Did you manually update your Secure Boot Keys ?

Almighty1 · Sep 29, 2025

Buddywh said:
MOSBY has you first put UEFI in SETUP mode... or delete all the secure boot keys which does the same thing in my BIOS'. That forces it to boot with Secure Boot off, and boot to the MOSBY USB recovery, whereupon you run MOSBY to repopulate all the keys including the 2023 keys. It may have to either be in SETUP mode or booting with Secure Boot if doing it in the OS (pure speculation on my part).

I haven't tried the Microsoft Method. Can't now because Windows won't create a recovery USB for me. I can create a MOSBY recovery USB at any time using RUFUS.

You have it in reverse, you have to put the UEFI in setup mode to use Mosby which is basically just deleting all keys or in reality just deleting the PK by first going into BIOS Setup's Secure Boot section. You still have to put Secure Boot enabled = off as on a Dell, keeping it on will not boot to Mosby but instead it will boot to Dell Pre-Boot Diagnostics which basically tests all the hardware and you will lose 20 minutes of time.

Almighty1 · Sep 29, 2025

bo elam said:
Almighty, I read it and felt after reading it the answer was YES, but then later I read something else and get confused. So, I would like a simple yes or no. Yes or no.

Thank you

Bo

The answer should be yes since the expiration date only matters when something is signed and not used as long as that certificate is not in the DBX.

Almighty1 · Sep 29, 2025

Buddywh said:
MOSBY has you first put UEFI in SETUP mode... or delete all the secure boot keys which does the same thing in my BIOS'. That forces it to boot with Secure Boot off, and boot to the MOSBY USB recovery, whereupon you run MOSBY to repopulate all the keys including the 2023 keys. It may have to either be in SETUP mode or booting with Secure Boot if doing it in the OS (pure speculation on my part).

I haven't tried the Microsoft Method. Can't now because Windows won't create a recovery USB for me. I can create a MOSBY recovery USB at any time using RUFUS.

There is no recovery USB to create as I think all you really need is formatted FAT32 USB and this is all you really do, all I did was take an existing formatted USB Drive and followed the directions.

Go to a device where the July 8, 2025, or later update has been applied.
In a command window, copy the recovery app to the flash drive using the following commands (assuming the flash drive is the “D:” drive). Type each command separately and then press Enter:

md D:\EFI\BOOT

copy C:\windows\boot\efi\securebootrecovery.efi D:\efi\boot\bootx64.efi
On the device that has the Secure Boot settings reset to the defaults, insert the flash drive, restart the device and boot from the flash drive.

bo elam · Sep 29, 2025

Almighty1 said:
The answer should be yes since the expiration date only matters when something is signed and not used as long as that certificate is not in the DBX.

Thank you.

Bo

Almighty1 · Sep 29, 2025

bo elam said:
Thank you.

Bo

Actually, I know why you are concerned. I looked at your image again and your current setup has the 2011 PCA for booting. You should really update to the 2023 signed boot manager since remember when Microsoft enforces the DBX for 2011 PCA, you won't be booting in secure mode.

All you need to do is using PowerShell the two commands:
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x100 /f

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

and followed by these two commands in PowerShell:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

and the "'s are actually used.

Buddywh · Sep 29, 2025

Almighty1 said:
You have it in reverse, you have to put the UEFI in setup mode to use Mosby which is basically just deleting all keys or in reality just deleting the PK by first going into BIOS Setup's Secure Boot section. You still have to put Secure Boot enabled = off as on a Dell, keeping it on will not boot to Mosby but instead it will boot to Dell Pre-Boot Diagnostics which basically tests all the hardware and you will lose 20 minutes of time.

You misunderstood: in the BIOS of my machines (two of them, the other has a separate SETUP mode setting) it tells me to DELETE the keys which puts it in setup mode. I can't remember for sure but I'm pretty sure I left Secure Boot enabled on them, which couldn't work anyway because there are no keys so it probably simply reverts to an OFF status.

I did so (both of those machines) booted into the MOSBY recovery USB and populated the keys (including it's unique PK) and restarted. All's good now as reported by "Check_Mosby_EFIBootFile.ps1".

I'm very glad I don't have to be doing this on any Dell or HP PC's. My MSI and Gigabyte MoBo's are flaky enough trying to relate the terms they use in the BIOS to what I'm reading here and in MOSBY Readme's.

Almighty1 · Sep 29, 2025

Buddywh said:
You misunderstood: in the BIOS of my machines (two of them, the other has a separate SETUP mode setting) it tells me to DELETE the keys which puts it in setup mode. I can't remember, but I'm pretty sure I left Secure Boot enabled on them.

I did so (both of those machines) booted into MOSBY and populated the keys (including it's unique PK) and restarted. All's good now.

I'm very glad I don't have to be doing this on any Dell or HP PC's. My MSI and Gigabyte MoBo's are flaky enough trying to relate the terms they use in the BIOS to what I'm reading here and in MOSBY Readme's.

Different machines work different ways and MSI and Gigabyte are more custom build machines so you have way more options and settings which is good. On Dell's, the only way to do Setup mode requires enabling custom keys just to delete the keys or else Mosby won't work. It's actually easy on the Dell as long as someone tells you how to get into Setup mode as Dell's only have a Deployment mode and Audit mode, only Deployment mode is Secure Boot enabled as Audit Mode is still off when booting. HP and Qualcomm firmware based arm64 machines are the ones that both Microsoft and HP on the blocked from update list:

bo elam · Sep 29, 2025

Almighty1 said:
..... You should really update to the 2023 signed boot manager since remember when Microsoft enforces the DBX for 2011 PCA, you won't be booting in secure mode.

You got good instincts. I think something about that boot manager thing was what I read that got me thinking and wondering.

Regarding the PS commands. They look a little confusing to me. I am not sure were each begins and ends. It looks to me like it's 4 commands in total. It's that correct? Please confirm this. I won't do them now but I ll make a note of your answer for later, in case I manually do the boot manager update.

But, again. If lets say neither MS or I manually update anything so the current status of my certs remain static, would my computer still boot? I hate assuming, in your previous answer to that question (The answer should be yes since the expiration date only matters when something is signed and not used as long as that certificate is not in the DBX.) do that still applies even if the boot manager is not updated to the 2023 signed boot manager? Thanks.

Bo

bo elam · Sep 29, 2025

@Almighty1 By the way, that Known issues table you posted a copy of, I think the known issue for HP's posted there, I think it might be hurting my HP get an update from MS that MS is trying to apply. I am talking about that Sure Start Security. My computer has that On, and MS is failing to update a variable (whatever that means, it doesn't make sense to me but I am sure it does to you guys that know about this things).

Bo

Buddywh · Sep 29, 2025

Almighty1 said:
...restart the device and boot from the flash drive.

When it boots, will it "automatically" repopulate the keys and then exit with no need to enter any commands? So I'd just restart again, enter BIOS to make sure secure boot is enabled, save (if necessary) and exit to Secure Boot back into Windows?

I wonder what this would do given that I have created a custom PK with MOSBY.

KevTech · Sep 29, 2025

Personally I found it easier to just follow what Microsoft has posted.
No need to put secure boot into setup mode to accomplish the task.

Almighty1 · Sep 29, 2025

bo elam said:
You got good instincts. I think something about that boot manager thing was what I read that got me thinking and wondering.

Regarding the PS commands. They look a little confusing to me. I am not sure were each begins and ends. It looks to me like it's 4 commands in total. It's that correct? Please confirm this. I won't do them now but I ll make a note of your answer for later, in case I manually do the boot manager update.

But, again. If lets say neither MS or I manually update anything so the current status of my certs remain static, would my computer still boot? I hate assuming, in your previous answer to that question (The answer should be yes since the expiration date only matters when something is signed and not used as long as that certificate is not in the DBX.) do that still applies even if the boot manager is not updated to the 2023 signed boot manager? Thanks.

Bo

Yes, it is 4 commands or 2 sets... so it's basically this which you need to do in PowerShell in elevated Adminstrator mode:
Set #1 which consists of:

This is to add the 2023 boot manager:
#1

Code:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x100 /f

#2

Code:

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

I do not know if you need to reboot before you do the following or not.

