Did you manually update your Secure Boot Keys ?


open with notepad and save as .bat all files
 

Attachments

My Computer My Computer

At a glance

windows 11 25H224GBiris xe
OS
windows 11 25H2
Computer type
Laptop
Manufacturer/Model
ASUS Vivobook 15 (X1504)
Motherboard
Intel Alder Lake-P PCH
Memory
24GB
Graphics Card(s)
iris xe
Sound Card
realtek
Screen Resolution
1920X1080
Hard Drives
Samsung SSD 990 PRO 1TB
Browser
edge
Antivirus
eset anti virus
andyc56 said:
I see you are using PowerShell 7 or similar, rather than Windows PowerShell (pwsh.exe rather than powershell.exe). The previously posted scripts have a bug when used with pwsh, as I originally noted in this post. @garlin posted a fix in a later post in response. I tried his fix and it worked.

I've attached the script with the modification below. This works with both PowerShell 7.x and Windows PowerShell. It also has his addition that picks up Mosby certificates if present.
Click to expand...
Thanks, but I don't know to run it.. I opened Powershell as admin pasted in the script it starts then closed PS seemingly before it completes.
 

My Computer My Computer

At a glance

Windows 11 Intel i5 10400 HD630 graphics chipi5-1040012 gbHD630 chipset
OS
Windows 11 Intel i5 10400 HD630 graphics chip
Computer type
PC/Desktop
Manufacturer/Model
HP
CPU
i5-10400
Memory
12 gb
Graphics Card(s)
HD630 chipset
Monitor(s) Displays
LG 24inch
Hard Drives
SSD, external usb drive 1tb for files/backups
Keyboard
wireless Logi
Mouse
ms 4000 wireless mouse
Internet Speed
10meg
Browser
Firefox
Antivirus
Defender
Other Info
Win11 Home 25h2 26200.8894 07/18/2026
neldog said:
That's a tough one where you received no information. Somewhere, back in this thread, there is a PowerShell script that when run can tell you about the status of your Secure Boot Certificates. I would point you to it, but I don't know where it is now... this thread is so long. Maybe someone else knows just where it is.
Click to expand...
u talking about this?

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing.
  • Look for the registry value named WindowsUEFICA2023Capable.
  • If the key exists and is set to 1, the system has the "Windows UEFI CA 2023" certificate in the DB, and the mitigation is in place.
  • If the key is set to 2, the certificate is in the DB, and the system is using the 2023 signed boot manager.
  • If the key is missing or set to 0, the certificate is not in the DB, and the system is not fully protected
 

My Computers My Computers

System One System Two

  • At a glance

    windows 11 home 23H2 22631.6199Intel core i7 (2nd gen) Turbo 3.10 ghz6gbAmd Radeon HD 7400m 1GB & Intel hd graphics
    OS
    windows 11 home 23H2 22631.6199
    Computer type
    Laptop
    Manufacturer/Model
    HP
    CPU
    Intel core i7 (2nd gen) Turbo 3.10 ghz
    Memory
    6gb
    Graphics Card(s)
    Amd Radeon HD 7400m 1GB & Intel hd graphics
    Sound Card
    BeatsAudio
    Hard Drives
    128gb SSD

  • At a glance

    macOS SequoiaM1 3.2 ghz8gb onboardigpu
    Operating System
    macOS Sequoia
    Computer type
    PC/Desktop
    Manufacturer/Model
    iMac 24"
    CPU
    M1 3.2 ghz
    Memory
    8gb onboard
    Graphics card(s)
    igpu
    Monitor(s) Displays
    Retina 4.5K
    Screen Resolution
    4480x2520
    Hard Drives
    512gb SSD
TheVisitor said:
Thanks, but I don't know to run it.. I opened Powershell as admin pasted in the script it starts then closed PS seemingly before it completes.
Click to expand...
Change the extension from .txt to .bat and double click the file.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 24H2Intel i7-1260P 12th Gen 4.7GHz32GB DDR4-3200NVIDIA T550 Laptop GPU
    OS
    Windows 11 Pro 24H2
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo P16s Workstation
    CPU
    Intel i7-1260P 12th Gen 4.7GHz
    Memory
    32GB DDR4-3200
    Graphics Card(s)
    NVIDIA T550 Laptop GPU
    Sound Card
    Realtek Audio
    Monitor(s) Displays
    16" Laptop Display
    Screen Resolution
    2560x1600
    Hard Drives
    2TB Samsung M.2 2280 SSD PCIe 4.0 x 4 NVMe
    Mouse
    Logitech MX Anywhere 2s
    Internet Speed
    1000 Mb
    Browser
    Firefox
    Antivirus
    Avast

  • At a glance

    Windows 11 Pro 24H2i7-6820HQ 6th Gen 3.6 GHz32GB DDR4-2133NVIDIA Quadro M2000M Laptop GPU
    Operating System
    Windows 11 Pro 24H2
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo P50 Workstation
    CPU
    i7-6820HQ 6th Gen 3.6 GHz
    Memory
    32GB DDR4-2133
    Graphics card(s)
    NVIDIA Quadro M2000M Laptop GPU
    Sound Card
    Realtek Audio
    Monitor(s) Displays
    15.6" Laptop Display
    Screen Resolution
    1920x1080
    Hard Drives
    2 x 1TB Samsung M.2 2280 SSD PCIe 3.0 x 4 NVMe
    Cooling
    Dual Fan System
    Mouse
    Logitech MX Anywhere 2s
    Internet Speed
    1000 Mb
    Browser
    Firefox
    Antivirus
    Avast
Phil_C said:
Change the extension from .txt to .bat and double click the file.
Click to expand...
OK got it to run this is what I got in return:
Secure Boot: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Windows UEFI CA 2023

UEFI DBX Certs
--------------

EFI Files
---------
Disk 0: Boot Manager [Production PCA 2011] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 1
[Windows UEFI CA 2023] is in UEFI DB.
 

