Did you manually update your Secure Boot Keys ?

bo elam said:

I like to run Garlin's script but I have a couple questions, perhaps someone can answer. Is Double clicking the script the way to run it? And question 2: Are the results auto generated into a text file that is created at the desktop, or how do I get them. Thank's.

Click to expand...

\path\to\save\folder\Check_EFIBootFile.ps1 > C:\Users\BoElam\Desktop\output.txt

powershell -ep bypass -f \path\to\save\folder\Check_EFIBootFile.ps1 > C:\Users\BoElam\Desktop\output.txt

garlin said:

Here's a PowerShell script for downloading & copying the Microsoft KEK CA 2023 (DER) certificate to your system drive's EFI partition. You could copy the same file to a mounted USB drive, but that's more of a hassle since the file is tiny (less than 2K).

After the script is successful, shutdown your PC and enter the BIOS setup screens.

Under Secure Boot, there should be a menu option to add KEK certificates. From the selection, browse the available filesystems. One of them should be your system drive's EFI partition. Under the path \EFI\Microsoft\Boot, find the "Microsoft Corporation KEK 2K CA 2023" certificate and add it.

Restart Windows, and you should see KEK CA 2023 reported now.

Code:

PS C:\Users\GARLIN\Downloads> .\CopyKEK2023_to_EFI.ps1
Successful copy of KEK CA 2023 cert to the EFI partition.

Shutdown Windows, and enter your BIOS's Secure Boot setup screen.
Browse the system drive's EFI partition.

Look under the "EFI\Microsoft\Boot" folder, and select "Microsoft Corporation KEK 2K CA 2023.der" cert.
Restart Windows.

PS C:\Users\GARLIN\Downloads>

Click to expand...

RJARRRPCGP said:

Where's the file at?

Click to expand...

mountvol S: /s
dir S:\EFI\Microsoft\Boot

FerchogtX said:

Seem the BIOS on my laptop doesn't have an option to load files, just enable or disable Secure Boot...
Any advice here?
(Man, this is a mess lol)

Click to expand...

FIREMEDIC2700 said:

i cant get it to load in power shell i am stupid i know i dont know how to use powershell

Click to expand...

garlin said:

The file is hidden on the EFI partition. When you update the BIOS, it wants to read a file from the system drive or a mounted USB drive.
By copying directly to the EFI partition, it bypasses the need for you to format an USB drive using FAT32.

I have chosen to place a copy of the cert file on the EFI, under \EFI\Microsoft\Boot.
That's where you navigate through your BIOS' setup screen, it will be browsable.

If you don't trust the file is there:

Code:

mountvol S: /s
dir S:\EFI\Microsoft\Boot

Click to expand...

garlin said:

You don't have some advanced setup mode? Post your laptop's model, and see if anyone knows.

Click to expand...

FIREMEDIC2700 said:

garlin thanks for tha
after i run it whats the next step

Click to expand...

RJARRRPCGP said:

I have a lot of options that do seem confusing!

Click to expand...

garlin said:

You just keep navigating folders until you see it. I can't tell you what your exact devices will look like.

Click to expand...

RJARRRPCGP said:

I couldn't see the file listed. I will try a USB stick.

Click to expand...

FIREMEDIC2700 said:

i was given the option to install this on my computer it says it was installed . how do i check to see if it was

Click to expand...

FerchogtX said:

Nope... my older Acer used to have one, but this one... I haven't been able to see advanced mode...
My Laptop model is Pavilion 15-eh3000la (80M53LA)

Click to expand...

garlin said:

If your vendor (HP) is terrible and doesn't allow you access, or has abandoned your PC as too old to update -- then your safe option is to disable Secure Boot in BIOS and ignore this entire thread.

With Secure Boot disabled, you have less system security but none of the upcoming Windows changes will break your PC. You can freely run whatever Windows or Linux you want. The point of this exercise is to block a known UEFI-based malware from infecting your system by banning older boot files.

It's taken over 2 1/2 years to get this far, because a lot of PC makers have dragged their feet.

Click to expand...

HP Pavilion HPE h8-1360t CTO Desktop PC​