Did you manually update your Secure Boot Keys ?

gunrunnerjohn · Sep 20, 2025

garlin said:
Will do. This script has taken a life of its own, it started as a quick tool for checking your progress thru the MS mitigation steps.

Stuff like that comes in handy, just nice to know which version we're looking at.

BTW, thanks for coming up with it.

OldNavy · Sep 20, 2025

This topic is now 23 pages long. Which script are we supposed to be using and where is the link?
Thanks

Almighty1 · Sep 20, 2025

antspants said:
Not sure if I have seen that process in this thread, or if I did, can’t seem to find it.

First, visit How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

and then step 3 Enable the revocation in the "Mitigation deployment guidelines" section. There is also Step 4. Apply the SVN update to the firmware.

Almighty1 · Sep 20, 2025

OldNavy said:
This topic is now 23 pages long. Which script are we supposed to be using and where is the link?
Thanks

For me, I am using the most recent from Did you manually update your Secure Boot Keys ? which is the last one posted in post #428 as I am using Mosby.

OldNavy · Sep 20, 2025

Cheers Almighty1

AncientParadise · Sep 20, 2025

I have a question for the professionals here. I know you don't condone disabling Secure Boot, but in case I must, I want to know the answer.

Imagine that I have Secure Boot disabled, so my computer will still work after the expiration date of the certificates, without needing the new ones. Now imagine that a few months AFTER the expiration date, the CR2032 battery in my motherboard has stopped working, so the settings of the BIOS have been set to the default settings.

If I have a type of BIOS that has Secure Boot set to "On" in the default configuration, would that mean my computer cannot function again? Would it stop ONLY Windows from booting, but still allow me to enter the BIOS (to set Secure Boot to "Off" again)?

(I switch to a new BIOS battery often, and I'll buy a new one before the expiration date, but I'm still curious about the situation I described.)

Almighty1 · Sep 20, 2025

AncientParadise said:
I have a question for the professionals here. I know you don't condone disabling Secure Boot, but in case I must, I want to know the answer.

Imagine that I have Secure Boot disabled, so my computer will still work after the expiration date of the certificates, without needing the new ones. Now imagine that a few months AFTER the expiration date, the CR2032 battery in my motherboard has stopped working, so the settings of the BIOS have been set to the default settings.

If I have a type of BIOS that has Secure Boot set to "On" in the default configuration, would that mean my computer cannot function again? Would it stop ONLY Windows from booting, but still allow me to enter the BIOS (to set Secure Boot to "Off" again)?

(I switch to a new BIOS battery often, and I'll buy a new one before the expiration date, but I'm still curious about the situation I described.)

The CR2032 battery has nothing to do with it since the certificates is stored in a different location just like when you reset the CMOS or take out the battery, you can still not get into the BIOS if you had a BIOS password enabled so you will still be able to get into BIOS Setup to change Secure Boot to off and Windows will still boot and then you can fix it afterwards. Even if you went into the BIOS and deleted the secure boot keys and reset them back to defaults, it only takes a USB flash drive to put the certificate back on the system and you will get back in fine.

I just did it yesterday, all you have to do is:
1) Visit How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support
2) Goto the "Updating Windows install media" section and then do the following:

Until you do that, your system will only boot with Secure Boot=Off
But with the flash drive, you can Keep Secure Boot=on and boot from the flash drive which will write the needed certificates and then it will boot without issues. If that still doesn't work, you can just use Mosby.

I had switched motherboards, changed the CMOS battery and even clear the CMOS during the past year and had always fixed it one way or another.
For example, see my post at:

Act now: Secure Boot certificates expire in June 2026

Windows IT Pro Blog: Prepare for the first global large-scale certificate update to Secure Boot. The Microsoft certificates used in Secure Boot are the basis of trust for operating system security, and all will be expiring beginning June 2026. The way to automatically get timely updates to new...

www.elevenforum.com

AncientParadise · Sep 20, 2025

I was curious about the situation of a person who won't ever feel comfortable installing a certificate without it being easily installed through "Windows Update". Imagine that person deciding to set Secure Boot to "Off", to avoid adding a certificate. Now imagine that the time is January 2027, so the old certificates have expired, but he'll be fine because he has Secure Boot set to "Off".

Now imagine one month later, during February 2027, his BIOS battery has stopped working. He'll buy a new battery, but the default settings are active now because the depletion of the battery caused his preferred settings to be erased. The default setting of his BIOS is to set Secure Boot to "On". The certificate is expired, so he can't enter Windows 10, but could he still enter the BIOS with an expired certificate, so, with a new battery, he'll set Secure Boot to "Off" again?

I know he could pay a professional to add the certificate, but I still want to know the answer. Would the expired certificates block access to the BIOS, too?

antspants · Sep 20, 2025

Imagine not overthinking something.

AncientParadise said:
but could he still enter the BIOS with an expired certificate, so, with a new battery, he'll set Secure Boot to "Off" again?

Yes.

AncientParadise said:
Would the expired certificates block access to the BIOS, too?

NO

Didn’t Almighty just answer that?

When is the last time a battery on a Motherboard died? I couldn’t tell you because I have never heard of it happening. At least not in the past 20 years.

My Motherboard was built in 2013/14 which is when I purchased it. I have used it everyday since. It still has the same battery.

antspants · Sep 20, 2025

Here is a clearer answer to your questions:

Can expired Secure Boot certificates block BIOS access?
- No, expired Secure Boot certificates do not block access to the BIOS/UEFI firmware interface.
- BIOS access is independent of Secure Boot status or certificate validity.
- You can always enter BIOS setup during POST (usually via [Del], [F2], or [Esc] depending on your motherboard).

What happens when the BIOS battery dies?
- CMOS settings (including Secure Boot state) revert to factory defaults.
- If Secure Boot defaults to "On", and the certificate is expired, Windows will fail to boot.
- However, you can still enter BIOS and manually set Secure Boot to "Off" again.

Can I recover access without installing a certificate?
- Yes. As long as you can enter BIOS, you can disable Secure Boot and bypass the expired certificate.
- This restores boot access to Windows (assuming no other boot integrity issues).

Would expired certificates ever prevent BIOS access?
- No. Certificates only affect OS boot validation under Secure Boot.
- BIOS/UEFI firmware is not gated by certificate status.

If BIOS access is blocked by a password or firmware-level lock (rare), you'd need to clear CMOS manually or use a recovery jumper.
But this is unrelated to certificate expiry.
You’re safe. Even in February 2027, with a dead battery and expired certs, you can re-enter BIOS and disable Secure Boot.
No need to install certificates unless you want Secure Boot enabled again.

gunrunnerjohn · Sep 20, 2025

antspants said:
When is the last time a battery on a Motherboard died? I couldn’t tell you because I have never heard of it happening. At least not in the past 20 years.

My Motherboard was built in 2013/14 which is when I purchased it. I have used it everyday since. It still has the same battery.

Believe it or not, they do die. I had a 2014 computer, and I had to replace the coin cell a couple of years ago, it started losing it's time. Since it was so far off, the automatic network sync was refusing to set the time.

Almighty1 · Sep 20, 2025

AncientParadise said:
I was curious about the situation of a person who won't ever feel comfortable installing a certificate without it being easily installed through "Windows Update". Imagine that person deciding to set Secure Boot to "Off", to avoid adding a certificate. Now imagine that the time is January 2027, so the old certificates have expired, but he'll be fine because he has Secure Boot set to "Off".

Now imagine one month later, during February 2027, his BIOS battery has stopped working. He'll buy a new battery, but the default settings are active now because the depletion of the battery caused his preferred settings to be erased. The default setting of his BIOS is to set Secure Boot to "On". The certificate is expired, so he can't enter Windows 10, but could he still enter the BIOS with an expired certificate, so, with a new battery, he'll set Secure Boot to "Off" again?

I know he could pay a professional to add the certificate, but I still want to know the answer. Would the expired certificates block access to the BIOS, too?

Like I said earlier, you can always get into the BIOS since on a Dell machine, holding down the power button for 25-30 seconds will clear all the RTC Settings whcih is the same thing as pulling the CMOS battery so it'll be in the load factory settings which is Secure Boot = on. You will always be able to enter the BIOS unless you had a password set on the BIOS and you forgot the password. So if it fails to boot, just change Secure Boot = off in the BIOS and it will boot. To get it to boot with Secure Boot = on, you need to do what I mentioned in my last response which requires a USB Flash Drive as the only way that will happen is not because of the BIOS settings since those are stored on CMOS, the certificates is stored elsewhere, the same place where the password for the BIOS is. Otherwise, think about it. If someone wanted to made your system no longer boot, they can just clear your CMOS so the only way to even not boot is to first delete all keys or reset all keys in the BIOS. The certificates are for the system to boot, the BIOS to is configure the system. Does your BIOS itself get erased when you disconnect the power or pull the CMOS without the battery?

garlin · Sep 20, 2025

UEFI data is stored in onboard flash memory, because it has to be persistent. If pulling out the battery and waiting a few minutes was enough to defeat UEFI-based security, then there really wouldn't be a point to having it.

antspants · Sep 20, 2025

gunrunnerjohn said:
Believe it or not, they do die. I had a 2014 computer, and I had to replace the coin cell a couple of years ago, it started losing it's time. Since it was so far off, the automatic network sync was refusing to set the time.

And when you replaced the battery, it was like nothing ever happened — less having to reconfigure your BIOS if you don’t use the defaults.

Almighty1 · Sep 20, 2025

gunrunnerjohn said:
Believe it or not, they do die. I had a 2014 computer, and I had to replace the coin cell a couple of years ago, it started losing it's time. Since it was so far off, the automatic network sync was refusing to set the time.

It does happen and depends on luck and the quality of the battery as my ASUS P4C-800E Deluxe motherboard which I am still using now, the original battery lasted for 5 years and the replacement battery is still working 15 years later.

As long as it is 2.80V and above, it will work but once it goes below 2.80V, it will stop working. The people using the CR versions of batteries use disposable batteries but people who use ML versions use a rechargeable battery. My Dell XPS 15 9570 uses a ML1220 and if I do not connect it to the wall for 3 weeks, the battery will be dead.

And there are people who have frequent CMOS battery dying as in every few days....
Ask all the people who have the Framework Modular Laptops with the 11th Generation Processor where their system will not boot if they do not plug the computer once every 7 days or so which is a big known issue as they will need to open the computer to manually fix it before it will work again, you can read about it here:

Viability of an ML 1220 rechargable battery for RTC | CMOS (11th gen)

Hi all, just providing more detail on this. The RTC battery (CMOS battery) powers the very low power subsystem that preserves the real time clock (responsible for providing the calendar clock to the system) and some processor state. This battery exists to allow system time to be preserved...

community.frame.work

mccmw · Sep 21, 2025

Once a full solution is determined...i.e. that updates all of the required keys, can someone post the process, or create a tutorial (in the tutorials forum)? I was successful in getting "Windows UEFI" to show up by running the powershell command. However, and I'm sure I'm not the only one, I'm not lost on what else to do? It is my understanding that the 2011 KEK and the 2011 PCA certificates need to be updated too? What is the safe procedure to do that?

I've also seen a rumor that Microsoft will ultimately do it for us via update. However, one site said you may need to have optional diagnostic data enabled (I have never had it enabled for privacy reasons). I just want to keep my machine updated and secure though:)

gunrunnerjohn · Sep 21, 2025

If I'm seeing this right, I have the job 90% done here. I have the 2023 certs installed and Windows is booting using the 2023 cert. I just need to disallow the 2011 certs, right?

garlin · Sep 21, 2025

Aramil · Sep 21, 2025

gunrunnerjohn said:
If I'm seeing this right, I have the job 90% done here. I have the 2023 certs installed and Windows is booting using the 2023 cert. I just need to disallow the 2011 certs, right?

*snip*

Used Microsoft's instructions to add PCA 2011 to the DBX

gunrunnerjohn · Sep 21, 2025

garlin said:
Yep.

Is there a procedure for doing that step? I did a brief search here, but I'm probably missing it if posted.

Did you manually update your Secure Boot Keys ?

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Member

My Computer

Well-known member

My Computer

Member

My Computer

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Similar threads