Did you manually update your Secure Boot Keys ?

hader · Dec 9, 2025

Pnokio said:
My Secure Boot is Enabled but not Active as in BIOS.
What does this mean????
-
View attachment 156201

I don't have this motherboard but I think this video will solve your issue;

Pnokio · Dec 9, 2025

hader said:
Remember; PowerShell must run as admin. As the screendump already said; Not enough privileges to execute the command. I don't see "Administrator: Powershell" in the powershell box screendump you are referring too. Correct it. The end-result must be; True or False.

Done exactly as instructed again but remembered my image.
-

Dirtyflash · Dec 9, 2025

Pnokio said:
Done exactly as instructed again but remembered my image.
-
View attachment 156281

Are you telling the truth? Your username leaves some doubt.

mccmw · Dec 9, 2025

hader said:
Note @mccmw: About the KEK issue; I saw a red cross (had trouble with reading because of the spaces issue in the screendump) at the item: "Microsoft Corporation KEK 2K CA 2023" The Dell UEFI PK and KEK of the manufacturer seems to alright; green. The current UEFI KEK from "Microsoft Corporation KEK 2K CA 2023" not. (red) I saw a document I thought would solve that issue also; Download the "Microsoft Corporation KEK 2K CA 2023" from Microsoft themself.

The doc: Windows Secure Boot Key Creation and Management Guidance

Search for Microsoft Corporation KEK 2K CA 2023. The .cer can be download by the link below. BUT... It's based on a root certificate Microsoft RSA Devices Root CA 2021 (valid until 2046) OEM's can use this to sign it based on the new CA 2023 certificate. So this is no use because that RSA certificate is not the Windows trusted certificate store. Use certmgr.msc to view all the root and intermediate certificates.

I think you have to wait until the CA2023 is implemented. This whole exercise was to prepare (on a non MS way) us until this certificate is re-signed for all programs (needs to be replaced by an Windows update) that needs be verified by the new CA2023 certificate. As far as I can see; all files now are still pointing to the old PCA 2011 certificate. The issue you can solve are the red crosses at the EUFI Current values at DB and DBX.

Well...I unexpectedly inched a step closer. I went to update Windows 11 (Tuesday Security update) on that machine. I noticed that it now shows that the CA 2023 cert is active and Windows is using it. I think, the only step left is how to get the KEK 2023 certificate installed.

hader · Dec 10, 2025

Pnokio said:
Done exactly as instructed again but remembered my image.
-
View attachment 156281

This is an different error message. The one you referring to had a "not enough rights" problem. The devil is in the details....

If you leave out the -match etc. part you will see a lot of "Garbage" strings return. What this command does is searching trough that "garbage" and looking (through the EUFI DB part) for that string "Windows UEFI CA 2023" It's can't find it. Most likely UEFI is not turned on or/and secure boot is not enabled.

You have to go to your BIOS and change the following settings; UEFI Only (or Both) and CSM (Compatibility Support Module) Support = NO. Then you can set Secure boot = enabled.

Look at your manual for those 2 BIOS settings and it's values and conditions; Those settings have a close relationship with each other.
- Secure Boot
- UEFI/Legacy boot
After the change you can query for that value again.

This post talks about the same error; (older article but still valid) UEFI with secure boot disabled - Windows 10 Help Forums (If possible; make sure you have the latest BIOS version for your motherboard to make sure you do not run against other problems later on)

Pnokio · Dec 10, 2025

My final post in this thread is just to say a big thanks to all for your knowledgeable messages.
Sadly none worked, nor did trying to contact Asus. Getting into Fort Knox might be easier.

hader · Dec 10, 2025

Pnokio said:
My final post in this thread is just to say a big thanks to all for your knowledgeable messages.
Sadly none worked, nor did trying to contact Asus. Getting into Fort Knox might be easier.

OK. Giving up. Secure boot is an optional security feature. It's not mandatory. You can still use Windows as is. You don't have to contact ASUS for that; they will point back at Windows. You can still look at the latest BIOS version on their site and check. If it doesn't is there anymore than your motherboard is too old and out of service. Buying a recent (new/secondhand) one maybe an option but with no further details we can't help you here any further on this subject. Having a good antivirusprogram is your last line of defense.

Make sure Windows is error free (DISM /ScanHealth & SFC /Scannow) and be up-to-date with the builds. Latest one came in today; 26200.7462

Buddywh · Dec 10, 2025

hader said:
OK. Giving up. Secure boot is an optional security feature. It's not mandatory. You can still use Windows as is.

To be clear: it is sort of optional.

Even though Win11 runs with it disabled (even in non-UEFI compatibility mode and with MBR system drive partitioning) Microsoft does want it enabled. Some people have voiced opinions they may require it at some point in the future. There also are currently a few games (and probably more coming) that require secure boot enabled to play as part of their "anti-cheat" system.

Pnokio · Dec 10, 2025

Hi hader, I have 2 ASUS Win 11 Home laptops, the slightly older one has Bitlocker and Secure Boot Enabled & Active.
My main one is the one I am writing about. Both are well under 2 years old.
I use Windows AV on both. I check for updates daily. I also use Ghostery & McAfee Web Advisor.

Dirtyflash · Dec 10, 2025

Pnokio said:
Hi hader, I have 2 ASUS Win 11 Home laptops, the slightly older one has Bitlocker and Secure Boot Enabled & Active.
My main one is the one I am writing about. Both are well under 2 years old.
I use Windows AV on both. I check for updates daily. I also use Ghostery & McAfee Web Advisor.

One day when you have time and feel adventurous, save a backup image of the problematic laptop, wipe the drive and do a fresh clean install of Windows. You may find the results interesting.

Pnokio · Dec 10, 2025

Dirtyflash said:
One day when you have time and feel adventurous, save a backup image of the problematic laptop, wipe the drive and do a fresh clean install of Windows. You may find the results interesting.

I recently had Bitlocker trouble and I paid to have new Windows installed.
-
Edition Windows 11 Home
Version 25H2
Installed on ‎09/‎08/‎2025
OS build 26200.7462
Experience Windows Feature Experience Pack 1000.26100.275.0

Buddywh · Dec 10, 2025

Pnokio said:
I recently had Bitlocker trouble and I paid to have new Windows installed.
...

Try the below attached applet instead.

Unzip it to a folder. Right click on "Check UEFI PK, KEK, DB and DBX.cmd" and run as Admin. It will give you a fairly busy display: you're interested in seeing which certificates (keys) are loaded in the CURRENT PK, KEK and DB.

The DEFAULT of these are what your machine's BIOS would restore if you had to "Restore Default Keys" (assuming it's capable of that).

XxXxX · Dec 10, 2025

Pnokio said:
My final post in this thread is just to say a big thanks to all for your knowledgeable messages.
Sadly none worked, nor did trying to contact Asus. Getting into Fort Knox might be easier.

i am in the process of updating an ASUS 21" all in one for a family friend
i cant do this until tomorrow as they forgot to leave me the password.

i shall report back on how it goes.
best of luck Steve ..

edit.
i have updated the Asus all in one using the Secure boot update HowTo
and now the system is booting from the secure boot 2023 cert.

mccmw · Dec 16, 2025

Success...finally...on the ancient Dell XPS referenced above:) Thank you Akeo! I noticed the recent Mosby 2.8 update and decided to try it. It ran successfully and now I have the KEK and DB certificates (and 2023 is active), and the Dell UEFI cert was replaced with Mosby. Now I can wait longer for RAM prices to go down before biting the bullet and buying a new laptop for the kids:)

Dirtyflash · Dec 16, 2025

mccmw said:
Success...finally...on the ancient Dell XPS referenced above:) Thank you Akeo! I noticed the recent Mosby 2.8 update and decided to try it. It ran successfully and now I have the KEK and DB certificates (and 2023 is active), and the Dell UEFI cert was replaced with Mosby. Now I can wait longer for RAM prices to go down before biting the bullet and buying a new laptop for the kids:)

Curious, how old was your Dell XPS? Also intrigued about your experience of using Mosby 2.8? What was different that made it successful? I'm assuming you were running into some issues previously, can't remember if you had previously posted the specific details? Great new though, happy it worked out for you!

mccmw · Dec 16, 2025

Dirtyflash said:
Curious, how old was your Dell XPS? Also intrigued about your experience of using Mosby 2.8? What was different that made it successful? I'm assuming you were running into some issues previously, can't remember if you had previously posted the specific details? Great new though, happy it worked out for you!

The Dell is a XPS 13 9350 (circa 2015)...kids use it for educational games, learning to type, learning web browsing, etc. Knowing it would never get another BIOS update, I struggled to get it to update secure boot certificates. Eventually, I was able to get everything except the KEK. Mosby 2.7 kept returning and error and would not update the UEFI or KEK certs. I noticed earlier today, that the 2.8 changelog included fixes for older Dells and other manufacturers...allegedly with the same issue. This time, it made it all the way through. The only error was the first time I ran it I forgot to delete all of the existing certs so it wasn't in BIOS "Setup Mode." As soon as I cleared them...it was fast and complete. Also...despite its age, and for what it's being used for...it runs 25H2 (unsupported of course) just fine.

Dirtyflash · Dec 16, 2025

mccmw said:
The Dell is a XPS 13 9350 (circa 2015)...kids use it for educational games, learning to type, learning web browsing, etc. Knowing it would never get another BIOS update, I struggled to get it to update secure boot certificates. Eventually, I was able to get everything except the KEK. Mosby 2.7 kept returning and error and would not update the UEFI or KEK certs. I noticed earlier today, that the 2.8 changelog included fixes for older Dells and other manufacturers...allegedly with the same issue. This time, it made it all the way through. The only error was the first time I ran it I forgot to delete all of the existing certs so it wasn't in BIOS "Setup Mode." As soon as I cleared them...it was fast and complete. Also...despite its age, and for what it's being used for...it runs 25H2 (unsupported of course) just fine.

Thanks for sharing, I'll maybe give it another shot on the Lenovo T460. Clearing all the keys after turning off secure boot makes sense.

Buddywh · Dec 16, 2025

Dirtyflash said:
Curious, how old was your Dell XPS? Also intrigued about your experience of using Mosby 2.8? What was different that made it successful? I'm assuming you were running into some issues previously, can't remember if you had previously posted the specific details? Great new though, happy it worked out for you!

@Akeo had reported that he had found a number machine BIOS's have an improper (or at least non-standard) UEFI implementation that made it impossible to append or update to the KEK variable using methods outlined in UEFI specs. These included some Lenovo, Dell, MSI and (I think) HP laptops, maybe more and typically older ones. MOSBY Ver 2.8 includes a work-around for the problem.

I can't speak to how well it works for that problem or what he did to make it work. But I can say it includes the latest SVN updates. I just MOSBY'd another older system I cobbled together with perfect results: all the 2023 and 2011 keys as there should be, no manufacturer keys left behind, SVN up to the latest rev.

Dirtyflash · Dec 16, 2025

Buddywh said:
@Akeo had reported that he had found a number machine BIOS's have an improper (or at least non-standard) UEFI implementation that made it impossible to append or update to the KEK variable using methods outlined in UEFI specs. These included some Lenovo, Dell, MSI and (I think) HP laptops, maybe more and typically older ones. MOSBY Ver 2.8 includes a work-around for the problem.

I can't speak to how well it works for that problem or what he did to make it work. But I can say it includes the latest SVN updates. I just MOSBY'd another older system I cobbled together with perfect results: all the 2023 and 2011 keys as there should be, no manufacturer keys left behind, SVN up to the latest rev.

Great insight, thanks. I just downloaded Mosby 2.8 from GitHub, extracted the contents. How do I build a USB using the downloaded files. I have previously used Rufus and selected the download option to build the USB using UEFI Shell 2.2, is it the same v2.8? Maybe I've been doing it all wrong.

Akeo · Dec 16, 2025

Dirtyflash said:
How do I build a USB using the downloaded files. I have previously used Rufus and selected the download option to build the USB using UEFI Shell 2.2

Do just that.

Then download the latest Mosby_v#.#.zip from Releases · pbatard/Mosby and extract the content from that zip archive to the top of the USB you created (it should prompt you to overwrite existing files -- say yes to that).

That's it. You know have a UEFI Shell bootable USB with the latest Mosby.

Did you manually update your Secure Boot Keys ?

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computers My Computers

At a glance

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computers

My Computer

My Computer

My Computers

My Computers

My Computer

My Computers

My Computers

My Computer

My Computer

My Computer

My Computers

My Computers

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer