Solved Finding the UEFI's DBX SVN number using PowerShell


Buddywh said:
I did the clean install just recently (in the last week) from a USB installation drive I created using Microsoft's Media Creation Tool
Click to expand...

Yep, me too, I always use MCT, that's the only way I do it.
My clean install on 26/10 was 26200.6899, I think, but may have been 26200.6901, can't check now because I've since updated my USB with Latest version of MCT which, I think, was the version before the current Preview Update.

I didn't use MOSBY to update my keys, I used a script from @MoKiChU from another forum which just put entries in the registry and then MS updates keys accordingly.

Since I installed the latest BIOS Dated 25th September '25 on my HP Laptop, my default keys are all 2023 signed, so the only thing I'm missing now is the SVN 7.0. From what I understand there is very little security issue with not having the latest SVN so I'm going to sit on my hands and see how things pan out in the next few months. Then I'll cross that bridge when, and if, I come to it.

Screenshot 2025-11-22 120013.webp
 

My Computer My Computer

At a glance

Windows 11 Pro 25H212th Gen Intel(R) Core(TM) i7-1255U (1.70 GHz16.0 GBIntel iRIS Xe
OS
Windows 11 Pro 25H2
Computer type
Laptop
Manufacturer/Model
HP 15s-fq5xxx
CPU
12th Gen Intel(R) Core(TM) i7-1255U (1.70 GHz
Memory
16.0 GB
Graphics Card(s)
Intel iRIS Xe
Screen Resolution
1920 x 1080
Hard Drives
Samsung SSD 512 GB
Mouse
Logitech Pebble
Internet Speed
500/50 Mb/sec
Browser
Chrome
Antivirus
Defender
Hi.

I have two questions to those having sophisticated computer knowledge and/or deeply involved in IT business regarding future unexpected SVN updates by Microsoft's monthly patches.

On my PC I have two Windows installations (both 25H2 same builds). They are not dual-booting. I can boot to one or to the other through the BIOS boot selection menu.

Normally, I update one Windows installation first and the other, a week or so later, thinking that the update may be buggy.

I updated SVN in one Windows installation two days ago. It was 2.0 before the update and it went up to 7.0 after the update. After doing this, I thought my second Windows installation would not boot because it did not have its boot manager configured to SVN 7.0. But it booted fine. This led me to think that SVN is not yet in effect and it's not controlling Windows boot for now. Am I right ???

Or putting it the other way, assuming the first Windows installation has a night-raid SVN update from MS, does this mean my other Windows installation will not boot ?

Will turning both Windows installations into dual-boot setup while I have time save the day ?

Have a nice day.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro build 26200.8524Intel i7-4790Teams DDR3-1600 4x4 GBMSI Nvidia GeForce GTX 1050Ti
    OS
    Windows 11 Pro build 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Built
    CPU
    Intel i7-4790
    Motherboard
    Asus H97 Pro Gamer with add-on TPM1.2 module
    Memory
    Teams DDR3-1600 4x4 GB
    Graphics Card(s)
    MSI Nvidia GeForce GTX 1050Ti
    Sound Card
    Realtek ALC1150
    Monitor(s) Displays
    Dell P2425D
    Screen Resolution
    2560 by 1440 pixels
    Hard Drives
    Corsair NVMe M.2 Core XT 1000 GB (Windows 11 v.25H2); Samsung SATA Evo 870 500 GB (Windows 11 v.25H2);
    PSU
    Corsair HX850
    Case
    Gigabyte Solo 210
    Cooling
    Zalman CNPS7X Tower
    Keyboard
    Microsoft AIO Wireless (includes touchpad)
    Mouse
    HP S1000 Plus Wireless
    Internet Speed
    500 Mb fiber optic
    Browser
    Chrome; MS Edge
    Antivirus
    Windows Defender

  • At a glance

    MacOS 12 MontereyIntel Core i58 GBIntel integrated
    Operating System
    MacOS 12 Monterey
    Computer type
    Laptop
    Manufacturer/Model
    Apple Macbook Air
    CPU
    Intel Core i5
    Memory
    8 GB
    Graphics card(s)
    Intel integrated
    Screen Resolution
    1440 by 900 pixels
    Hard Drives
    128 GB
    Keyboard
    Built-in
    Mouse
    Microsoft Wireless
    Internet Speed
    802.11 ac
    Browser
    Chrome; Safari
    Antivirus
    N/A
@Brian48 Did you check your current SVN ? You can check only, not update.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro build 26200.8524Intel i7-4790Teams DDR3-1600 4x4 GBMSI Nvidia GeForce GTX 1050Ti
    OS
    Windows 11 Pro build 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Built
    CPU
    Intel i7-4790
    Motherboard
    Asus H97 Pro Gamer with add-on TPM1.2 module
    Memory
    Teams DDR3-1600 4x4 GB
    Graphics Card(s)
    MSI Nvidia GeForce GTX 1050Ti
    Sound Card
    Realtek ALC1150
    Monitor(s) Displays
    Dell P2425D
    Screen Resolution
    2560 by 1440 pixels
    Hard Drives
    Corsair NVMe M.2 Core XT 1000 GB (Windows 11 v.25H2); Samsung SATA Evo 870 500 GB (Windows 11 v.25H2);
    PSU
    Corsair HX850
    Case
    Gigabyte Solo 210
    Cooling
    Zalman CNPS7X Tower
    Keyboard
    Microsoft AIO Wireless (includes touchpad)
    Mouse
    HP S1000 Plus Wireless
    Internet Speed
    500 Mb fiber optic
    Browser
    Chrome; MS Edge
    Antivirus
    Windows Defender

  • At a glance

    MacOS 12 MontereyIntel Core i58 GBIntel integrated
    Operating System
    MacOS 12 Monterey
    Computer type
    Laptop
    Manufacturer/Model
    Apple Macbook Air
    CPU
    Intel Core i5
    Memory
    8 GB
    Graphics card(s)
    Intel integrated
    Screen Resolution
    1440 by 900 pixels
    Hard Drives
    128 GB
    Keyboard
    Built-in
    Mouse
    Microsoft Wireless
    Internet Speed
    802.11 ac
    Browser
    Chrome; Safari
    Antivirus
    N/A

My Computer My Computer

At a glance

Windows 11 Pro 25H212th Gen Intel(R) Core(TM) i7-1255U (1.70 GHz16.0 GBIntel iRIS Xe
OS
Windows 11 Pro 25H2
Computer type
Laptop
Manufacturer/Model
HP 15s-fq5xxx
CPU
12th Gen Intel(R) Core(TM) i7-1255U (1.70 GHz
Memory
16.0 GB
Graphics Card(s)
Intel iRIS Xe
Screen Resolution
1920 x 1080
Hard Drives
Samsung SSD 512 GB
Mouse
Logitech Pebble
Internet Speed
500/50 Mb/sec
Browser
Chrome
Antivirus
Defender
Brian48 said:
Yep, SVN 2.0
Click to expand...
Mine was also 2.0 before the update. After I updated SVN, it went up to 7.0. If you update, you must update your bootable media, too.

If and when you update SVN, you must do this to update bootable media or recovery media, too:

