Did you manually update your Secure Boot Keys ?

glasskuter · Jul 17, 2025

@garlin I do not deny that you are 100% correct in every point you made.

Diceman2037 · Jul 22, 2025

garlin said:
firmware files have been shared with MS on the GitHub repository folders.

these aren't "firmware" files, they are binary representations of the signed secure components for use within firmware and the der data for insertion into the root stores.

the script also aborts on systems that already have secureboot enabled, even outdated and won't finish without the PK binary, which is not public.

gunrunnerjohn · Jul 22, 2025

Diceman2037 said:
these aren't "firmware" files, they are binary representations of the signed secure components for use within firmware and the der data for insertion into the root stores.

the script also aborts on systems that already have secureboot enabled, even outdated and won't finish without the PK binary, which is not public.

You sure about that? I thought the "firmware" files on GitHub were actual processor firmware. They really have nothing to do with security, but more for processor stability and bug fixes.

garlin · Jul 22, 2025

Diceman2037 said:
these aren't "firmware" files, they are binary representations of the signed secure components for use within firmware and the der data for insertion into the root stores.

the script also aborts on systems that already have secureboot enabled, even outdated and won't finish without the PK binary, which is not public.

I'll grant you a better description is signed files, but they're for the PC's firmware.

My original point isn't to use the actual script, but that MS has been working behind the scenes so eventually an official method to fix the partially updated PC's will appear later on.

Hazel123 · Jul 26, 2025

garlin said:
Run this PowerShell script as Admin:

Code:

powershell -nop -ep bypass -f Check_EFIBootFile.ps1

The script will report which CA certificates have been added to the DB & DBX lists, and which boot file you currently have installed for the system drive.

I got this

The argument 'Check_EFIBootFile.ps1' to the -File parameter does not exist. Provide the path to an existing '.ps1' file as an argument to the -File parameter.
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! Migrating from Windows PowerShell 5.1 to PowerShell 7 - PowerShell

garlin · Jul 26, 2025

If your Terminal app opens in PS automatically, you can just type "\path\to\Check_EFIBootFile.ps1" to run the script.

Sheikh · Jul 26, 2025

sorry guys. is there any command in CMD to do this update?
these three commands:

Powershell:

Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot” -Name “AvailableUpdates” -Value 0x40
Start-ScheduledTask -TaskName “\Microsoft\Windows\PI\Secure-Boot-Update”
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’

garlin · Jul 26, 2025

Code:

@echo off
powershell -C "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot' -Name AvailableUpdates -Value 0x40; Start-ScheduledTask -TaskName '\Microsoft\Windows\PI\Secure-Boot-Update'; [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'"

Sheikh · Jul 26, 2025

garlin said:

Code:

@echo off
powershell -C "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot' -Name AvailableUpdates -Value 0x40; Start-ScheduledTask -TaskName '\Microsoft\Windows\PI\Secure-Boot-Update'; [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'"

Thanks
I mean not using PS at all :lmao:

garlin · Jul 26, 2025

Sheikh said:
Thanks
I mean not using PS at all

The non-PS commands are in the KB instructions.

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

Hazel123 · Jul 26, 2025

garlin said:
If your Terminal app opens in PS automatically, you can just type "\path\to\Check_EFIBootFile.ps1" to run the script.

That didn't work for me either

I'm also more used to command prompt than powershell but couldn't understand that article either

Hazel123 · Jul 26, 2025

I'm just wanting to check what my current certificate is! Had a look in bios and can't see anything except that secure boot is on.

gunrunnerjohn · Jul 26, 2025

Copy the Check_EFIBootFile.ps1 script to a folder off the root of C: called TEMP, i.e. C:\TEMP

Open an admin terminal window, Windows Key/X and then select "A".

Paste the following line into the terminal window.

powershell -nop -ep bypass -f "C:\TEMP\Check_EFIBootFile.ps1"

This is what I get when I do that...

Sheikh · Jul 26, 2025

Some devices have old UEFI, which will remove these new keys after a reset UEFI command. is there any way to update those UEFI keys and prevent from removing those keys? or even better, integrate these new keys into .iso file which updates keys before installation.
here is an example:
1- Insert USB drive after turning off secure boot.
2- Keys now updated successfully.
3- Reboot to USB with secure boot ON.

Hazel123 · Jul 26, 2025

Copy the Check_EFIBootFile.ps1 script to a folder off the root of C: called TEMP, i.e. C:\TEMP

Thanks

Where is that script again?

gunrunnerjohn · Jul 26, 2025

Hazel123 said:
Thanks Where is that script again?

Here it is, I don't see where it was originally posted. This is the one I just ran to get that output.

Hazel123 · Jul 26, 2025

gunrunnerjohn said:
Here it is, I don't see where it was originally posted. This is the one I just ran to get that output.

So do I unzip that and rename it TEMP and put it in C?

KevTech · Jul 26, 2025

gunrunnerjohn said:
This is what I get when I do that

When revoked you get like I have.

Anything past the July 8th updates should have the 2023 patch but like I posted in the other tread they are not yet enabled unless you go through the mitigation.

gunrunnerjohn · Jul 26, 2025

Hazel123 said:
So do I unzip that and rename it TEMP and put it in C?

No, you unzip that file to the folder you created, C:\TEMP

Then you open a terminal window in administrative mode as I mentioned and paste the following command.

powershell -nop -ep bypass -f "C:\TEMP\Check_EFIBootFile.ps1"

Hazel123 · Jul 26, 2025

gunrunnerjohn said:
No, you unzip that file to the folder you created, C:\TEMP

Then you open a terminal window in administrative mode as I mentioned and paste the following command.

powershell -nop -ep bypass -f "C:\TEMP\Check_EFIBootFile.ps1"

Thank you - I get this

Secure Boot: ENABLED

EFI DB Certificates
-------------------
Microsoft Windows Production PCA 2011
Microsoft Corporation UEFI CA 2011

EFI DBX Certificates
--------------------

AvailableUpdates: 0x0
---------------------

EFI Files
---------
Boot Manager [Microsoft Corporation UEFI CA 2011] on Disk 0 is allowed.

Did you manually update your Secure Boot Keys ?

aka Mama Glass

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Software Developer

My Computers

Well-known member

My Computer

Software Developer

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Software Developer

My Computers

Well-known member

My Computers

Well-known member

Attachments

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Similar threads