My Computer My Computer

At a glance

Windows 11 Intel i5 10400 HD630 graphics chipi5-1040012 gbHD630 chipset
OS
Windows 11 Intel i5 10400 HD630 graphics chip
Computer type
PC/Desktop
Manufacturer/Model
HP
CPU
i5-10400
Memory
12 gb
Graphics Card(s)
HD630 chipset
Monitor(s) Displays
LG 24inch
Hard Drives
SSD, external usb drive 1tb for files/backups
Keyboard
wireless Logi
Mouse
ms 4000 wireless mouse
Internet Speed
10meg
Browser
Firefox
Antivirus
Defender
Other Info
Win11 Home 25h2 26200.8894 07/18/2026
I have two Dell systems, both under "My Computers". System 2 is eligible to have the CA 2023 update. My system #1 is not eligible for the CA 2023 BIOS update, as Dell won't update those systems that were built prior to 2020. Dell has posted several articles on which systems will or will not get the CA 2023 BIOS updates.
 

My Computers My Computers

System One System Two Other systems

  • At a glance

    Windows 11 Pro 25H2AMD Ryzen 9 7940HS32 GBRadeon 780M Graphics
    OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Geekom AX7 Pro
    CPU
    AMD Ryzen 9 7940HS
    Memory
    32 GB
    Graphics Card(s)
    Radeon 780M Graphics
    Monitor(s) Displays
    Dell S2425H 24"
    Screen Resolution
    1920 x 1080
    Hard Drives
    2 TB NVMe SSD
    Internet Speed
    100 Mbs
    Browser
    Microsoft Edge / Firefox
    Antivirus
    F-Secure Security Suite
    Other Info
    All secure boot certificates updated to CA 2023
    Windows Production PCA 2011 certificate has been revoked.

  • At a glance

    Windows 11 Pro 25H212th Gen Intel Core i7-12700 processor (12-Co...16 GBIntel(R) UHD Graphics 770 with shared graphic...
    Operating System
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Inspiron 3910
    CPU
    12th Gen Intel Core i7-12700 processor (12-Core, 25M Cache, 2.1GHz to 4.8GHz)
    Motherboard
    Dell 0KHP4K
    Memory
    16 GB
    Graphics card(s)
    Intel(R) UHD Graphics 770 with shared graphics memory
    Monitor(s) Displays
    Dell 27" Monitor S2721DS,
    Screen Resolution
    QHD 2560 x 1440 @ 75 Hz
    Hard Drives
    1TB M.2, PCIe NVMe, SSD
    Internet Speed
    100 Mbps
    Browser
    Edge
    Antivirus
    F-Secure Security Suite
    Other Info
    All secure boot certificates updated to CA 2023
    Windows Production PCA 2011 certificate has been revoked.
  • HP Laptop 15-fd0xxx
    OS: Windows 11 Home 25H2
    Processor: 13th Gen Intel(R) Core(TM) i7-1355U (1.70 GHz), 10 Cores, 12 Logical Processors
    BIOS Version: AMI F.26 4/22/2026
    RAM: 16 GB
    SSD: 1 TB
    Screen Resolution: 1920 x 1080
    All secure boot certificates updated to CA 2023 by factory.
TheVisitor said:
OK got it to run this is what I got in return:
Secure Boot: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Windows UEFI CA 2023

UEFI DBX Certs
--------------

EFI Files
---------
Disk 0: Boot Manager [Production PCA 2011] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 1
[Windows UEFI CA 2023] is in UEFI DB.
Click to expand...
You have the 2023 Windows CA present, but not in use. Look here:

Registry key updates for Secure Boot: Windows devices with IT-managed updates

About two-thirds down the page you will see "Device testing using registry keys".

Run the two commands as described there. You might need a restart. Then run your script again to see results.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 24H2Intel i7-1260P 12th Gen 4.7GHz32GB DDR4-3200NVIDIA T550 Laptop GPU
    OS
    Windows 11 Pro 24H2
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo P16s Workstation
    CPU
    Intel i7-1260P 12th Gen 4.7GHz
    Memory
    32GB DDR4-3200
    Graphics Card(s)
    NVIDIA T550 Laptop GPU
    Sound Card
    Realtek Audio
    Monitor(s) Displays
    16" Laptop Display
    Screen Resolution
    2560x1600
    Hard Drives
    2TB Samsung M.2 2280 SSD PCIe 4.0 x 4 NVMe
    Mouse
    Logitech MX Anywhere 2s
    Internet Speed
    1000 Mb
    Browser
    Firefox
    Antivirus
    Avast

  • At a glance

    Windows 11 Pro 24H2i7-6820HQ 6th Gen 3.6 GHz32GB DDR4-2133NVIDIA Quadro M2000M Laptop GPU
    Operating System
    Windows 11 Pro 24H2
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo P50 Workstation
    CPU
    i7-6820HQ 6th Gen 3.6 GHz
    Memory
    32GB DDR4-2133
    Graphics card(s)
    NVIDIA Quadro M2000M Laptop GPU
    Sound Card
    Realtek Audio
    Monitor(s) Displays
    15.6" Laptop Display
    Screen Resolution
    1920x1080
    Hard Drives
    2 x 1TB Samsung M.2 2280 SSD PCIe 3.0 x 4 NVMe
    Cooling
    Dual Fan System
    Mouse
    Logitech MX Anywhere 2s
    Internet Speed
    1000 Mb
    Browser
    Firefox
    Antivirus
    Avast
TheVisitor said:
I got a Bios update for my HP a couple days ago, but I can't find any info on what it contains. Quick googling around try to find in seems the only
thing I can find is HP covers up any info for security so no one can spoof the BIOS into something else.

