Did you manually update your Secure Boot Keys ?

Sheikh · Jun 3, 2025

garlin said:
ConvertConfig.ini -> UpdtBootFiles=1

I think this one updates boot.wim not the BIOS.
My UEFI has not received any updates by Huawei since 2022 so I had to disable secure boot. Had no problem with official images but the uup.

suatcini54 · Jun 3, 2025

garlin said:
ConvertConfig.ini -> UpdtBootFiles=1

Thanks, @garlin for the heads-up.

This value change in ConvertConfig.ini file updated the bootx64.efi file with Windows UEFI CA 2023 Certificate. No need for my manual certificate update bootx64.efi file any longer.

suatcini54 · Jun 3, 2025

Sheikh said:
I think this one updates boot.wim not the BIOS.
My UEFI has not received any updates by Huawei since 2022 so I had to disable secure boot. Had no problem with official images but the uup.

Hi.

The ConvertConfig.ini file modification updates bootx64.efi file in EFI\boot directory with the updated Windows UEFI CA2023 certificate when you mount iso file from uupdump download. For UEFI firmware update for your PC, you must do the update manually.

Please refer to: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support for proper instructions.

Hope this helps.

garlin · Jun 3, 2025

UUP dump has no clue what your UEFI state is when building the ISO. So the script can either leave the boot file as provided from the ISO distribution folder, or take the boot file from the patched install image. This is the same for both W10 22H2 and all W11 builds.

The script really doesn't care, it's your problem to figure out if you need to change UpdtBootFiles.

Scannerman · Jun 3, 2025

Just an observation but I'm starting to notice that simple BIOS based operating systems with no UEFI seem to be safer, less troublesome, and, ironically, more secure. They're certainly low maintenance. I'm currently running two units like this and they keep on running every day without issue. Perhaps I'm out of my league on this as I'm not running a commercial server and I'm not an IT. I'm okay with this but the irony hasn't escaped me as I continue to struggle with Win 11. Is newer really better? Perhaps for some.

hsehestedt · Jun 3, 2025

I automated the whole process for my PCs so they are all patched up.

PerpetualCycle · Jun 27, 2025

So will the certificate updates invalidate macrium backups that were made prior to the update?

suatcini54 · Jun 27, 2025

PerpetualCycle said:
So will the certificate updates invalidate macrium backups that were made prior to the update?

Most probably if you also revoked the CA2011 certificate in UEFI firmware. That's the idea, I guess.

PerpetualCycle · Jun 27, 2025

suatcini54 said:
Most probably if you also revoked the CA2011 certificate in UEFI firmware. That's the idea, I guess.

Thanks, that is what I thought. Just to be aware.

People may want to make a fresh backup after they have updated.

suatcini54 · Jun 27, 2025

garlin said:
UUP dump has no clue what your UEFI state is when building the ISO. So the script can either leave the boot file as provided from the ISO distribution folder, or take the boot file from the patched install image. This is the same for both W10 22H2 and all W11 builds.

The script really doesn't care, it's your problem to figure out if you need to change UpdtBootFiles.

Isn't it always a good idea to make UpdtBootFiles=1 ? By this don't we get updated bootx64.efi file with Windows CA 2023 certificate, which works whether CA 2011 certificate is revoked in UEFI firmware or not ?

PerpetualCycle · Jun 27, 2025

After following the steps, I am stuck on the verification check that the 2023 CA is in the path of bootmgfw_2023.efi

Any help?

bikemanAMD · Jun 27, 2025

Is there a script I should run to update my boot file? Don't think ever did that part in the past, or revoked old one on any of my computers

suatcini54 · Jun 27, 2025

@PerpetualCycle

Don't you have this ?

PerpetualCycle · Jun 27, 2025

suatcini54 said:
@PerpetualCycle

Don't you have this ?

View attachment 137935

No I didn't. But now I do. A reboot was required between the add to database and add to bootloader steps.

bikemanAMD · Jun 27, 2025

Think mine all set now, and last powershell command did return a true value after reboot between the steps

Gonna update Macrium Reflect Rescue Media in a few minutes here

gunrunnerjohn · Jun 27, 2025

I checked, I did have the 2023 update.

bikemanAMD · Jun 30, 2025

Think my System is all set here, at least my Desktop. Haven't done the steps as yet on my Windows 10 Gaming Laptop or Windows 10 Family Desktop as wasn't sure i needed to or not

Now if sometime i upgrade this boot drive from its current one to say possibly Samsung 990 Pro 1TB, and make eventually the new 2TB M.2 Samsung 990 Pro as the Game M.2.

Would i have to do the steps again on the new fresh install, or what happens then lol. ((Current boot drive is Samsung 990 Evo Plus Host Memory buffer version)

garlin · Jun 30, 2025

bikemanAMD said:
Think my System is all set here, at least my Desktop. Haven't done the steps as yet on my Windows 10 Gaming Laptop or Windows 10 Family Desktop as wasn't sure i needed to or not

Your PC is done.

bikemanAMD said:
Would i have to do the steps again on the new fresh install, or what happens then lol.

No, because UEFI changes are persistent. They survive even if you wipe or replace the Windows drive.

Moving forward you can only boot Windows or install media which are signed with PCA 2023 (for example, no more W11 21H2 install ISO because it was released before PCA 2023). Older install images can be patched by replacing the boot files, but MS isn't going to do that service for you.

bikemanAMD · Jun 30, 2025

garlin said:
Your PC is done.

No, because UEFI changes are persistent. They survive even if you wipe or replace the Windows drive.

Moving forward you can only boot Windows or install media which are signed with PCA 2023 (for example, no more W11 21H2 install ISO because it was released before PCA 2023). Older install images can be patched by replacing the boot files, but MS isn't going to do that service for you.

Oh ok, Well i always keep my Installation media up to date, 24H2 version my install media should be

cheaterslick · Jun 30, 2025

Will these new certs eventually be pushed through Windows Update?

If not, then how are the non-tech savvy going to update?

-------> I doubt they're going to go through all this.

Did you manually update your Secure Boot Keys ?

Software Developer

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Syzygy

My Computers

Well-known member

My Computers

Syzygy

My Computers

Well-known member

My Computers

Syzygy

My Computers

Well-known member

My Computers

Well-known member

My Computers

Syzygy

My Computers

Well-known member

Attachments

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Similar threads