Did you manually update your Secure Boot Keys ?

Scott · Feb 14, 2026

garlin said:
except complain to ASUS.

I think you mean ASRock, as that's what 666pierog has.

ASUS seems to be on the ball. They recently released a new BIOS for my old Tuf Z590 board (System 2).

I know you don't like this script, but here it is.

garlin · Feb 14, 2026

Green is good. I forgot ASUS sold off ASRock...

HeavyHemi · Feb 14, 2026

666pierog said:
I have one more question, so Option ROM 2023 can't be granted to me by Windows Update right?

NVIDIA GPU UEFI Firmware Update Tool for RTX 5060 Series

NVIDIA Support

nvidia.custhelp.com

666pierog · Feb 14, 2026

HeavyHemi said:
NVIDIA GPU UEFI Firmware Update Tool for RTX 5060 Series

NVIDIA Support

nvidia.custhelp.com

Yea, I did it right after purchasing the card.

666pierog · Feb 14, 2026

so now if I have it added via script, I shouldn't have a problem when the 2011 certificates expire?

garlin · Feb 16, 2026

Listed under the Feb. 2026 Monthly Update:

[Secure Boot] This release for Windows 11, version 24H2 will execute updates in the Boot Manager on devices that already have the Windows UEFI CA 2023 certificate in their Secure Boot Signature Database (DB). It replaces the 2011 signed bootmgfw.efi with the 2023 signed bootmgfw.efi. Be advised of the consequences of resetting the DB or turning Secure Boot on or off, as this can cause a "Secure Boot violation" issue. In those rare cases, the solution is to create the Secure Boot recovery media.

If your UEFI has the CA 2023 certs installed, Windows will try switching to the new CA 2023 boot file for you. Anyone who forced the Secure Boot updates before this month's update will not see any changes (you already switched the boot file).

Andy76swe · Feb 18, 2026

Any way of manually updating/fixing the Windows Bootmgr SVN?

garlin · Feb 18, 2026

Andy76swe said:
Any way of manually updating/fixing the Windows Bootmgr SVN?

1. Make sure Windows has the October 2025 (or later) Monthly Update. SVN 5.0 indicates an older version of Windows.

2. Run the commands:

Code:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Andy76swe · Feb 18, 2026

garlin said:
1. Make sure Windows has the October 2025 (or later) Monthly Update. SVN 5.0 indicates an older version of Windows.

2. Run the commands:

Code:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

well thats the thing.. I'm running the latest Windows Insider Canary.. updated today..

garlin · Feb 18, 2026

Andy76swe said:
well thats the thing.. I'm running the latest Windows Insider Canary.. updated today..

That's the problem with Canary, it might not have the latest Secure Boot update files since its focus is on new Windows features...

Copy this file to \Windows\System32\SecureBootUpdates:
https://github.com/microsoft/secure...edObjects/Optional/DBX/amd64/DBXUpdateSVN.bin

Re-run the commands.

garlin · Feb 19, 2026

Forgot to mention, my update script has an option to use the latest DBXupdate.bin and DBXupdateSVN.bin files from the MS GitHub.
If the GitHub files are not a higher version of the files, no change is made.

garlin's PowerShell scripts for updating Secure Boot CA 2023

Run this command as Admin:

Code:

powershell -ep bypass -f .\Update_UEFI-CA2023.ps1 -Revoke -Latest

kiilp · Feb 24, 2026

Hello everyone,

I have a question for everyone that got a new BIOS update,
Was this included in the BIOS update?

I mean the (v1.6.0) DBX.
I suppose all the Windows SVN is something that will be from microsoft and not from a BIOS update?

garlin · Feb 24, 2026

kiilp said:
I have a question for everyone that got a new BIOS update,
Was this included in the BIOS update?

I mean the (v1.6.0) DBX.
I suppose all the Windows SVN is something that will be from microsoft and not from a BIOS update?

Every BIOS firmware will include some factory default DBX signatures; but since the list can change too quickly, it's up to MS to provide an updated list.

The main goal of installing a new BIOS is adding the CA 2023 certs to KEK and DB, but not to automatically revoke any certs in DBX. After you follow the all manual (or scripted) steps to revoke the CA 2011 cert, the missing DBX signatures and SVN numbers will be populated.

kiilp · Feb 24, 2026

garlin said:
Every BIOS firmware will include some factory default DBX signatures; but since the list can change too quickly, it's up to MS to provide an updated list.