COPY D:\EFI\MICROSOFT\BOOT\BCD D:\EFI\MICROSOFT\BOOT\BCD.BAK (where D: is USB recovery media or Windows installation media)

bcdboot C:\Windows /f UEFI /s D: /bootex

COPY D:\EFI\MICROSOFT\BOOT\BCD.BAK D:\EFI\MICROSOFT\BOOT\BCD
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro build 26200.8524Intel i7-4790Teams DDR3-1600 4x4 GBMSI Nvidia GeForce GTX 1050Ti
    OS
    Windows 11 Pro build 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Built
    CPU
    Intel i7-4790
    Motherboard
    Asus H97 Pro Gamer with add-on TPM1.2 module
    Memory
    Teams DDR3-1600 4x4 GB
    Graphics Card(s)
    MSI Nvidia GeForce GTX 1050Ti
    Sound Card
    Realtek ALC1150
    Monitor(s) Displays
    Dell P2425D
    Screen Resolution
    2560 by 1440 pixels
    Hard Drives
    Corsair NVMe M.2 Core XT 1000 GB (Windows 11 v.25H2); Samsung SATA Evo 870 500 GB (Windows 11 v.25H2);
    PSU
    Corsair HX850
    Case
    Gigabyte Solo 210
    Cooling
    Zalman CNPS7X Tower
    Keyboard
    Microsoft AIO Wireless (includes touchpad)
    Mouse
    HP S1000 Plus Wireless
    Internet Speed
    500 Mb fiber optic
    Browser
    Chrome; MS Edge
    Antivirus
    Windows Defender

  • At a glance

    MacOS 12 MontereyIntel Core i58 GBIntel integrated
    Operating System
    MacOS 12 Monterey
    Computer type
    Laptop
    Manufacturer/Model
    Apple Macbook Air
    CPU
    Intel Core i5
    Memory
    8 GB
    Graphics card(s)
    Intel integrated
    Screen Resolution
    1440 by 900 pixels
    Hard Drives
    128 GB
    Keyboard
    Built-in
    Mouse
    Microsoft Wireless
    Internet Speed
    802.11 ac
    Browser
    Chrome; Safari
    Antivirus
    N/A
Brian48 said:
Since I installed the latest BIOS Dated 25th September '25 on my HP Laptop, my default keys are all 2023 signed, so the only thing I'm missing now is the SVN 7.0.
Click to expand...
I'd not worry about it. They don't always come but when they do they come in the monthly "patch Tuesday" updates. So, you'll get it at some point I'm pretty sure... so long as you allow updates, that is.
 
Last edited:

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 ProRyzen 7 5800XGSkill 3200, 2x8GBMSI RX 6800 XT Gaming Z
    OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 5800X
    Motherboard
    Gigabyte B550M Aorus Pro
    Memory
    GSkill 3200, 2x8GB
    Graphics Card(s)
    MSI RX 6800 XT Gaming Z
    Sound Card
    on-board Realtek
    Monitor(s) Displays
    MSI 180hz
    Screen Resolution
    1440p
    Hard Drives
    Samsung 980 Pro, Samsung 870 Evo, generic PCIe NVME, WD 1TB 2.5" laptop spinner
    PSU
    Corsair RM 650
    Case
    mATX
    Cooling
    BeQuiet 240mm AIO and a bunch of case fans
    Keyboard
    one that clacks softly
    Mouse
    logitech
    Internet Speed
    bunches of bps
    Browser
    Firefox
    Antivirus
    Windows' own

  • At a glance

    Win11 ProRyzen 7 170016GB DDR4RX-480
    Operating System
    Win11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 1700
    Motherboard
    GA-AB350M G-3
    Memory
    16GB DDR4
    Graphics card(s)
    RX-480
    Sound Card
    In-Built Realtek
    Monitor(s) Displays
    Samsung
    Screen Resolution
    1440p
    Hard Drives
    NVME/SSD's
    PSU
    Thermaltake BX1 550W
    Case
    Some junky thing
    Cooling
    ThermalTake Assassin(?)
    Browser
    FF/Edge
    Antivirus
    Whatever Windows does
    Other Info
    Secure Boot enabled updated to 2023 CA keys, TPM2.0 enabled with system drive Bitlocker'd.
suatcini54 said:
There are millions and millions of people running Windows machines with Secure-Boot-State on, who may not be knowledgeable enough to repair and/or reinstall Windows easily in such Windows-not-booting scenarios. My post was to draw attention to this issue.
Click to expand...
Of those millions and millions of Windows machines a huge percentage are IT managed corporate desktops and laptops. And of the rest, many more are just looked on as a throw-away appliance.

