Did you manually update your Secure Boot Keys ?

garlin · Sep 14, 2025

bo elam said:
I like to run Garlin's script but I have a couple questions, perhaps someone can answer. Is Double clicking the script the way to run it? And question 2: Are the results auto generated into a text file that is created at the desktop, or how do I get them. Thank's.

It's a PowerShell script, and for security reasons Windows doesn't allow you to double-click PS scripts to run.

You can open an Administrator's CMD or PowerShell session. To run the script, and save the output into a text file:

From Powershell (as Admin):

Code:

\path\to\save\folder\Check_EFIBootFile.ps1 > C:\Users\BoElam\Desktop\output.txt

From CMD (as Admin):

Code:

powershell -ep bypass -f \path\to\save\folder\Check_EFIBootFile.ps1 > C:\Users\BoElam\Desktop\output.txt

FIREMEDIC2700 · Sep 14, 2025

i cant get it to load in power shell i am stupid i know i dont know how to use powershell

DarkShadowMD · Sep 14, 2025

garlin said:
Here's a PowerShell script for downloading & copying the Microsoft KEK CA 2023 (DER) certificate to your system drive's EFI partition. You could copy the same file to a mounted USB drive, but that's more of a hassle since the file is tiny (less than 2K).

After the script is successful, shutdown your PC and enter the BIOS setup screens.

Under Secure Boot, there should be a menu option to add KEK certificates. From the selection, browse the available filesystems. One of them should be your system drive's EFI partition. Under the path \EFI\Microsoft\Boot, find the "Microsoft Corporation KEK 2K CA 2023" certificate and add it.

Restart Windows, and you should see KEK CA 2023 reported now.

Code:

PS C:\Users\GARLIN\Downloads> .\CopyKEK2023_to_EFI.ps1 Successful copy of KEK CA 2023 cert to the EFI partition. Shutdown Windows, and enter your BIOS's Secure Boot setup screen. Browse the system drive's EFI partition. Look under the "EFI\Microsoft\Boot" folder, and select "Microsoft Corporation KEK 2K CA 2023.der" cert. Restart Windows. PS C:\Users\GARLIN\Downloads>

Seem the BIOS on my laptop doesn't have an option to load files, just enable or disable Secure Boot...
Any advice here?
(Man, this is a mess lol)

garlin · Sep 14, 2025

RJARRRPCGP said:
Where's the file at?

The file is hidden on the EFI partition. When you update the BIOS, it wants to read a file from the system drive or a mounted USB drive.
By copying directly to the EFI partition, it bypasses the need for you to format an USB drive using FAT32.

I have chosen to place a copy of the cert file on the EFI, under \EFI\Microsoft\Boot.
That's where you navigate through your BIOS' setup screen, it will be browsable.

If you don't trust the file is there:

Code:

mountvol S: /s
dir S:\EFI\Microsoft\Boot

FIREMEDIC2700 · Sep 14, 2025

i think were are all screwed to be honest

garlin · Sep 14, 2025

FerchogtX said:
Seem the BIOS on my laptop doesn't have an option to load files, just enable or disable Secure Boot...
Any advice here?
(Man, this is a mess lol)

You don't have some advanced setup mode? Post your laptop's model, and see if anyone knows.

garlin · Sep 14, 2025

FIREMEDIC2700 said:
i cant get it to load in power shell i am stupid i know i dont know how to use powershell

Here's a clickable batch file.

RJARRRPCGP · Sep 14, 2025

garlin said:
The file is hidden on the EFI partition. When you update the BIOS, it wants to read a file from the system drive or a mounted USB drive.
By copying directly to the EFI partition, it bypasses the need for you to format an USB drive using FAT32.

I have chosen to place a copy of the cert file on the EFI, under \EFI\Microsoft\Boot.
That's where you navigate through your BIOS' setup screen, it will be browsable.

If you don't trust the file is there:

Code:

mountvol S: /s dir S:\EFI\Microsoft\Boot

I have a lot of options that do seem confusing!

FIREMEDIC2700 · Sep 14, 2025

garlin thanks for tha
after i run it whats the next step

DarkShadowMD · Sep 14, 2025

garlin said:
You don't have some advanced setup mode? Post your laptop's model, and see if anyone knows.

Nope... my older Acer used to have one, but this one... I haven't been able to see advanced mode...
My Laptop model is Pavilion 15-eh3000la (80M53LA)

garlin · Sep 14, 2025

FIREMEDIC2700 said:
garlin thanks for tha
after i run it whats the next step

You can post the output for feedback.

garlin · Sep 14, 2025

RJARRRPCGP said:
I have a lot of options that do seem confusing!

You just keep navigating folders until you see it. I can't tell you what your exact devices will look like.

RJARRRPCGP · Sep 14, 2025

garlin said:
You just keep navigating folders until you see it. I can't tell you what your exact devices will look like.

I couldn't see the file listed. I will try a USB stick.

FIREMEDIC2700 · Sep 14, 2025

same here no such thing on my pc

garlin · Sep 14, 2025

RJARRRPCGP said:
I couldn't see the file listed. I will try a USB stick.

Download this file and copy it to an USB drive:
https://raw.githubusercontent.com/m...ates/microsoft corporation kek 2k ca 2023.der

I don't know if your BIOS expects a FAT32-formatted drive or not.

FIREMEDIC2700 · Sep 14, 2025

i was given the option to install this on my computer it says it was installed . how do i check to see if it was

garlin · Sep 14, 2025

FIREMEDIC2700 said:
i was given the option to install this on my computer it says it was installed . how do i check to see if it was

Restart Windows. Re-run the script and now it should report a KEK CA 2023 present.

garlin · Sep 14, 2025

FerchogtX said:
Nope... my older Acer used to have one, but this one... I haven't been able to see advanced mode...
My Laptop model is Pavilion 15-eh3000la (80M53LA)

If your vendor (HP) is terrible and doesn't allow you access, or has abandoned your PC as too old to update -- then your safe option is to disable Secure Boot in BIOS and ignore this entire thread.

With Secure Boot disabled, you have less system security but none of the upcoming Windows changes will break your PC. You can freely run whatever Windows or Linux you want. The point of this exercise is to block a known UEFI-based malware from infecting your system by banning older boot files.

It's taken over 2 1/2 years to get this far, because a lot of PC makers have dragged their feet.

DarkShadowMD · Sep 14, 2025

garlin said:
If your vendor (HP) is terrible and doesn't allow you access, or has abandoned your PC as too old to update -- then your safe option is to disable Secure Boot in BIOS and ignore this entire thread.

With Secure Boot disabled, you have less system security but none of the upcoming Windows changes will break your PC. You can freely run whatever Windows or Linux you want. The point of this exercise is to block a known UEFI-based malware from infecting your system by banning older boot files.

It's taken over 2 1/2 years to get this far, because a lot of PC makers have dragged their feet.

Well... only if they probably release a BIOS update... the latest is April 2025, but since they suck in telling WHAT exactly they update, I'm uncertain if they have tackled this issue yet...
I am not in fond of constantly updating BIOS... I'm unsure to proceed lol (Current BIOS in this laptop is from March 2024 more or less...)
This is a true mess... I mean, secure boot is a thing that supposedly keeps you secure, but disabling it now keeps you safer lol. (Not complaining to you... more like to tech in general)

FIREMEDIC2700 · Sep 14, 2025

garlin that would be a no go trying to install it from the option to install from the drop down menu . how can i try it using a usb stick .
does secure boot have to be enabled for all this to work .
btw this is computer is a hp

Did you manually update your Secure Boot Keys ?

Well-known member

My Computer

Well-known member

My Computer

Peaceful Citizen

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

Attachments

My Computer

Well-known member

My Computers

Well-known member

My Computer

Peaceful Citizen

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Peaceful Citizen

My Computers

Well-known member

HP Pavilion HPE h8-1360t CTO Desktop PC​

My Computer

Similar threads

HP Pavilion HPE h8-1360t CTO Desktop PC