The main goal of installing a new BIOS is adding the CA 2023 certs to KEK and DB, but not to automatically revoke any certs in DBX. After you follow the all manual (or scripted) steps to revoke the CA 2011 cert, the missing DBX signatures and SVN numbers will be populated.

Thanks, I’m asking because the latest BIOS update seems to be missing some things. The blacklist (DBX) wasn't updated, the new Microsoft Option ROM UEFI CA 2023 key is missing,

and the KEK key is also showing up in the DB list but not sure if that's fine as long as it's also in KEK list?

garlin · Feb 24, 2026

kiilp said:
Thanks, I’m asking because the latest BIOS update seems to be missing some things. The blacklist (DBX) wasn't updated, the new Microsoft Option ROM UEFI CA 2023 key is missing,

By default, no vendor will update the DBX with certs because that would block systems which are not ready, from booting. Not every vendor will include the Option ROM cert as a default, but it can be added from Windows after KEK CA 2023 has been installed.

kiilp said:
and the KEK key is also showing up in the DB list but not sure if that's fine as long as it's also in KEK list?

KEK CA 2023 should not be listed in DB, but it won't harm the PC.

You can have extra certs in DB or DBX, which are ignored if they don't follow the "web of trust". Every DB or DBX cert needs to have a KEK to authenticate it. Since only a PK can only authenticate a KEK cert, having KEK CA 2023 in the wrong place means this duplicate entry is not enforceable (ignored).

But if your BIOS has manual key management, I would clean it up if possible.

TheJademoon · Feb 28, 2026

I have a MoBo that had it's last eol firmware update in 2022. Needless to say, I had the old secure boot certificate version. I followed suatcini54's directions, and everything shows as true when I run Confirm-SecureBootUEFI and [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’

Thank you so much, suatcini54!

Try3 · Feb 28, 2026

TheJademoon said:
I followed suatcini54's directions

Where are those directions?
If they are in this thread, what is their post number [shown on the right-hand side of each post]?

Denis

Scott · Mar 1, 2026

Try3 said:
Where are those directions?

Post # 1

Levitate11 · May 9, 2026

Folks:

Guide me!

If I run the suggested EFIBootFile.ps1, here's the output.

Code:

PS C:\Users\xxx> Check_EFIBootFile.ps1
Secure Boot: ENABLED

EFI DB Certificates
-------------------
    Microsoft Windows Production PCA 2011
    Windows UEFI CA 2023
    Microsoft Corporation UEFI CA 2011
    Microsoft UEFI CA 2023

EFI DBX Certificates
--------------------
AvailableUpdates: 0x400
-----------------------
EFI Files
---------
Boot Manager [Microsoft UEFI CA 2023] on Disk 0 is allowed.

And if I check in Privacy and Security > Windows Security > Device Security > Secure Boot, I find ""Secure Boot is on, but your device is using an older boot trust configuration that should be updated."

I have MS updates through the latest 2026-04 Preview Update (KB5083631) (26200.8328) installed.

So where do I stand? Am I running off the 2023 certificates now?

garlin · May 9, 2026

The Check_EFIBootFile.ps1 script is obsolete, and now replaced by a newer and more complete script.

You can down the replacement script from here:
garlin's PowerShell scripts for updating Secure Boot CA 2023

Did you manually update your Secure Boot Keys ?

Well-known member

My Computers

Well-known member

My Computer

Well-known member

NVIDIA GPU UEFI Firmware Update Tool for RTX 5060 Series​

My Computer

Member

NVIDIA GPU UEFI Firmware Update Tool for RTX 5060 Series​

My Computer

Member

My Computer

Well-known member

My Computer

Member

Attachments

My Computer

Well-known member

My Computer

Member

My Computer

Well-known member

My Computer

Well-known member

My Computer

New member

My Computer

Well-known member

My Computer

New member

My Computer

Well-known member

My Computer

New member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Similar threads

NVIDIA GPU UEFI Firmware Update Tool for RTX 5060 Series

NVIDIA GPU UEFI Firmware Update Tool for RTX 5060 Series