Did you manually update your Secure Boot Keys ?

Hazel123 · Jul 26, 2025

So - what I have expires in October doesn't it?

gunrunnerjohn · Jul 26, 2025

KevTech said:
When revoked you get like I have.

Anything past the July 8th updates should have the 2023 patch but like I posted in the other tread they are not yet enabled unless you go through the mitigation.

View attachment 140534

I still don't get the one 2023 certificate on my laptop, and I have all the updates applied.

This one is still missing.

I got it on my two desktops by running

gunrunnerjohn · Jul 26, 2025

Hazel123 said:
So - what I have expires in October doesn't it?

Technically, but if you don't have Secure Boot enabled, nothing happens. I've been hearing that Microsoft is going to deliver these keys in an update, but so far it hasn't happened.

garlin · Jul 26, 2025

CA 2011 certificate expires in Oct 2026. That doesn't mean your old Windows will drop dead and be invalidated.

But at some point after Oct 2026, MS will release newer Windows boot files which can no longer be signed by the CA 2011 (since the cert was only valid for 15 years). This means your BIOS has to install at a minimum, the CA 2023 cert in order to trust newer boot files. If you intend to be on 25H2 for the next 2-3 years, then it's something that will have to happen.

man00 · Jul 26, 2025

gunrunnerjohn said:
powershell -nop -ep bypass -f "C:\TEMP\Check_EFIBootFile.ps1"

I tried that this is what I got
The argument 'C:\TEMP\Check_EFIBootFile.ps1' to the -File parameter does not exist. Provide the path to an existing '.ps1' file as an argument to the -File parameter.

garlin · Jul 26, 2025

The path is where you downloaded or copied the PS script file.

bikemanAMD · Jul 26, 2025

Macrium Reflect & Possibly version 8

Should have access to updated Windows PE Build 26100 December 2024

Rescue Media
- PE 11 Rescue Media has been updated to build 26100, December 2024.

Will Remake my Macrium Reflect X Rescue Media after dinner here and see if it has the updated bootkit cert

Does Create in E:\EFI\Boot\bootx64.efi with 2023 Cert

gunrunnerjohn · Jul 26, 2025

man00 said:
I tried that this is what I got
The argument 'C:\TEMP\Check_EFIBootFile.ps1' to the -File parameter does not exist. Provide the path to an existing '.ps1' file as an argument to the -File parameter.

Did you actually do this?

Create a folder in the root of drive C: named TEMP

Copy the Check_EFIBootFile.ps1 script to the TEMP folder just created, i.e. C:\TEMP

Open an admin terminal window, Windows Key/X and then select "A".

Paste the following line into the terminal window.

powershell -nop -ep bypass -f "C:\TEMP\Check_EFIBootFile.ps1"

man00 · Jul 27, 2025

gunrunnerjohn said:
Did you actually do this?

Create a folder in the root of drive C: named TEMP

Copy the Check_EFIBootFile.ps1 script to the TEMP folder just created, i.e. C:\TEMP

Open an admin terminal window, Windows Key/X and then select "A".

Paste the following line into the terminal window.

powershell -nop -ep bypass -f "C:\TEMP\Check_EFIBootFile.ps1"

Thanks, but I'm still no sure about doing this. I don't have any EFIBootFile.ps1 script
to copy to c:\temp

KevTech · Jul 27, 2025

man00 said:
I don't have any EFIBootFile.ps1 script
to copy to c:\temp

Post 196 in this thread.

man00 · Jul 27, 2025

KevTech said:
Post 196 in this thread.

My results..thanks for the link

gunrunnerjohn · Jul 27, 2025

man00 said:
My results..thanks for the link
View attachment 140620

That happened to me because the Secure Boot wasn't configured in the BIOS on my AceMagic mini-PC box. Once I configured it properly, I got the expected results.

uncyler825 · Jul 28, 2025

garlin said:
Run this PowerShell script as Admin:

Code:

powershell -nop -ep bypass -f Check_EFIBootFile.ps1

The script will report which CA certificates have been added to the DB & DBX lists, and which boot file you currently have installed for the system drive.

Thanks for the script. Could you please add the KEK certificate list?

Code:

$db_Certs = @((Get-SecureBootUEFI kek | Get-UefiDatabaseSignatures).SignatureList.SignatureData.Subject | where { $_ -match 'Microsoft' } | foreach { $null = $_ -match $CN_regex; $Matches[2] })

Print-Header 'EFI KEK Certificates'
foreach ($Cert in $db_Certs) {
    "    {0}" -f $Cert
}

wordsworth · Jul 31, 2025

Why do I get the following error on my noncompatible machine. The two compatible machines run the script fine. Not that I think compatibility has anything to do with it.

powershell -nop -ep bypass -f Check_EFIBootFile.ps1

The argument 'Check_EFIBootFile.ps1' to the -File parameter does not exist. Provide the path to an existing '.ps1' file as an argument to the -File parameter.

gunrunnerjohn · Jul 31, 2025

wordsworth said:
Why do I get the following error on my noncompatible machine. The two compatible machines run the script fine. Not that I think compatibility has anything to do with it.

powershell -nop -ep bypass -f Check_EFIBootFile.ps1

The argument 'Check_EFIBootFile.ps1' to the -File parameter does not exist. Provide the path to an existing '.ps1' file as an argument to the -File parameter.

You have to provide the full path to the Check_EFIBootFile.ps1 file. In my case, it's a couple folders deep so I have this command to launch it. Note the full path and the quotes since there are spaces in the folder name.

powershell -nop -ep bypass -f "C:\BAT\Check Boot CA Certificates\Check_EFIBootFileUpdated.ps1"

man00 · Jul 31, 2025

gunrunnerjohn said:
That happened to me because the Secure Boot wasn't configured in the BIOS on my AceMagic mini-PC box. Once I configured it properly, I got the expected results.

Secure Boot is enable in my Bios

wordsworth · Jul 31, 2025

On my two compatible machines and the noncompatible I simply have the file in the Download folder and the two compatible machines simply run it. On the noncompatible I just now did put the file on C: and now it works. Go figure.

Anyway, success now on all three machines.

OldNavy · Jul 31, 2025

This is way too complicated for millions upon millions of computer users.
Microsoft will have to come up with simple procedure for the implementation of this.

gunrunnerjohn · Jul 31, 2025

wordsworth said:
On my two compatible machines and the noncompatible I simply have the file in the Download folder and the two compatible machines simply run it. On the noncompatible I just now did put the file on C: and now it works. Go figure.

Anyway, success now on all three machines.

View attachment 140990

You're missing the 2023 certificate for booting other bootable utilities.

I have yet to ban the 2011 certificate on any of my machines.

Sheikh · Jul 31, 2025

is there any way to update keys offline? for example, a pack to install manually without internet connection.

Did you manually update your Secure Boot Keys ?

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

Attachments

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Software Developer

My Computers

Similar threads