Did you manually update your Secure Boot Keys ?

man00 · Oct 9, 2025

C:\>powershell -nop -ep bypass -f "C:\Check_EFIBootFileUpdated.ps1"
The argument 'C:\Check_EFIBootFileUpdated.ps1' to the -File parameter does not exist. Provide the path to an existing '.ps1' file as an argument to the -File parameter.
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! Installing PowerShell on Windows - PowerShell

gunrunnerjohn · Oct 9, 2025

man00 said:
C:\>powershell -nop -ep bypass -f "C:\Check_EFIBootFileUpdated.ps1"
The argument 'C:\Check_EFIBootFileUpdated.ps1' to the -File parameter does not exist. Provide the path to an existing '.ps1' file as an argument to the -File parameter.
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! Installing PowerShell on Windows - PowerShell

Did you download the attached file and copy it to the root of the C:\ drive?

Buddywh · Oct 9, 2025

Almighty1 said:
One user or no users. If someone wanted to get control of your system, they will. ...

Indeed yes... that's a truism of any security system, in any application or situation. All you can realistically hope to do is slow them down and/or make them use more resources if they really want what you got.

man00 · Oct 9, 2025

gunrunnerjohn said:
Did you download the attached file and copy it to the root of the C:\ drive?

yes

wowchick · Oct 12, 2025

would this matter if i have secure boot off?

Buddywh · Oct 12, 2025

wowchick said:
would this matter if i have secure boot off?

Would what matter? Not having updated secure boot keys? I don't think it will for an existing Windows 11 installation. In fact, just disabling Secure Boot and keep on trudging will be a standard operating mode for many people if they run into any problems in the future.

Even so, I believe the experts (reading back through the thread) are saying Microsoft will (eventually) push updated keys into the BIOS variables even if Secure Boot is disabled (off). So you could re-enable at any time and it should work again: but how many will do that once their immediate problem gets "solved"? And also, Windows 11 officially requires Secure Boot to be enabled to do a clean install. It will be interesting to see what Microsoft does to deal with systems where BIOS hasn't been updated with new keys as defaults in the future.

gunrunnerjohn · Oct 12, 2025

Buddywh said:
It will be interesting to see what Microsoft does to deal with systems where BIOS hasn't been updated with new keys as defaults in the future.

I would speculate that they might have to have some process where they update them again if they see they're not there. OTOH, they might just throw up their hands and say you're on your own. :think:

Scott · Oct 12, 2025

man00 said:
C:\>powershell -nop -ep bypass -f "C:\Check_EFIBootFileUpdated.ps1"
The argument 'C:\Check_EFIBootFileUpdated.ps1' to the -File parameter does not exist. Provide the path to an existing '.ps1' file as an argument to the -File parameter.
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! Installing PowerShell on Windows - PowerShell

@garlin made us a double-clickable script that makes this very easy. It creates a UEFI_report.txt file on your desktop.
Just download the .zip file and extract it wherever you want. Double-click the BoScript.bat file then open the report
on your desktop. Too easy.

Download the script here.

Did you manually update your Secure Boot Keys ?

Not sure why my output looks different to everyone else's after running @Sheikh's script. Especially where it's referenced as EFI not UEFI So EFI preceded UEFI. I get it. I get that I am also probably out of luck. PS C:\Users\XXXXX> powershell -nop -ep bypass -f...

www.elevenforum.com

Hazel123 · Oct 12, 2025

I still haven't done anything. Have they rolled out with windows update yet? Can't remember where to check if I have them or not.

Phil_C · Oct 12, 2025

So--after spending several days reading this thread (and the one in the other forum), much of this scattershot information has managed to gel in my brain. I decided to try Mosby instead of the MS method. But then I saw this in the Rufus instructions:

"Please take note however that this guide is only intended for systems where you are going to install Windows from scratch because, if you have a running Windows installation, you should instead follow the steps detailed in KB5025885."

Is that right? Mosby is only intended for use if you are going to install Windows from scratch? Did I miss that in all the information I tried to absorb? Or is that a different scenario? (My head hurts!)

Hazel123 · Oct 12, 2025

Hazel123 said:
I still haven't done anything. Have they rolled out with windows update yet? Can't remember where to check if I have them or not.

It's ok I read back and found it. I still don't have it. I'd have thought that July kb update would have been in my new install of 25H2?

Winuser · Oct 12, 2025

Hazel123 said:
I still haven't done anything. Have they rolled out with windows update yet? Can't remember where to check if I have them or not.

I'm not sure about what I have done but so far what I have done hasn't caused me any problems. I'm going to leave the rest up to MS and the programmers of any of my third party programs that need the certs to take care of it. If not, I know how to turn off Secure Boot.

Winuser · Oct 12, 2025

wowchick said:
would this matter if i have secure boot off?

No. If Secure Boot is disabled the computer won't look for the certificates.

gunrunnerjohn · Oct 12, 2025

Phil_C said:
So--after spending several days reading this thread (and the one in the other forum), much of this scattershot information has managed to gel in my brain. I decided to try Mosby instead of the MS method. But then I saw this in the Rufus instructions:

"Please take note however that this guide is only intended for systems where you are going to install Windows from scratch because, if you have a running Windows installation, you should instead follow the steps detailed in KB5025885."

Is that right? Mosby is only intended for use if you are going to install Windows from scratch? Did I miss that in all the information I tried to absorb? Or is that a different scenario? (My head hurts!)

I used Mosby on a few running computers, it works fine. I'm curious where you read that you should use KB5025885, I can't find that in the Mosby readme file. I think that was just someone's opinion, not a statement of fact.

Mosby Readme

Truthfully, the KB5025885 process is way more painful than the simple Mosby process. There are also way more places to screw up using the Microsoft multi-step process.

Phil_C · Oct 12, 2025

gunrunnerjohn said:
I used Mosby on a few running computers, it works fine. I'm curious where you read that you should use KB5025885, I can't find that in the Mosby readme file. I think that was just someone's opinion, not a statement of fact.

The quote is directly from the Rufus FAQ regarding Mosby.

FAQ

Buddywh · Oct 12, 2025

Hazel123 said:
It's ok I read back and found it. I still don't have it. I'd have thought that July kb update would have been in my new install of 25H2?

View attachment 148684

Did you run the scripts in:

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

Hazel123 · Oct 12, 2025

Buddywh said:
Did you run the scripts in:

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

No - I found the article confusing

Phil_C · Oct 12, 2025

Buddywh said:
I installed the MOSBY keys in my three computers, all on running installs of 25H2.

I used RUFUS to create an EFI shell bootable USB using the Shell 2.2 option.

OK, thanks. Just wanted to make sure of what is working for (almost) everyone.

Buddywh · Oct 12, 2025

Hazel123 said:
No - I found the article confusing

As is most of the word salad Microsoft puts out LOL

Well, the new keys and scripts are (probably) all on the computer already. Microsoft is waiting until the time is right to run the scheduled tasks that push them into BIOS but you can initiate it manually... that KB article explains how. You can jump to the section titled: "Mitigation Deployment Guidelines" if you want, then read down a para. to "1. Install the updated certificate definitions to the DB."

It's advised to not revoke trust in the 2011 certificate (step 3.) unless you really understand what you are doing!

gunrunnerjohn · Oct 12, 2025

It's trivial to do the upgrade with Rufus and Mosby, much easier than with the Microsoft procedure. Also, the installation is a bit more secure without the shared Microsoft encoding.

Did you manually update your Secure Boot Keys ?

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Active member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Similar threads