, 2560x1440 (3)
    Hard Drives
    WD SN850X 2TB M.2 NVME (OS Drive), WD SN850X 2TB M.2 NVME, 2x Crucial 2TB SSD, Crucial 1TB SSD, Seagate Barracuda 2TB HDD
    PSU
    NZXT C1200 Gold ATX 3.1-Fully Modular/Low-Noise-1200 Watts-12V-2x6 Connector-Zero Fan Mode-100% Japanese Capacitors
    Case
    NZXT H7
    Cooling
    EK AIO Elite 360mm Elite
    Keyboard
    Razer Huntsman V3 Pro
    Mouse
    Logitech G502X
    Internet Speed
    1GB
    Browser
    Edge Chromium
    Antivirus
    Windows Defender
I wish I had not gone ahead and revoked the Production PCA 2011 certificate. I now realize that any form of in-place repair will reinstall the older 2011-signed bootloader files into the EFI partition, and the system will not boot with Secure Boot enabled. So, if I have to do an in-place repair, I will have to disable Secure Boot first, and then the repair is complete, manually install copies of the 2023-signed bootloader into the EFI partition. This will all be fixed in June 2026. But in the meantime, I seem to have made my life more difficult. At least, I am protected from BlackLotus!
I have done two in-place reinstalls to correct errant update issues, and my system is still booting fine with Secure Boot and the 2011 cert revoked.
 

My Computers

System One System Two

  • OS
    Win 11 Pro 25H2, Build 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Brew
    CPU
    Intel Core i5 14500
    Motherboard
    Gigabyte B760M G P WIFI
    Memory
    64GB DDR4
    Graphics Card(s)
    GeForce RTX 4060
    Sound Card
    Chipset Realtek
    Monitor(s) Displays
    LG 45" Ultragear, Acer 24" 1080p
    Screen Resolution
    5120x1440, 1920x1080
    Hard Drives
    Crucial P310 2TB 2280 PCIe Gen4 3D NAND NVMe M.2 SSD (O/S)
    Silicon Power 2TB US75 NVMe PCIe Gen4 M.2 2280 SSD (backup)
    Crucial BX500 2TB 3D NAND (2nd backup)
    Seagate 4TB Ironwolf, rotating HDD archive files
    External off-line backup Drives: 2 NVMe 4TB drives in external enclosures
    PSU
    Thermaltake Toughpower GF3 750W
    Case
    LIAN LI LANCOOL 216 E-ATX PC Case
    Cooling
    Lots of fans!
    Keyboard
    Microsoft Comfort Curve 2000
    Mouse
    Logitech G305
    Internet Speed
    Verizon FiOS 1GB
    Browser
    Firefox
    Antivirus
    Malware Bytes & Windows Defender Security
  • Operating System
    Win 11 Pro 25H2, Build 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Brew
    CPU
    Intel Core i5 14400
    Motherboard
    Gigabyte B760M DS3H AX
    Memory
    32GB DDR5
    Graphics card(s)
    Intel 700 Embedded GPU
    Sound Card
    Realtek Embedded
    Monitor(s) Displays
    27" HP 1080p
    Screen Resolution
    1920x1080
    Hard Drives
    Crucial P310 2TB 2280 PCIe Gen4 eD NAND PCIe SSD
    Samsung EVO 990 2TB NVMe Gen4 SSD
    Samsung 2TB SATA SSD
    PSU
    Thermaltake Smart BM3 650W
    Case
    Okinos Micro ATX Case
    Cooling
    Fans
    Keyboard
    Microsoft Comfort Curve 2000
    Mouse
    Logitech G305
    Internet Speed
    Verizon FiOS 1GB
    Browser
    Firefox
    Antivirus
    Malware Bytes & Windows Defender Security
I just looked into this, and wanted to create a bootable USB Win 11 installation of the latest Win 11 23H2 Enterprise build I got from UUP Dump.
I have successfully updated this PC (target machine I am creating the bootable drive on) with the CA 2023 certificates using the guide @Scott provided, verifying with the 'True' results.

I have the latest Rufus 4.11p (portable), and I let it grab whatever updates it needed to get when it first opened.
Supposedly, this latest Rufus update should add the last option just before creating the bootable ISO to include the latest CA 2023 certificates, however it does not?

View attachment 150802

I'm guessing this is because the ISO I'm using has the outdated CA 2011 certificates (as per the pop-up just before creating), so how would I be able to use Rufus to build a bootable ISO according to your assertions?
Perhaps this only works for building a 25H2 ISO that already has the updates certificates built into the ISO?Otherwise, I would have to use the method described by @Scott to change these files before using Rufus?
Rufus from ver.4.10 has the ability to use CA 2023signed bootloader, but it requires Winows 11 25H2 iso. This is specified in the change log Rufus - Create bootable USB drives the easy way , where you have to click the FAQ FAQ Here part 1 is describing about Updating your UEFI firmware to install the newer Windows UEFI CA 2023 certificate and revoke the obsolete PCA 2011 one. If you look into Part 2 the first point itself says
"In Rufus, select a Windows 11 25H2 ISO (Note that Windows 11 24H2 ISOs will not work on account that Microsoft screwed up compatibility with Windows UEFI CA 2023 in those images. Only the Windows 11 25H2 ISOs are compatible with a Windows UEFI CA 2023 installation) " So using Rufus if you want to create a Windows 11 bootable media with CA 2023 signed bootloader you need to have 25H2 ISO. If you must stay with the UUPDump 23H2 build (Enterprise) for compatibility or specific reason: then consider manually rebuilding the ISO (or injecting the new boot-chain) method described by @Scott so that you can leverage the CA 2023 option in Rufus.

Manu
 

My Computers

System One System Two

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom Made
    CPU
    Intel 14100
    Motherboard
    Gigabyte B760M D2H
    Memory
    G.Skill Trident Z5 Neo RGB 32GB (2x16GB) DDR5 6000
    Graphics Card(s)
    Integrated
    Sound Card
    Built-in
    Monitor(s) Displays
    40Inch Blaupunkt 1920X1080 & Acer 24Inch 1920X1080
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung 990Pro 1TB &
    Western Digital WD Black SN850X NVMe 1TB
    PSU
    550W Corsair
    Case
    Chiptronix
    Cooling
    Default
    Keyboard
    Logitech Wireless
    Mouse
    Logitech Wireless
    Internet Speed
    500Mbps
    Browser
    Brave
    Antivirus
    Kaspersky Premium
  • Operating System
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom Built
    CPU
    Intel G7600
    Motherboard
    Asus PRIME-H610M-E-D4
    Memory
    16GB Corsair Vengeance
    Graphics card(s)
    Integrated
    Sound Card
    In Built
    Monitor(s) Displays
    Samsung 22Inch
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung Evo 970 Pro 500GB
    PSU
    CoolerMaster 450W
    Case
    Normal
    Cooling
    Default
    Keyboard
    Logitech Wireless
    Mouse
    Logitech Wireless
    Internet Speed
    500Mbps
    Browser
    Brave
    Antivirus
    Kaspersky Total Security
This is the latest UUPDUMP of Win 1123H2 Enterprise that I intend to use all the way through Nov 2026 since I'm perfectly happy with 23H2

Hey @Globespy, re-download your ISO from UUPdump, but before running the uup_download_windows.cmd file modify the
ConvertConfig.ini file, change UpdtBootFiles from 0 to 1, save and close. That will give you the updated cert.

1761804074164.webp

I just downloaded the ISO and here's the output I got with the ISO mounted:

1761804207118.webp
 
Last edited:

My Computers

System One System Two

  • OS
    Win 11 Pro 25H2 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self Built
    CPU
    Intel® Core™ i7-14700K
    Motherboard
    ASUS TUF Z690-PLUS WIFI BIOS 4505 11/29/25
    Memory
    G.SKILL Ripjaws S5 Series 64GB (2 x 32GB) DDR5
    Graphics Card(s)
    ASUS GeForce RTX 4070 Super 12GB
    Sound Card
    Sound Blaster AE-5 Plus
    Monitor(s) Displays
    ASUS TUF Gaming 27" 2K HDR Gaming
    Screen Resolution
    2560 x 1440
    Hard Drives
    Samsung 990 Pro 1TB NVMe (Win 11 25H2)
    SK hynix P41 500GB NVMe 25H2 DEV/Games
    SK hynix P41 2TB NVMe (x3)
    Crucial P3 Plus 4TB
    PSU
    Corsair RM850x Shift
    Case
    Antec Dark Phantom DP502 FLUX
    Cooling
    Corsair Nautilus 360 RS AIO
    Keyboard
    Logitech MK 320
    Mouse
    Razer Basilisk V3
    Internet Speed
    350Mbs
    Browser
    Firefox
    Antivirus
    Winows Security
    Other Info
    MR 8.1 Home

    System 3 Specs
    Win 11 Pro 25H2 26200.8524
    ASUS PRIME Z370-P II BIOS 3004 7/12/21
    Intel Core i7-8700 CPU @ 3.20GHz
    32GB DDR4 RAM (4x8)
    iGPU Intel UHD Graphics 630
  • Operating System
    Win 11 Pro 25H2 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self Built
    CPU
    Intel Core i7-11700F
    Motherboard
    Asus TUF Gaming Z590 Plus WiFi (BIOS 2803)
    Memory
    64 GB DDR4
    Graphics card(s)
    MSI GeForce RTX 3060 Ventus 2X 12GB
    Sound Card
    SoundBlaster Audigy Fx V2
    Monitor(s) Displays
    Samsung F27T350
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 980 Pro 1TB
    Samsung 970 EVO Plus 2TB
    Samsung 870 EVO 500GB SSD
    PSU
    Corsair HX750
    Case
    Cougar MX330-G Window
    Cooling
    Thermalright Frozen Edge 240 Black AIO
    Internet Speed
    350Mbps
    Browser
    Firefox
    Antivirus
    Windows Security
Looking for some help/simplification of this process

I followed this....... How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932
...to the letter.

I have ended up with this.......

2025-10-30_203040.webp

The things that bother me is the BANNED statement in the EFI Files and Why I seem to have two references to
Microsoft Windows Production PCA 2011 certs, one in the DB and one in the DBX. (I thought it would just move it from DB to DBX)

Can anyone decode/explain this to me please?

The drives on the computer are configured as per diagram below and the computer is booting fine,
Any insight would be much appreciated.

2025-10-30_203325.webp


:unsure:
 

My Computer

System One

  • OS
    Windows 11 Enterprise
Looking for some help/simplification of this process
The 2011 cert in DBX revokes trust in the 2011 cert in DB. So even though it's in DB a boot manager signed with a 2011 CERT can not validate with it and will fail to start Windows 11. That's why you need the 2023 CERT, so the 2023 Boot Manager it is starting from can be validated with it.

You're still missing three other 2023 cert's, one that's pretty important. Look back for a post by @Scott , #1104, for two commands that should get you all four.

BTW: for ultimate simplification in the process, just be sure you're in secure boot and that diagnostics reporting is enabled. Then Microsoft will update the keys for you according to the schedule they have you on.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 5800X
    Motherboard
    Gigabyte B550M Aorus Pro
    Memory
    GSkill 3200, 2x8GB
    Graphics Card(s)
    MSI RX 6800 XT Gaming Z
    Sound Card
    on-board Realtek
    Monitor(s) Displays
    MSI 180hz
    Screen Resolution
    1440p
    Hard Drives
    Samsung 980 Pro, Samsung 870 Evo, generic PCIe NVME, WD 1TB 2.5" laptop spinner
    PSU
    Corsair RM 650
    Case
    mATX
    Cooling
    BeQuiet 240mm AIO and a bunch of case fans
    Keyboard
    one that clacks softly
    Mouse
    logitech
    Internet Speed
    bunches of bps
    Browser
    Firefox
    Antivirus
    Windows' own
  • Operating System
    Win11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 1700
    Motherboard
    GA-AB350M G-3
    Memory
    16GB DDR4
    Graphics card(s)
    RX-480
    Sound Card
    In-Built Realtek
    Monitor(s) Displays
    Samsung
    Screen Resolution
    1440p
    Hard Drives
    NVME/SSD's
    PSU
    Thermaltake BX1 550W
    Case
    Some junky thing
    Cooling
    ThermalTake Assassin(?)
    Browser
    FF/Edge
    Antivirus
    Whatever Windows does
    Other Info
    Secure Boot enabled updated to 2023 CA keys, TPM2.0 enabled with system drive Bitlocker'd.
The 2011 cert in DBX revokes trust in the 2011 cert in DB. So even though it's in DB a boot manager signed with a 2011 CERT can not validate with it and will fail to start Windows 11. That's why you need the 2023 CERT, so the 2023 Boot Manager it is starting from can be validated with it.
Ok thanks so DB one is cancelled with dbx one and sucessfully revoked the Microsoft Windows Production 2011 PCA certificate. What about the BANNED part? I look at others in here and they show allowed. I suppose what I'm saying is does this look OK to you all or is there something left to do?
 

My Computer

System One

  • OS
    Windows 11 Enterprise
Ok thanks so DB one is cancelled with dbx one and sucessfully revoked the Microsoft Windows Production 2011 PCA certificate. What about the BANNED part? I look at others in here and they show allowed. I suppose what I'm saying is does this look OK to you all or is there something left to do?
There are several scripts on this thread, some don't get that part quite right. Look for script titled "Check_Mosby_EFIBootFile.ps1" and you're much more likely to get a correct report.

But also, as I said you're missing three other certs but those two commands I referenced should get them for you too.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 5800X
    Motherboard
    Gigabyte B550M Aorus Pro
    Memory
    GSkill 3200, 2x8GB
    Graphics Card(s)
    MSI RX 6800 XT Gaming Z
    Sound Card
    on-board Realtek
    Monitor(s) Displays
    MSI 180hz
    Screen Resolution
    1440p
    Hard Drives
    Samsung 980 Pro, Samsung 870 Evo, generic PCIe NVME, WD 1TB 2.5" laptop spinner
    PSU
    Corsair RM 650
    Case
    mATX
    Cooling
    BeQuiet 240mm AIO and a bunch of case fans
    Keyboard
    one that clacks softly
    Mouse
    logitech
    Internet Speed
    bunches of bps
    Browser
    Firefox
    Antivirus
    Windows' own
  • Operating System
    Win11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 1700
    Motherboard
    GA-AB350M G-3
    Memory
    16GB DDR4
    Graphics card(s)
    RX-480
    Sound Card
    In-Built Realtek
    Monitor(s) Displays
    Samsung
    Screen Resolution
    1440p
    Hard Drives
    NVME/SSD's
    PSU
    Thermaltake BX1 550W
    Case
    Some junky thing
    Cooling
    ThermalTake Assassin(?)
    Browser
    FF/Edge
    Antivirus
    Whatever Windows does
    Other Info
    Secure Boot enabled updated to 2023 CA keys, TPM2.0 enabled with system drive Bitlocker'd.
There are several scripts on this thread, some don't get that part quite right. Look for script titled "Check_Mosby_EFIBootFile.ps1" and you're much more likely to get a correct report.

But also, as I said you're missing three other certs but those two commands I referenced should get them for you too.
OK so there is progress :) It now looks like this picture below after your advice...... I can't find a link to the Mosby version (Check_Mosby_EFIBootFile.ps1). The only one I found seemed to have been removed. Does anyone know of one? Until then see below how it looks now.....


2025-10-30_210458.webp
 

My Computer

System One

  • OS
    Windows 11 Enterprise
There are several scripts on this thread, some don't get that part quite right. Look for script titled "Check_Mosby_EFIBootFile.ps1" and you're much more likely to get a correct report.

But also, as I said you're missing three other certs but those two commands I referenced should get them for you too.
OK so this is the output from Check_EFIBootFileUpdated.ps1 and this shows Allowed. I'm going to make bootable media now as per the experiences of others earlier in this thread.

2025-10-30_215907.webp

:coffee: Caffine required.....
 

My Computer

System One

  • OS
    Windows 11 Enterprise
OK so this is the output from Check_EFIBootFileUpdated.ps1 and this shows Allowed. I'm going to make bootable media now as per the experiences of others earlier in this thread.

View attachment 151031

:coffee: Caffine required.....
If you need it, definitely make bootable media that uses the 2023 signed boot manager. Nothing with a 2011 signed boot manager will start now that the 2011 certificate is revokedd in DBX. There are instructions on doing this in several posts in this thread, even in the Microsoft document.

All the 2023 certs are in place.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 5800X
    Motherboard
    Gigabyte B550M Aorus Pro
    Memory
    GSkill 3200, 2x8GB
    Graphics Card(s)
    MSI RX 6800 XT Gaming Z
    Sound Card
    on-board Realtek
    Monitor(s) Displays
    MSI 180hz
    Screen Resolution
    1440p
    Hard Drives
    Samsung 980 Pro, Samsung 870 Evo, generic PCIe NVME, WD 1TB 2.5" laptop spinner
    PSU
    Corsair RM 650
    Case
    mATX
    Cooling
    BeQuiet 240mm AIO and a bunch of case fans
    Keyboard
    one that clacks softly
    Mouse
    logitech
    Internet Speed
    bunches of bps
    Browser
    Firefox
    Antivirus
    Windows' own
  • Operating System
    Win11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 1700
    Motherboard
    GA-AB350M G-3
    Memory
    16GB DDR4
    Graphics card(s)
    RX-480
    Sound Card
    In-Built Realtek
    Monitor(s) Displays
    Samsung
    Screen Resolution
    1440p
    Hard Drives
    NVME/SSD's
    PSU
    Thermaltake BX1 550W
    Case
    Some junky thing
    Cooling
    ThermalTake Assassin(?)
    Browser
    FF/Edge
    Antivirus
    Whatever Windows does
    Other Info
    Secure Boot enabled updated to 2023 CA keys, TPM2.0 enabled with system drive Bitlocker'd.
Back
Top Bottom