So I have no idea if the CA's in the BIOS are updated. The BIOS installed was:
HP Inc. Driver Update (15.54.0.0) Device Manager shows date of: 8/15/2025 This update came through WU.
Click to expand...

Download the following (from upper right corner - 3rd option right to RAW):

github.com

Check-UEFISecureBootVariables/Check UEFI KEK, DB and DBX.ps1 at main · cjee21/Check-UEFISecureBootVariables

PowerShell scripts to check the UEFI KEK, DB and DBX Secure Boot variables. - cjee21/Check-UEFISecureBootVariables
github.com github.com

github.com

Check-UEFISecureBootVariables/Check UEFI KEK, DB and DBX.cmd at main · cjee21/Check-UEFISecureBootVariables

PowerShell scripts to check the UEFI KEK, DB and DBX Secure Boot variables. - cjee21/Check-UEFISecureBootVariables
github.com github.com

Copy both of them in C:/ partition and right click - open the Check UEFI KEK, DB and DBX.cmd file as Admin. Didn't give direct links - cause you should always check the content of a script - and this way - you can see the contents (and that it's a clean script - no external links to embed malware and such). You will get this:

460220957-efa6fcfb-c505-43aa-8c19-c30d10bc6f60.png


As can be seen above - the Green Checked marks are Applied, the Red X-ed - are not. See what you have.
 
Last edited:

My Computer My Computer

At a glance

WinDOS 25H2Intel & AMDSO-DIMM SK Hynix 15.8 GB Dual-Channel DDR4-26...nVidia RTX 2060 6GB Mobile GPU (TU106M)
OS
WinDOS 25H2
Computer type
Laptop
CPU
Intel & AMD
Memory
SO-DIMM SK Hynix 15.8 GB Dual-Channel DDR4-2666 (2 x 8 GB) 1329MHz (19-19-19-43)
Graphics Card(s)
nVidia RTX 2060 6GB Mobile GPU (TU106M)
Sound Card
Onbord Realtek ALC1220
Screen Resolution
1920 x 1080
Hard Drives
1x Samsung PM981 NVMe PCIe M.2 512GB / 1x Seagate Expansion ST1000LM035 1TB
wabbit said:
I have two Dell systems, both under "My Computers". System 2 is eligible to have the CA 2023 update. My system #1 is not eligible for the CA 2023 BIOS update, as Dell won't update those systems that were built prior to 2020. Dell has posted several articles on which systems will or will not get the CA 2023 BIOS updates.
Click to expand...
That must be why I do not see the BIOS update for my System Two - that is a 2019 machine. I guess it will be up to Microsoft to get it than, (unless we have to do it ourselves). :oops:
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 25H2 26200.8894Intel® Core™ Ultra 7 265 1.8GHz to 5.3GHz (Ar...SK Hynix 32GB DDR5 5600 Desktop RAM UDIMM Non...Dell NVIDIA® GeForce RTX™ 4060 8GB GDDR6 & (i...
    OS
    Windows 11 Pro 25H2 26200.8894
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Tower Plus EBT2250, DOB: 06/15/2025
    CPU
    Intel® Core™ Ultra 7 265 1.8GHz to 5.3GHz (Arrow Lake)
    Motherboard
    Dell Inc. 02D3NT A00 (U3E1)
    Memory
    SK Hynix 32GB DDR5 5600 Desktop RAM UDIMM Non-ECC PC5-5600B
    Graphics Card(s)
    Dell NVIDIA® GeForce RTX™ 4060 8GB GDDR6 & (iGPU) Integrated Intel® UHD Graphics
    Sound Card
    Chipset Realtek High-Definition Audio with Dolby Atmos
    Monitor(s) Displays
    Dell Ultra Sharp U2515H 25-Inch Screen LED-Lit
    Screen Resolution
    2560 X 1440
    Hard Drives
    Samsung (NVMe PM9C1a 1024GB) M.2 PCIe NVMe Solid State Drive (OS), with Samsung Piccolo (S4LY022) 6-Core 4 Channel Controller.

    Samsung T7 500GB SSD, USB-C External Drive
    PSU
    Dell 460W
    Case
    Dell Tower Plus EBT 2250
    Cooling
    Fan
    Keyboard
    Dell Wired Keyboard - KB216
    Mouse
    Logitech M510
    Internet Speed
    Intel Killer E3100G 2.5 Gigabit Ethernet Controller
    Browser
    Microsoft Edge
    Antivirus
    Microsoft Windows Security
    Other Info
    The Samsung NVMe PM9C1a 1024GB SSD does not use a Phison NAND controller. Instead, it uses Samsung's in-house developed Piccolo (S4LY022) 6-Core 4 Channel Controller. The PM9C1a utilizes a controller built using Samsung's 5-nanometer process and seventh-generation V-NAND technology. 🤔

  • At a glance

    Windows 11 Pro 25H2 26200.889410th Generation Intel Core i7-10510U Processo...16GB DDR4 RAMNVIDIA® GeForce® MX250 with 2GB GDDR5 graphic...
    Operating System
    Windows 11 Pro 25H2 26200.8894
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 15 7000 (7591) 2-in-1, DOB: 11/30/2019
    CPU
    10th Generation Intel Core i7-10510U Processor (8MB Cache, up to 4.9 GHz) Comet Lake
    Motherboard
    Dell 0NNW5N
    Memory
    16GB DDR4 RAM
    Graphics card(s)
    NVIDIA® GeForce® MX250 with 2GB GDDR5 graphics memory
    Sound Card
    Chipset Realtek ALC3254 🤔
    Monitor(s) Displays
    Dell 15.6-inch UHD Truelife Touch Narrow Border WVA Display with Active Pen support
    Screen Resolution
    3840 x 2160
    Hard Drives
    Intel NVME 512GB SSD with 32GB Intel Optane Memory, M.2 80mm PCIe 3.0 RAID

    SanDisk 256GB Extreme microSDXC UHS-I Memory Card
    PSU
    Dell 4-Cell Battery, 68 Whr (Integrated), 90 Watt AC Adapter
    Case
    Dell Inspiron 15 7000 2-in-1 (7591)
    Cooling
    Standard Dell Case Fan & Havit HV-F2056 USB Powered (3 Fans) Laptop Cooling Pad.
    Keyboard
    Dell
    Mouse
    Logitech Wireless Mouse M650L
    Internet Speed
    Wireless/Wired connectivity (WiFi 6 - 802.11 ax)
    Browser
    Microsoft Edge
    Antivirus
    Microsoft Windows Security
    Other Info
    From Dell: 512GB NVME Solid State Drive accelerated by 32GB Intel Optane Memory are the fastest as compared to NAND SSDs. Intel Optane H10 with SSD offers speedy storage and accelerates opening your programs.
HarleyQuinn said:
u talking about this?

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing.
  • Look for the registry value named WindowsUEFICA2023Capable.
  • If the key exists and is set to 1, the system has the "Windows UEFI CA 2023" certificate in the DB, and the mitigation is in place.
  • If the key is set to 2, the certificate is in the DB, and the system is using the 2023 signed boot manager.
  • If the key is missing or set to 0, the certificate is not in the DB, and the system is not fully protected
Click to expand...
No, that is not the script I was talking about. I think @neves just above this post of mine here, is what you need.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 25H2 26200.8894Intel® Core™ Ultra 7 265 1.8GHz to 5.3GHz (Ar...SK Hynix 32GB DDR5 5600 Desktop RAM UDIMM Non...Dell NVIDIA® GeForce RTX™ 4060 8GB GDDR6 & (i...
    OS
    Windows 11 Pro 25H2 26200.8894
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Tower Plus EBT2250, DOB: 06/15/2025
    CPU
    Intel® Core™ Ultra 7 265 1.8GHz to 5.3GHz (Arrow Lake)
    Motherboard
    Dell Inc. 02D3NT A00 (U3E1)
    Memory
    SK Hynix 32GB DDR5 5600 Desktop RAM UDIMM Non-ECC PC5-5600B
    Graphics Card(s)
    Dell NVIDIA® GeForce RTX™ 4060 8GB GDDR6 & (iGPU) Integrated Intel® UHD Graphics
    Sound Card
    Chipset Realtek High-Definition Audio with Dolby Atmos
    Monitor(s) Displays
    Dell Ultra Sharp U2515H 25-Inch Screen LED-Lit
    Screen Resolution
    2560 X 1440
    Hard Drives
    Samsung (NVMe PM9C1a 1024GB) M.2 PCIe NVMe Solid State Drive (OS), with Samsung Piccolo (S4LY022) 6-Core 4 Channel Controller.

    Samsung T7 500GB SSD, USB-C External Drive
    PSU
    Dell 460W
    Case
    Dell Tower Plus EBT 2250
    Cooling
    Fan
    Keyboard
    Dell Wired Keyboard - KB216
    Mouse
    Logitech M510
    Internet Speed
    Intel Killer E3100G 2.5 Gigabit Ethernet Controller
    Browser
    Microsoft Edge
    Antivirus
    Microsoft Windows Security
    Other Info
    The Samsung NVMe PM9C1a 1024GB SSD does not use a Phison NAND controller. Instead, it uses Samsung's in-house developed Piccolo (S4LY022) 6-Core 4 Channel Controller. The PM9C1a utilizes a controller built using Samsung's 5-nanometer process and seventh-generation V-NAND technology. 🤔

  • At a glance

    Windows 11 Pro 25H2 26200.889410th Generation Intel Core i7-10510U Processo...16GB DDR4 RAMNVIDIA® GeForce® MX250 with 2GB GDDR5 graphic...
    Operating System
    Windows 11 Pro 25H2 26200.8894
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 15 7000 (7591) 2-in-1, DOB: 11/30/2019
    CPU
    10th Generation Intel Core i7-10510U Processor (8MB Cache, up to 4.9 GHz) Comet Lake
    Motherboard
    Dell 0NNW5N
    Memory
    16GB DDR4 RAM
    Graphics card(s)
    NVIDIA® GeForce® MX250 with 2GB GDDR5 graphics memory
    Sound Card
    Chipset Realtek ALC3254 🤔
    Monitor(s) Displays
    Dell 15.6-inch UHD Truelife Touch Narrow Border WVA Display with Active Pen support
    Screen Resolution
    3840 x 2160
    Hard Drives
    Intel NVME 512GB SSD with 32GB Intel Optane Memory, M.2 80mm PCIe 3.0 RAID

    SanDisk 256GB Extreme microSDXC UHS-I Memory Card
    PSU
    Dell 4-Cell Battery, 68 Whr (Integrated), 90 Watt AC Adapter
    Case
    Dell Inspiron 15 7000 2-in-1 (7591)
    Cooling
    Standard Dell Case Fan & Havit HV-F2056 USB Powered (3 Fans) Laptop Cooling Pad.
    Keyboard
    Dell
    Mouse
    Logitech Wireless Mouse M650L
    Internet Speed
    Wireless/Wired connectivity (WiFi 6 - 802.11 ax)
    Browser
    Microsoft Edge
    Antivirus
    Microsoft Windows Security
    Other Info
    From Dell: 512GB NVME Solid State Drive accelerated by 32GB Intel Optane Memory are the fastest as compared to NAND SSDs. Intel Optane H10 with SSD offers speedy storage and accelerates opening your programs.
HarleyQuinn said:
u talking about this?

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing.
  • Look for the registry value named WindowsUEFICA2023Capable.
  • If the key exists and is set to 1, the system has the "Windows UEFI CA 2023" certificate in the DB, and the mitigation is in place.
  • If the key is set to 2, the certificate is in the DB, and the system is using the 2023 signed boot manager.
  • If the key is missing or set to 0, the certificate is not in the DB, and the system is not fully protected
Click to expand...
The script I was talking about is named this: EFIBootFileUpdated.ps1. But I can't seem to find it. It is in this thread somewhere.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 25H2 26200.8894Intel® Core™ Ultra 7 265 1.8GHz to 5.3GHz (Ar...SK Hynix 32GB DDR5 5600 Desktop RAM UDIMM Non...Dell NVIDIA® GeForce RTX™ 4060 8GB GDDR6 & (i...
    OS
    Windows 11 Pro 25H2 26200.8894
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Tower Plus EBT2250, DOB: 06/15/2025
    CPU
    Intel® Core™ Ultra 7 265 1.8GHz to 5.3GHz (Arrow Lake)
    Motherboard
    Dell Inc. 02D3NT A00 (U3E1)
    Memory
    SK Hynix 32GB DDR5 5600 Desktop RAM UDIMM Non-ECC PC5-5600B
    Graphics Card(s)
    Dell NVIDIA® GeForce RTX™ 4060 8GB GDDR6 & (iGPU) Integrated Intel® UHD Graphics
    Sound Card
    Chipset Realtek High-Definition Audio with Dolby Atmos
    Monitor(s) Displays
    Dell Ultra Sharp U2515H 25-Inch Screen LED-Lit
    Screen Resolution
    2560 X 1440
    Hard Drives
    Samsung (NVMe PM9C1a 1024GB) M.2 PCIe NVMe Solid State Drive (OS), with Samsung Piccolo (S4LY022) 6-Core 4 Channel Controller.

    Samsung T7 500GB SSD, USB-C External Drive
    PSU
    Dell 460W
    Case
    Dell Tower Plus EBT 2250
    Cooling
    Fan
    Keyboard
    Dell Wired Keyboard - KB216
    Mouse
    Logitech M510
    Internet Speed
    Intel Killer E3100G 2.5 Gigabit Ethernet Controller
    Browser
    Microsoft Edge
    Antivirus
    Microsoft Windows Security
    Other Info
    The Samsung NVMe PM9C1a 1024GB SSD does not use a Phison NAND controller. Instead, it uses Samsung's in-house developed Piccolo (S4LY022) 6-Core 4 Channel Controller. The PM9C1a utilizes a controller built using Samsung's 5-nanometer process and seventh-generation V-NAND technology. 🤔

  • At a glance

    Windows 11 Pro 25H2 26200.889410th Generation Intel Core i7-10510U Processo...16GB DDR4 RAMNVIDIA® GeForce® MX250 with 2GB GDDR5 graphic...
    Operating System
    Windows 11 Pro 25H2 26200.8894
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 15 7000 (7591) 2-in-1, DOB: 11/30/2019
    CPU
    10th Generation Intel Core i7-10510U Processor (8MB Cache, up to 4.9 GHz) Comet Lake
    Motherboard
    Dell 0NNW5N
    Memory
    16GB DDR4 RAM
    Graphics card(s)
    NVIDIA® GeForce® MX250 with 2GB GDDR5 graphics memory
    Sound Card
    Chipset Realtek ALC3254 🤔
    Monitor(s) Displays
    Dell 15.6-inch UHD Truelife Touch Narrow Border WVA Display with Active Pen support
    Screen Resolution
    3840 x 2160
    Hard Drives
    Intel NVME 512GB SSD with 32GB Intel Optane Memory, M.2 80mm PCIe 3.0 RAID

    SanDisk 256GB Extreme microSDXC UHS-I Memory Card
    PSU
    Dell 4-Cell Battery, 68 Whr (Integrated), 90 Watt AC Adapter
    Case
    Dell Inspiron 15 7000 2-in-1 (7591)
    Cooling
    Standard Dell Case Fan & Havit HV-F2056 USB Powered (3 Fans) Laptop Cooling Pad.
    Keyboard
    Dell
    Mouse
    Logitech Wireless Mouse M650L
    Internet Speed
    Wireless/Wired connectivity (WiFi 6 - 802.11 ax)
    Browser
    Microsoft Edge
    Antivirus
    Microsoft Windows Security
    Other Info
    From Dell: 512GB NVME Solid State Drive accelerated by 32GB Intel Optane Memory are the fastest as compared to NAND SSDs. Intel Optane H10 with SSD offers speedy storage and accelerates opening your programs.
Phil_C said:
See here:

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932

The steps in #2 will verify what you have. Be VERY sure everything looks right and is working properly before revoking the 2011 CA. Check all bootable flash drives, etc,
Click to expand...

Thanks, I'll do that.

Tangent question: If my system has a recovery partition, does it need some sort of updating in order to function in the future if I ever need it? Is it now obsolete and a bootable USB is the only go-to option?
 

My Computer My Computer

At a glance

Windows 11 Pro 24H2Intel Ultra 7 155H16gbIntel Arc integrated
OS
Windows 11 Pro 24H2
Computer type
Laptop
Manufacturer/Model
HP
CPU
Intel Ultra 7 155H
Memory
16gb
Graphics Card(s)
Intel Arc integrated
Hard Drives
SSD
Levitate11 said:
Thanks, I'll do that.

Tangent question: If my system has a recovery partition, does it need some sort of updating in order to function in the future if I ever need it? Is it now obsolete and a bootable USB is the only go-to option?
Click to expand...
I don't know. My guess is that the recovery partition uses the same bootloader in the EFI, and would therefore work normally.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 24H2Intel i7-1260P 12th Gen 4.7GHz32GB DDR4-3200NVIDIA T550 Laptop GPU
    OS
    Windows 11 Pro 24H2
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo P16s Workstation
    CPU
    Intel i7-1260P 12th Gen 4.7GHz
    Memory
    32GB DDR4-3200
    Graphics Card(s)
    NVIDIA T550 Laptop GPU
    Sound Card
    Realtek Audio
    Monitor(s) Displays
    16" Laptop Display
    Screen Resolution
    2560x1600
    Hard Drives
    2TB Samsung M.2 2280 SSD PCIe 4.0 x 4 NVMe
    Mouse
    Logitech MX Anywhere 2s
    Internet Speed
    1000 Mb
    Browser
    Firefox
    Antivirus
    Avast

  • At a glance

    Windows 11 Pro 24H2i7-6820HQ 6th Gen 3.6 GHz32GB DDR4-2133NVIDIA Quadro M2000M Laptop GPU
    Operating System
    Windows 11 Pro 24H2
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo P50 Workstation
    CPU
    i7-6820HQ 6th Gen 3.6 GHz
    Memory
    32GB DDR4-2133
    Graphics card(s)
    NVIDIA Quadro M2000M Laptop GPU
    Sound Card
    Realtek Audio
    Monitor(s) Displays
    15.6" Laptop Display
    Screen Resolution
    1920x1080
    Hard Drives
    2 x 1TB Samsung M.2 2280 SSD PCIe 3.0 x 4 NVMe
    Cooling
    Dual Fan System
    Mouse
    Logitech MX Anywhere 2s
    Internet Speed
    1000 Mb
    Browser
    Firefox
    Antivirus
    Avast
Phil_C said:
I don't know. My guess is that the recovery partition uses the same bootloader in the EFI, and would therefore work normally.
Click to expand...

Yeah...my thought is around the portions of the updates that are happening on the Windows side as we "correct" the SB features. Will an old version of Windows interface with that? is the SB loader process entirely MoBo based and outside the scope of a recovery partition?

En-quiring minds want to know.
 

My Computer My Computer

At a glance

Windows 11 Pro 24H2Intel Ultra 7 155H16gbIntel Arc integrated
OS
Windows 11 Pro 24H2
Computer type
Laptop
Manufacturer/Model
HP
CPU
Intel Ultra 7 155H
Memory
16gb
Graphics Card(s)
Intel Arc integrated
Hard Drives
SSD
neves said:
Download the following (from upper right corner - 3rd option right to RAW):

github.com

Check-UEFISecureBootVariables/Check UEFI KEK, DB and DBX.ps1 at main · cjee21/Check-UEFISecureBootVariables

PowerShell scripts to check the UEFI KEK, DB and DBX Secure Boot variables. - cjee21/Check-UEFISecureBootVariables
github.com github.com

github.com

Check-UEFISecureBootVariables/Check UEFI KEK, DB and DBX.cmd at main · cjee21/Check-UEFISecureBootVariables

PowerShell scripts to check the UEFI KEK, DB and DBX Secure Boot variables. - cjee21/Check-UEFISecureBootVariables
github.com github.com

Copy them on C:/ and right click - open the Check UEFI KEK, DB and DBX.cmd file as Admin. Didn't give direct links - cause you should always check the content of a script - and this way - you can see the contents (and that it's a clean script - no external links to embed malware and such). You will get this:

460220957-efa6fcfb-c505-43aa-8c19-c30d10bc6f60.png


As can be seen above - the Green Checked marks are Applied, the Red X-ed - are not. See what you have.
Click to expand...
Finally figured out to run the commands, this is the result:
Checking for Administrator permission...
Running as administrator - continuing execution...

22 October 2025
Manufacturer: HP
Model: HP Pavilion Desktop TP01-1xxx
BIOS: AMI, F.54, F.54, HPQOEM - 1072009
Windows version: 25H2 (Build 26200.6901)

Secure Boot status: Enabled

Current UEFI KEK
√ Microsoft Corporation KEK CA 2011 (revoked: False)
X Microsoft Corporation KEK 2K CA 2023

Default UEFI KEK
√ Microsoft Corporation KEK CA 2011 (revoked: False)
X Microsoft Corporation KEK 2K CA 2023

Current UEFI DB
√ Microsoft Windows Production PCA 2011 (revoked: False)
√ Microsoft Corporation UEFI CA 2011 (revoked: False)
√ Windows UEFI CA 2023 (revoked: False)
X Microsoft UEFI CA 2023
X Microsoft Option ROM UEFI CA 2023

Default UEFI DB
√ Microsoft Windows Production PCA 2011 (revoked: False)
√ Microsoft Corporation UEFI CA 2011 (revoked: False)
X Windows UEFI CA 2023
X Microsoft UEFI CA 2023
X Microsoft Option ROM UEFI CA 2023

Current UEFI DBX (only the latest one is needed to be secure)
2023-03-14 : FAIL: Check DBX failed
2023-05-09 : FAIL: Check DBX failed
2025-01-14 (v1.3.1) : FAIL: Check DBX failed
2025-06-11 (v1.5.1) : FAIL: Check DBX failed

Press any key to continue . . .

So seems like I'm OK so far except for the DBX and I've not yet been brave enough to do the IT registry stuff.
 

My Computer My Computer

At a glance

Windows 11 Intel i5 10400 HD630 graphics chipi5-1040012 gbHD630 chipset
OS
Windows 11 Intel i5 10400 HD630 graphics chip
Computer type
PC/Desktop
Manufacturer/Model
HP
CPU
i5-10400
Memory
12 gb
Graphics Card(s)
HD630 chipset
Monitor(s) Displays
LG 24inch
Hard Drives
SSD, external usb drive 1tb for files/backups
Keyboard
wireless Logi
Mouse
ms 4000 wireless mouse
Internet Speed
10meg
Browser
Firefox
Antivirus
Defender
Other Info
Win11 Home 25h2 26200.8894 07/18/2026
TheVisitor said:
Finally figured out to run the commands, this is the result:
Checking for Administrator permission...
Running as administrator - continuing execution...

22 October 2025
Manufacturer: HP
Model: HP Pavilion Desktop TP01-1xxx
BIOS: AMI, F.54, F.54, HPQOEM - 1072009
Windows version: 25H2 (Build 26200.6901)

Secure Boot status: Enabled

Current UEFI KEK
√ Microsoft Corporation KEK CA 2011 (revoked: False)
X Microsoft Corporation KEK 2K CA 2023

Default UEFI KEK
√ Microsoft Corporation KEK CA 2011 (revoked: False)
X Microsoft Corporation KEK 2K CA 2023

Current UEFI DB
√ Microsoft Windows Production PCA 2011 (revoked: False)
√ Microsoft Corporation UEFI CA 2011 (revoked: False)
√ Windows UEFI CA 2023 (revoked: False)
X Microsoft UEFI CA 2023
X Microsoft Option ROM UEFI CA 2023

Default UEFI DB
√ Microsoft Windows Production PCA 2011 (revoked: False)
√ Microsoft Corporation UEFI CA 2011 (revoked: False)
X Windows UEFI CA 2023
X Microsoft UEFI CA 2023
X Microsoft Option ROM UEFI CA 2023

Current UEFI DBX (only the latest one is needed to be secure)
2023-03-14 : FAIL: Check DBX failed
2023-05-09 : FAIL: Check DBX failed
2025-01-14 (v1.3.1) : FAIL: Check DBX failed
2025-06-11 (v1.5.1) : FAIL: Check DBX failed

Press any key to continue . . .

So seems like I'm OK so far except for the DBX and I've not yet been brave enough to do the IT registry stuff.
Click to expand...
Yup you have everything except revocation in the dbx. HP did what they needed to do (y)

Edit: Check DBX failed, maybe it's a script error!
 

My Computer My Computer

At a glance

windows 11
OS
windows 11
Buddywh said:
All that's left is to revoke the 2011 key if you need that before Microsoft does it for us.
Click to expand...

It's been revoked. Here's my output I posted above.

1761155237826.webp
 

My Computers My Computers

System One System Two Other systems

  • At a glance

    Win 11 Pro 25H2 26200.8894Intel® Core™ i7-14700KG.SKILL Ripjaws S5 Series 64GB (2 x 32GB) DDR5ASUS GeForce RTX 4070 Super 12GB
    OS
    Win 11 Pro 25H2 26200.8894
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self Built
    CPU
    Intel® Core™ i7-14700K
    Motherboard
    ASUS TUF Z690-PLUS WIFI (BIOS 4505)
    Memory
    G.SKILL Ripjaws S5 Series 64GB (2 x 32GB) DDR5
    Graphics Card(s)
    ASUS GeForce RTX 4070 Super 12GB
    Sound Card
    Sound Blaster AE-5 Plus
    Monitor(s) Displays
    ASUS TUF Gaming 27" 2K HDR Gaming
    Screen Resolution
    2560 x 1440
    Hard Drives
    Samsung 990 Pro 1TB NVMe (Win 11 25H2)
    SK hynix P41 500GB NVMe
    SK hynix P41 2TB NVMe (x3)
    Crucial P3 Plus 4TB
    PSU
    Corsair RM850x Shift
    Case
    Antec Dark Phantom DP502 FLUX
    Cooling
    Corsair Nautilus 360 RS AIO
    Keyboard
    Logitech MK 320
    Mouse
    Razer Basilisk V3
    Internet Speed
    750Mbs
    Browser
    Firefox
    Antivirus
    Winows Security
    Other Info
    MR 8.1 Home

  • At a glance

    Win 11 Pro 25H2 26200.8894Intel Core i5-1140064 GB DDR4MSI GeForce RTX 3060 Ventus 2X 12GB
    Operating System
    Win 11 Pro 25H2 26200.8894
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self Built
    CPU
    Intel Core i5-11400
    Motherboard
    Asus TUF Gaming Z590 Plus WiFi (BIOS 2803)
    Memory
    64 GB DDR4
    Graphics card(s)
    MSI GeForce RTX 3060 Ventus 2X 12GB
    Sound Card
    SoundBlaster Audigy Fx V2
    Monitor(s) Displays
    Samsung F27T350
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 980 Pro 1TB
    Samsung 970 EVO Plus 2TB
    Samsung 870 EVO 500GB SSD
    PSU
    Corsair HX750
    Case
    Cougar MX330-G Window
    Cooling
    Thermalright Frozen Edge 240 Black AIO
    Internet Speed
    350Mbps
    Browser
    Firefox
    Antivirus
    Windows Security
  • System Three
    Win 11 Pro 25H2 26200.8894
    ASUS PRIME Z370-P II BIOS 3004 7/12/21
    Intel Core i7-8700 CPU @ 3.20GHz
    32GB DDR4 RAM (4x8)
    iGPU Intel UHD Graphics 630
    Mid-Tower Desktop
neldog said:
The script I was talking about is named this: EFIBootFileUpdated.ps1. But I can't seem to find it. It is in this thread somewhere.
Click to expand...
yeah mine was just a reg page to check if your system running on ca 2023. I've also encountered some HP users not manage to check their system properly with powershell and this is what hp expert informed community
 

Attachments

  • ss(81).webp
    ss(81).webp
    57.8 KB · Views: 9

My Computers My Computers

System One System Two

  • At a glance

    windows 11 home 23H2 22631.6199Intel core i7 (2nd gen) Turbo 3.10 ghz6gbAmd Radeon HD 7400m 1GB & Intel hd graphics
    OS
    windows 11 home 23H2 22631.6199
    Computer type
    Laptop
    Manufacturer/Model
    HP
    CPU
    Intel core i7 (2nd gen) Turbo 3.10 ghz
    Memory
    6gb
    Graphics Card(s)
    Amd Radeon HD 7400m 1GB & Intel hd graphics
    Sound Card
    BeatsAudio
    Hard Drives
    128gb SSD

  • At a glance

    macOS SequoiaM1 3.2 ghz8gb onboardigpu
    Operating System
    macOS Sequoia
    Computer type
    PC/Desktop
    Manufacturer/Model
    iMac 24"
    CPU
    M1 3.2 ghz
    Memory
    8gb onboard
    Graphics card(s)
    igpu
    Monitor(s) Displays
    Retina 4.5K
    Screen Resolution
    4480x2520
    Hard Drives
    512gb SSD

My Computer My Computer

At a glance

Windows 11 Home x64 Version 25H2 Build 26200....
OS
Windows 11 Home x64 Version 25H2 Build 26200.8037
Scott said:
It's been revoked. Here's my output I posted above.

View attachment 150100
Click to expand...
If you don't mind, I would like to ask how you got your USB drives to show up like they are? I have everything like yours, but no USB drives displayed. :(
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 25H2 26200.8894Intel® Core™ Ultra 7 265 1.8GHz to 5.3GHz (Ar...SK Hynix 32GB DDR5 5600 Desktop RAM UDIMM Non...Dell NVIDIA® GeForce RTX™ 4060 8GB GDDR6 & (i...
    OS
    Windows 11 Pro 25H2 26200.8894
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell Tower Plus EBT2250, DOB: 06/15/2025
    CPU
    Intel® Core™ Ultra 7 265 1.8GHz to 5.3GHz (Arrow Lake)
    Motherboard
    Dell Inc. 02D3NT A00 (U3E1)
    Memory
    SK Hynix 32GB DDR5 5600 Desktop RAM UDIMM Non-ECC PC5-5600B
    Graphics Card(s)
    Dell NVIDIA® GeForce RTX™ 4060 8GB GDDR6 & (iGPU) Integrated Intel® UHD Graphics
    Sound Card
    Chipset Realtek High-Definition Audio with Dolby Atmos
    Monitor(s) Displays
    Dell Ultra Sharp U2515H 25-Inch Screen LED-Lit
    Screen Resolution
    2560 X 1440
    Hard Drives
    Samsung (NVMe PM9C1a 1024GB) M.2 PCIe NVMe Solid State Drive (OS), with Samsung Piccolo (S4LY022) 6-Core 4 Channel Controller.

    Samsung T7 500GB SSD, USB-C External Drive
    PSU
    Dell 460W
    Case
    Dell Tower Plus EBT 2250
    Cooling
    Fan
    Keyboard
    Dell Wired Keyboard - KB216
    Mouse
    Logitech M510
    Internet Speed
    Intel Killer E3100G 2.5 Gigabit Ethernet Controller
    Browser
    Microsoft Edge
    Antivirus
    Microsoft Windows Security
    Other Info
    The Samsung NVMe PM9C1a 1024GB SSD does not use a Phison NAND controller. Instead, it uses Samsung's in-house developed Piccolo (S4LY022) 6-Core 4 Channel Controller. The PM9C1a utilizes a controller built using Samsung's 5-nanometer process and seventh-generation V-NAND technology. 🤔

  • At a glance

    Windows 11 Pro 25H2 26200.889410th Generation Intel Core i7-10510U Processo...16GB DDR4 RAMNVIDIA® GeForce® MX250 with 2GB GDDR5 graphic...
    Operating System
    Windows 11 Pro 25H2 26200.8894
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 15 7000 (7591) 2-in-1, DOB: 11/30/2019
    CPU
    10th Generation Intel Core i7-10510U Processor (8MB Cache, up to 4.9 GHz) Comet Lake
    Motherboard
    Dell 0NNW5N
    Memory
    16GB DDR4 RAM
    Graphics card(s)
    NVIDIA® GeForce® MX250 with 2GB GDDR5 graphics memory
    Sound Card
    Chipset Realtek ALC3254 🤔
    Monitor(s) Displays
    Dell 15.6-inch UHD Truelife Touch Narrow Border WVA Display with Active Pen support
    Screen Resolution
    3840 x 2160
    Hard Drives
    Intel NVME 512GB SSD with 32GB Intel Optane Memory, M.2 80mm PCIe 3.0 RAID

    SanDisk 256GB Extreme microSDXC UHS-I Memory Card
    PSU
    Dell 4-Cell Battery, 68 Whr (Integrated), 90 Watt AC Adapter
    Case
    Dell Inspiron 15 7000 2-in-1 (7591)
    Cooling
    Standard Dell Case Fan & Havit HV-F2056 USB Powered (3 Fans) Laptop Cooling Pad.
    Keyboard
    Dell
    Mouse
    Logitech Wireless Mouse M650L
    Internet Speed
    Wireless/Wired connectivity (WiFi 6 - 802.11 ax)
    Browser
    Microsoft Edge
    Antivirus
    Microsoft Windows Security
    Other Info
    From Dell: 512GB NVME Solid State Drive accelerated by 32GB Intel Optane Memory are the fastest as compared to NAND SSDs. Intel Optane H10 with SSD offers speedy storage and accelerates opening your programs.
You must log in or register to reply here.

Similar threads

Solved Secure boot update HowTo
31 32 33
Replies
645
Views
111K
TrebleTA
T
  • Sticky
  • Article Article
Updating Microsoft Secure Boot keys before expiration in June 2026
26 27 28
Replies
559
Views
115K
Brink
Brink

Latest Support Threads

Latest Tutorials

Back
Top Bottom