This is Set #2:
This is to enable the SVN (Secure Version Number) which Microsoft describes as follows:
"The Boot Manager deployed above has a new self-revocation feature built-in. When the Boot Manager starts to run, it performs a self-check by comparing the Secure Version Number (SVN) that is stored in the firmware, with the SVN built into the Boot Manager. If the Boot Manager SVN is lower than the SVN stored in the firmware, the Boot Manager will refuse to run. This feature prevents an attacker from rolling back the Boot Manager to an older, non-updated version."
which is done with these two commands in PowerShell:

#1

Code:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f

#2

Code:

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Remember Microsoft's instructions wants people to add the PCA 2011 blocking to the DBX (forbidden booting list) so while you don't show a PCA 2011 in the DBX yet, if Microsoft pushes the update for the PCA 2011 blocking and somehow you don't get updated to the 2023 Boot Manager, then you will not be able to boot.

Almighty1 · Sep 29, 2025

bo elam said:
@Almighty1 By the way, that Known issues table you posted a copy of, I think the known issue for HP's posted there, I think it might be hurting my HP get an update from MS that MS is trying to apply. I am talking about that Sure Start Security. My computer has that On, and MS is failing to update a variable (whatever that means, it doesn't make sense to me but I am sure it does to you guys that know about this things).

Bo

That came from the article How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support in the Known Issues section so they are saying until HP provides a BIOS/firmware update, Microsoft will block the updates from happening on your system but it appears you have everything applies except for the bootmanager, SVN and DBX.

Almighty1 · Sep 29, 2025

Buddywh said:
When it boots, will it "automatically" repopulate the keys and then exit with no need to enter any commands? So I'd just restart again, enter BIOS to make sure secure boot is enabled, save (if necessary) and exit to Secure Boot back into Windows?

I wonder what this would do given that I have created a custom PK with MOSBY.

Yes, you keep Secure Boot on and you are supposed to Restore the default keys first and turn Secure Boot on. Then you boot, you will not even know what happened as it will boot from the flash drive and then it will boot your Windows automatically shortly on it's own. You do not even have to touch the keyboard or mouse.

Almighty1 · Sep 30, 2025

KevTech said:
Personally I found it easier to just follow what Microsoft has posted.
No need to put secure boot into setup mode to accomplish the task.

Microsoft's instructions will only get you one key, the Windows UEFI 2023 CA, you will still be missing the other three keys as Step 1 only does Windows UEFI 2023 CA. Step 2 does the bootmanager 2023, step 3 is for the DBX and step 4 is to enable the SVN. Mosby is way easier and faster as it requires you to do nothing other than booting the USB Flash Drive and type "Mosby" if you want to excluse step 3 or "Mosby -x" if you want to include step 3.

Even Microsoft tells you at Windows Secure Boot certificate expiration and CA updates - Microsoft Support that there are 4 keys that needs to be installed, Microsoft only showed you how to install 1 with step 1 and for a certificate that expires on October 31, 2026 which is still 13 months away, you still are missing 3 of them which Microsoft still did not provide any instructions for when they expire in 9 months or 4 months before the one Microsoft told you how to install so you can wait and hope Microsoft throws you a bone to get the other 3 keys which may or may not happen as the only thing in life that is guaranteed with certainty is death and taxes, add it on your own to the BIOS yourself or use a tool like Mosby.

You still have 9 months, Mosby takes less than 2 minutes flat and you will also learn something at the same time. and while Mosby does not do the Option ROM yet, that is already included with Windows and it's just going into the bios, append from file, point it at the .bin file which takes 2 seconds, reboot and you already have it. You can wait until the next version of Mosby which will have the option ROM if you want it easier.

And just like anything, hard is only if you have never tried it. You have to learn to walk before you can run. The first time for anything will of course be more challenging but once you have done it once, you can do it with your eyes closed. I have already installed all the keys, deleted all the keys, used Mosby, deleted the keys to see what the default PK shows and then installed Mosby again. Only the first time was hard as the hard part was figuring out how to get the UEFI Secure Keys into Setup Mode. The Mosby part is easy. It's just like any other command prompt. Whether it's Unix, DOS, Windows, it's all the same and you were already told to type in Mosby. Creating the USB Flash Drive is the hard part and I'm a Rufus newbie. Besides, a script is always easier than copying and pasting a bunch of things where there is a higher chance of errors plus rebooting. Basically, a lot of people spent way more time than needed to ask the same questions over and over like a broken recording. It would be different if the question is new and not something someone already asked before. Asking questions is one thing but as the saying goes, when you have to explain something and draw the intestines, that is really bad.

bo elam · Sep 30, 2025

Almighty1 said:
Remember Microsoft's instructions wants people to add the PCA 2011 blocking to the DBX (forbidden booting list) so while you don't show a PCA 2011 in the DBX yet, if Microsoft pushes the update for the PCA 2011 blocking and somehow you don't get updated to the 2023 Boot Manager, then you will not be able to boot.

See what I mean, that is why I asked the Yes or No question. The answer to my original question might be No (despite what Akeo says in his nice post from Saturday). So really, there is no answer as of now...

Anyway, I appreciate you taking the time to answer my questions the best you can. Also, you are answering a lot of other questions in this page of this thread. I tip my hat to you.

Regarding running the 4 scripts, that is easy. I trust PS and I can search to find out whether to reboot or not after running the first set of 2 commands. My concern about running the commands or doing anything manually to update is that doing it perhaps would interfere later with MS or the HP process (however that goes) to prepare computers to handle the transition from the old certs to the new ones. I reckon and hope HP has a process in mind. This HP is brand new.

Bo

bo elam · Sep 30, 2025

Almighty1 said:
That came from the article How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support in the Known Issues section so they are saying until HP provides a BIOS/firmware update, Microsoft will block the updates from happening on your system but it appears you have everything applies except for the bootmanager, SVN and DBX.

Yes, I know where that came from. I am familiar with it and (semi) understand what Sure Start Security is supposed to do. I did a new BIOS update about 4 days ago and MS still has an issue updating my HP (TMP WMI Error 1796). My feeling is that Sure Start Security is conflicting with MS update process and that is why the MS update is not being applied in my computer. Put what I am saying here together with what I wrote in my previous post and that produces why I am not sure about manually updating anything, at least not yet. Best regards.

Bo

bo elam · Sep 30, 2025

bo elam said:
See what I mean, that is why I asked the Yes or No question. The answer to my original question might be No (despite what Akeo says in his nice post from Saturday). So really, there is no answer as of now...

I just thought of something @Almighty1 The answer really is Yes. But based on what you said, that could change if MS pushes the update for the PCA 2011 blocking and somehow my PC don't get updated to the 2023 Boot Manager. Right?

Bo

Almighty1 · Sep 30, 2025

bo elam said:
See what I mean, that is why I asked the Yes or No question. The answer to my original question might be No (despite what Akeo says in his nice post from Saturday). So really, there is no answer as of now...

Anyway, I appreciate you taking the time to answer my questions the best you can. Also, you are answering a lot of other questions in this page of this thread. I tip my hat to you.

Regarding running the 4 scripts, that is easy. I trust PS and I can search to find out whether to reboot or not after running the first set of 2 commands. My concern about running the commands or doing anything manually to update is that doing it perhaps would interfere later with MS or the HP process (however that goes) to prepare computers to handle the transition from the old certs to the new ones. I reckon and hope HP has a process in mind. This HP is brand new.

Bo

When I look at things, I always look at the worst case scanario so just assume it does not work so you will not be paniced later. Yes, you have a HP so it's better to be safe than sorry. Always take precautions.

Almighty1 · Sep 30, 2025

bo elam said:
I just thought of something @Almighty1 The answer really is Yes. But based on what you said, that could change if MS pushes the update for the PCA 2011 blocking and somehow my PC don't get updated to the 2023 Boot Manager. Right?

Bo

It could be MS and/or HP since remember HP may decide to put the 2023 security stuff in a new BIOS and then it's already blocked by default.

Did you manually update your Secure Boot Keys ?

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer