Did you manually update your Secure Boot Keys ?

666pierog · Nov 24, 2025

Buddywh said:
If you're not positive your Windows is using 2023 signed secure boot manager files then do not revoke the 2011 Windows CA or your Windows will not start with Secure Boot enabled.

And where are you getting your secure boot objects? Assuming you're trying to "append" to DBX... you might need to use signed binary objects you can get from Microsoft's GitHub (below). Just don't do this until you've saved a copy of bitlocker keys (if using it) AND you KNOW your Windows is running with 2023- signed boot manager files.

secureboot_objects/PostSignedObjects at main · microsoft/secureboot_objects

Secure boot objects recommended by Microsoft. Contribute to microsoft/secureboot_objects development by creating an account on GitHub.

github.com

I already have the 2023 certificate. I downloaded the latest version of Windows, followed the steps in the guide, and received it. It also shows up in the BIOS. Before that, I cleared the Secure Boot keys. Also, how can i check if my windows uses a 2023 signed boot?

Buddywh · Nov 24, 2025

666pierog said:
I already have the 2023 certificate. I downloaded the latest version of Windows, followed the steps in the guide, and received it. It also shows up in the BIOS. Before that, I cleared the Secure Boot keys. Also, how can i check if my windows uses a 2023 signed boot?

The smart and undeniable way is to look into the EFI partition and examine the boot file - right click on it, open properties, Digital Signatures, Details, look for a 2023 certificate used to sign it. You may have to make a copy of it in a location you have permissions.

The second-hand way is examine the registry and look to see if Secure Boot Updates completed with a status of 2; that may not be correct if the microsoft scheduled task(s) haven't properly run though. I think at least some of the powershell scripts simply look at the registry value so you might consider that too.

How did you get the updated keys pushed into your firmware?

666pierog · Nov 24, 2025

Buddywh said:
If you're not positive your Windows is using 2023 signed secure boot manager files then do not revoke the 2011 Windows CA or your Windows will not start with Secure Boot enabled.

And where are you getting your secure boot objects? Assuming you're trying to "append" to DBX... you might need to use signed binary objects you can get from Microsoft's GitHub (below). Just don't do this until you've saved a copy of bitlocker keys (if using it) AND you KNOW your Windows is running with 2023- signed boot manager files.

secureboot_objects/PostSignedObjects at main · microsoft/secureboot_objects

Secure boot objects recommended by Microsoft. Contribute to microsoft/secureboot_objects development by creating an account on GitHub.

github.com

Secure boot update HowTo By this guide

Buddywh · Nov 24, 2025

666pierog said:
View attachment 154147Secure boot update HowTo By this guide

OK... that script says you do have it and Windows is actually booting from it AND that it's determining that from registry entries. I'd say you're good-to-go assuming the registry is in sync with the actual boot files.

If you want to revoke the 2011 cert now, go to the following MS document, scroll down to Step 3 "Enable the Revocations". Follow the instructions, and DO NOT IGNORE THE WARNING! Keep in mind: you do not have to do this right now. It's really only necessary if you think you're vulnerable to one of the few (and difficult to exploit) Secure Boot vulnerabilities like Black Lotus.

And BTW... in the same document, Step 2 covers the high-confidence method to verify your boot files are signed with 2023 certificate before doing this.

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

Dronix · Nov 25, 2025

garlin said:
Here's a clickable batch file that writes a report to the desktop.

Slightly modified your file. Now the output is UEFI_report.txt it does not go to the Desktop, but to the launch folder of the bat file. Plus, the Registry UEFICA2023Status output has been added.

Link to the file - BoScript_Modified.zip

Rollback_Jockey · Nov 25, 2025

garlin said:
Here's a clickable batch file that writes a report to the desktop. If you click on the script, it may ask you for Administrator rights.

The script takes more than a few seconds to run. If you click the report file on the Desktop too early, NotePad will warn you the file is still in use. Just wait another 10 seconds, and then open the file. The desktop icon for the report always appears before the script is actually done running.

Be patient.

Just an FYI, that script failed for me because my desktop is redirected to D:\User\etc

starchase · Nov 27, 2025

I'm preparing my HP Spectre unsupported by HP laptop to use MOSBY to update the Secure Boot Keys per this instructional post. Has anyone borked their system trying it, and if so, how did you regain a functional machine - if you didn't brick the machine?

gunrunnerjohn · Nov 27, 2025

starchase said:
I'm preparing my HP Spectre unsupported by HP laptop to use MOSBY to update the Secure Boot Keys per this instructional post. Has anyone borked their system trying it, and if so, how did you regain a functional machine - if you didn't brick the machine?

You can turn Secure Boot off in the BIOS and it'll be bootable. That should allow you to recover most anything you do to the certs.

starchase · Nov 27, 2025

gunrunnerjohn said:
You can turn Secure Boot off in the BIOS and it'll be bootable. That should allow you to recover most anything you do to the certs.

Thanks, simple enough! My last step is to figure out how to enter "Setup Mode" on this machine. Here is what the BIOS page looks like (below). I don't see anything obvious to get me to that state. I'll continue Googleing, and maybe a Copilot search .

Buddywh · Nov 27, 2025

starchase said:
I'm preparing my HP Spectre unsupported by HP laptop to use MOSBY to update the Secure Boot Keys per this instructional post. Has anyone borked their system trying it, and if so, how did you regain a functional machine - if you didn't brick the machine?

I borked my system once (ran the -X option while still running with the 2011 Boot Manager), but I just did a Restore Default Keys in BIOS settings to restore them and got back where I could start again, since I hadn't installed the 2023 boot manager it started in Secure Boot just fine too.

itsme1 · Nov 27, 2025

starchase said:
Thanks, simple enough! My last step is to figure out how to enter "Setup Mode" on this machine. Here is what the BIOS page looks like (below). I don't see anything obvious to get me to that state. I'll continue Googleing, and maybe a Copilot search .

View attachment 154552

Not sure, but I think you need to be in custom mode in secure boot. That's what I saw for HP(and dell) laptops, I can't remember where, here or on the internet.

starchase · Nov 27, 2025

Here is the reply from Copilot concerning my question:

Quick Answer: On HP laptops like your 2016 Spectre x360, Setup Mode for Secure Boot isn’t a visible BIOS menu option. Instead, it’s triggered automatically when Secure Boot keys are cleared. You’ll need to clear the existing PK (Platform Key) in the BIOS to force the system into Setup Mode, which then allows you to install new certificates using the Mosby scripts.

1. Select Clear Secure Boot Keys.
2. This removes the PK and automatically puts the system into Setup Mode.
3. You won’t see “Setup Mode” as a menu item—it’s a state the firmware enters once keys are cleared.

itsme1 · Nov 27, 2025

starchase said:
Here is the reply from Copilot concerning my question:

Quick Answer: On HP laptops like your 2016 Spectre x360, Setup Mode for Secure Boot isn’t a visible BIOS menu option. Instead, it’s triggered automatically when Secure Boot keys are cleared. You’ll need to clear the existing PK (Platform Key) in the BIOS to force the system into Setup Mode, which then allows you to install new certificates using the Mosby scripts.

Select Clear Secure Boot Keys.

This removes the PK and automatically puts the system into Setup Mode.

You won’t see “Setup Mode” as a menu item—it’s a state the firmware enters once keys are cleared.

Yes, that's how it works for Dell, something I haven't tried yet, I'm waiting... Try it without deleting the keys and if that doesn't work, delete the keys.

Buddywh · Nov 27, 2025

starchase said:
Quick Answer: On HP laptops like your 2016 Spectre x360, Setup Mode for Secure Boot isn’t a visible BIOS menu option. Instead, it’s triggered automatically when Secure Boot keys are cleared.

There's great inconsistency on how to put Secure Boot into setup mode. On one of my systems I had to right click on each of the variables (PK, KEK, DB, DBX) and then pick DELETE KEYS from a list of actions.

GPT-5 has really been a great assist for me in learning about this whole Chain of Trust thing and how it works. But treat it like an educated idiot: ask the question in a couple different ways because it's inference thingy often gets it wrong in the details, and then question it on the differences.

starchase · Nov 27, 2025

I took the plunge and ran mosby on my HP Spectre. It started right away but this screen shot below has been static for 10 minutes. Am I waiting for a note that it is done and shut down and reboot or is it still working?

starchase · Nov 27, 2025

starchase said:
I took the plunge and ran mosby on my HP Spectre. It started right away but this screen shot below has been static for 10 minutes. Am I waiting for a note that it is done and shut down and reboot or is it still working?
View attachment 154562

It's been about 20 minutes or more so I'll soon, if the screen doesn't change, just reboot and take my chances.

Buddywh · Nov 27, 2025

starchase said:
I took the plunge and ran mosby on my HP Spectre. It started right away but this screen shot below has been static for 10 minutes. Am I waiting for a note that it is done and shut down and reboot or is it still working?
View attachment 154562

It happened to me on a really old Gigabyte motherboard with one of the earliest UEFI BIOS'. You might have to break in and try again, this time using the option to disable logging.

starchase · Nov 27, 2025

I tried a second time with similar results - it appears the screen freezes up. Here is the screenshot:

Perhaps this machine just can't work with mosby.

Buddywh · Nov 27, 2025

starchase said:
Perhaps this machine just can't work with mosby.

You might drop the author a message in his GitHub site. He'll want to know details like UEFI version in your BIOS. The screen pic you show here should be helpful to him.

starchase · Nov 27, 2025

Looks like the HP Spectre laptop has a firmware limitation. I've been discussing this with Copilot and I run up against a hard wall.

"You’ve diagnosed it exactly right. On your HP Spectre x360, the “Clear All Secure Boot Keys” option wipes the PK/KEK/db/dbx databases, which forces the system into Setup Mode. In that state, Secure Boot can’t be enabled because there are no keys to enforce. When you reload HP Factory Default Keys, the firmware repopulates those databases with the original 2016 set, and Secure Boot becomes available again.

"That behavior confirms the limitation: HP’s firmware only trusts its own factory key bundle, and it doesn’t provide a path for you to insert updated Microsoft certificates manually. Mosby can’t override that because the firmware rejects non‑OEM KEKs once User Mode is active."

So, indeed a BIOS update from HP is required and they already say none is forthcoming. tant pis, peu importe!

Did you manually update your Secure Boot Keys ?

Member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

Attachments

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Similar threads

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computers

My Computers

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers