Did you manually update your Secure Boot Keys ?

andyc56 said:

I just do this to run PowerShell 5.1 from an administrative command prompt (from earlier in the thread):

Code:

powershell -nop -ep bypass -f Check_Mosby_EFIBootFile.ps1

For PowerShell 7.x, I used this:

Code:

pwsh -nop -ep bypass -f Check_Mosby_EFIBootFile.ps1

Click to expand...

neldog said:

Lordy - here is another PowerShell, (version unknown to me, came with WIN 11 Pro).

Click to expand...

garlin said:

It looks good, except for banning PCA 2010 on the DBX. The boot files that need blocking are signed PCA 2011, which is a different cert. I'm not sure if your BIOS update added PCA 2010 or not. Never seen that before.

Click to expand...

garlin said:

Thanks. PS 7 changed the calling arguments for Get-PfxCertificate.

Replace "-FileName" with "-LiteralPath":

Code:

171 function Get-PFXCert {
172     [Parameter(Mandatory)]
173     param ([string]$FileName)
174
175     try {
176         $Issuer = (Get-PfxCertificate -LiteralPath $FileName).Issuer
177     }

This edit will be rolled into the next official version of the script (later this week).

Click to expand...

neldog said:

New BIOS was just installed a few days ago, so I don't know. So, do you think I'm good or do I need to do that whole manual update thing? Thanks.

Click to expand...

neldog said:

I am unable to make either one of those codes to work. I must be missing something.

Click to expand...

andyc56 said:

When you open up your administrative command prompt to launch the command, do so from the folder containing the .ps1 script you're launching. I just do this from File Explorer by navigating to that folder, then going to the Explorer context menu and choosing "Open in Terminal". This opens up a non-administrative Terminal session. Click the down caret on the right in Terminal's tab controls, then Ctrl+click on any of "Windows PowerShell", "PowerShell", or "Command Prompt". This will launch an administrative command prompt of the desired type. Any of them will work. Then type the command from my previous post to run it.

If you don't launch the script when in that script's directory, you need to put the full path to the script into the command instead of just the file name.

Click to expand...

neldog said:

Well... It looks like I am going to have to do that manual update to those keys. I really did not want to do go down that road for fear of messing that up. I wish that Microsoft would just take care of this for us.

Click to expand...

neldog said:

Thank you so much! I wonder if I will get that missing one in some later Windows Update or do you think I need to do that manual update to get that last one. Thanks!

Click to expand...

neves said:

They say they will (for officially supported systems - at least), the update it set for Mid 2026. That's at least 9 months till then.

Click to expand...

Almighty1 said:

I did the last one manually as Mosby only added 3 and it's going to be in a future version of Mosby. To answer your question, I have no idea if they will come with Windows Update or not as even the KEK and Microsoft UEFI CA 2023 were not added using the Microsoft method. Do you happen to know how you got the DBX for the 2010 certificate?

Click to expand...

garlin said:

It looks good, except for banning PCA 2010 on the DBX. The boot files that need blocking are signed PCA 2011, which is a different cert. I'm not sure if your BIOS update added PCA 2010 or not. Never seen that before.

Click to expand...

Almighty1 said:

Do you know how you got the DBX for the 2010 certificate?

Click to expand...

neldog said:

Not sure how those were delivered other than to say this is a very new computer, (Dell June production date). A new BIOS update a few days ago and maybe Dell Supportassist program update to that application yesterday. Other than one of those, I don't see how they came to me.

Click to expand...

Almighty1 said:

I had it too but this is on a new motherboard from Dell to replace the failed motherboard in my notebook on June 10, 2025. It was not added when I did a delete all keys and reset all keys. Maybe Dell manually added them or something.

Click to expand...

neldog said:

I may need to get back with you for some guidance on how you did all that... later. I am going to wait a few months and see if all this gets sorted out on its own without my intervention. If not, I will need to do the manual update to those keys. I have no idea how to delete those bad keys and add new ones - that all sounds very frightening to me.

Dell needs to replace my motherboard too, as my RTC is not synchronizing with the "Windows Clock", or so the Event Viewer is saying.

Click to expand...

Did you manually update your Secure Boot Keys ?

Will do. This script has taken a life of its own, it started as a quick tool for checking your progress thru the MS mitigation steps. Stuff like that comes in handy, just nice to know which version we're looking at. :-) BTW, thanks for coming up with it. (y)

www.elevenforum.com