In short, I can't imagine a significant portion of the millions and millions of Windows machines are owned by people who even know about, much less care about, the certificate expirations. It'll either continue working with successful updates or they take it to a shop to get fixed or they buy a new one, just like their phones.

Or give up on it since they weren't that really all that "in-to" this long-running fad any way.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 ProRyzen 7 5800XGSkill 3200, 2x8GBMSI RX 6800 XT Gaming Z
    OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 5800X
    Motherboard
    Gigabyte B550M Aorus Pro
    Memory
    GSkill 3200, 2x8GB
    Graphics Card(s)
    MSI RX 6800 XT Gaming Z
    Sound Card
    on-board Realtek
    Monitor(s) Displays
    MSI 180hz
    Screen Resolution
    1440p
    Hard Drives
    Samsung 980 Pro, Samsung 870 Evo, generic PCIe NVME, WD 1TB 2.5" laptop spinner
    PSU
    Corsair RM 650
    Case
    mATX
    Cooling
    BeQuiet 240mm AIO and a bunch of case fans
    Keyboard
    one that clacks softly
    Mouse
    logitech
    Internet Speed
    bunches of bps
    Browser
    Firefox
    Antivirus
    Windows' own

  • At a glance

    Win11 ProRyzen 7 170016GB DDR4RX-480
    Operating System
    Win11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 1700
    Motherboard
    GA-AB350M G-3
    Memory
    16GB DDR4
    Graphics card(s)
    RX-480
    Sound Card
    In-Built Realtek
    Monitor(s) Displays
    Samsung
    Screen Resolution
    1440p
    Hard Drives
    NVME/SSD's
    PSU
    Thermaltake BX1 550W
    Case
    Some junky thing
    Cooling
    ThermalTake Assassin(?)
    Browser
    FF/Edge
    Antivirus
    Whatever Windows does
    Other Info
    Secure Boot enabled updated to 2023 CA keys, TPM2.0 enabled with system drive Bitlocker'd.
Buddywh said:
I'd not worry about it. They don't always come but when they do they come the monthly "patch Tuesday" updates. So you'll get it at some point I'm pretty sure... so long as you allow updates, that is.
Click to expand...

Well, I decided to update it anyway using the commands in the first post by @garlin after saying earlier that I was going to wait.
Now I am on SVN 7.0

Screenshot 2025-12-05 201006.webp

Interestingly, I tried my 2 USB's (24H2 & 25H2) that I have here without updating the boot files and the computer still booted fine with both and with Secure Boot enabled.
So I'm not real sure what updating the SVN actually achieves. 🤷‍♂️ :unsure:
 

My Computer My Computer

At a glance

Windows 11 Pro 25H212th Gen Intel(R) Core(TM) i7-1255U (1.70 GHz16.0 GBIntel iRIS Xe
OS
Windows 11 Pro 25H2
Computer type
Laptop
Manufacturer/Model
HP 15s-fq5xxx
CPU
12th Gen Intel(R) Core(TM) i7-1255U (1.70 GHz
Memory
16.0 GB
Graphics Card(s)
Intel iRIS Xe
Screen Resolution
1920 x 1080
Hard Drives
Samsung SSD 512 GB
Mouse
Logitech Pebble
Internet Speed
500/50 Mb/sec
Browser
Chrome
Antivirus
Defender
Brian48 said:
Interestingly, I tried my 2 USB's (24H2 & 25H2) that I have here without updating the boot files and the computer still booted fine with both and with Secure Boot enabled.
So I'm not real sure what updating the SVN actually achieves.
Click to expand...
Apparently both the (current) 2011 Boot Manager and the 2023 Boot Manager files are trusted with SVN 7.0. So you'd have to also revoke trust in the 2011 Windows PCA key (a separate action) which is when you'd experience start-up problems with any boot files that are signed by it. But before doing that make absolutely positive your system drive's EFI volume is using 2023 Boot Manager files.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 ProRyzen 7 5800XGSkill 3200, 2x8GBMSI RX 6800 XT Gaming Z
    OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 5800X
    Motherboard
    Gigabyte B550M Aorus Pro
    Memory
    GSkill 3200, 2x8GB
    Graphics Card(s)
    MSI RX 6800 XT Gaming Z
    Sound Card
    on-board Realtek
    Monitor(s) Displays
    MSI 180hz
    Screen Resolution
    1440p
    Hard Drives
    Samsung 980 Pro, Samsung 870 Evo, generic PCIe NVME, WD 1TB 2.5" laptop spinner
    PSU
    Corsair RM 650
    Case
    mATX
    Cooling
    BeQuiet 240mm AIO and a bunch of case fans
    Keyboard
    one that clacks softly
    Mouse
    logitech
    Internet Speed
    bunches of bps
    Browser
    Firefox
    Antivirus
    Windows' own

  • At a glance

    Win11 ProRyzen 7 170016GB DDR4RX-480
    Operating System
    Win11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 1700
    Motherboard
    GA-AB350M G-3
    Memory
    16GB DDR4
    Graphics card(s)
    RX-480
    Sound Card
    In-Built Realtek
    Monitor(s) Displays
    Samsung
    Screen Resolution
    1440p
    Hard Drives
    NVME/SSD's
    PSU
    Thermaltake BX1 550W
    Case
    Some junky thing
    Cooling
    ThermalTake Assassin(?)
    Browser
    FF/Edge
    Antivirus
    Whatever Windows does
    Other Info
    Secure Boot enabled updated to 2023 CA keys, TPM2.0 enabled with system drive Bitlocker'd.
@Brian48 Most probably, SVN is not put into effect as yet. This is my judgement. Please read my post #42 above.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro build 26200.8524Intel i7-4790Teams DDR3-1600 4x4 GBMSI Nvidia GeForce GTX 1050Ti
    OS
    Windows 11 Pro build 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Built
    CPU
    Intel i7-4790
    Motherboard
    Asus H97 Pro Gamer with add-on TPM1.2 module
    Memory
    Teams DDR3-1600 4x4 GB
    Graphics Card(s)
    MSI Nvidia GeForce GTX 1050Ti
    Sound Card
    Realtek ALC1150
    Monitor(s) Displays
    Dell P2425D
    Screen Resolution
    2560 by 1440 pixels
    Hard Drives
    Corsair NVMe M.2 Core XT 1000 GB (Windows 11 v.25H2); Samsung SATA Evo 870 500 GB (Windows 11 v.25H2);
    PSU
    Corsair HX850
    Case
    Gigabyte Solo 210
    Cooling
    Zalman CNPS7X Tower
    Keyboard
    Microsoft AIO Wireless (includes touchpad)
    Mouse
    HP S1000 Plus Wireless
    Internet Speed
    500 Mb fiber optic
    Browser
    Chrome; MS Edge
    Antivirus
    Windows Defender

  • At a glance

    MacOS 12 MontereyIntel Core i58 GBIntel integrated
    Operating System
    MacOS 12 Monterey
    Computer type
    Laptop
    Manufacturer/Model
    Apple Macbook Air
    CPU
    Intel Core i5
    Memory
    8 GB
    Graphics card(s)
    Intel integrated
    Screen Resolution
    1440 by 900 pixels
    Hard Drives
    128 GB
    Keyboard
    Built-in
    Mouse
    Microsoft Wireless
    Internet Speed
    802.11 ac
    Browser
    Chrome; Safari
    Antivirus
    N/A
Buddywh said:
You have to also revoke trust in the 2011 Windows PCA key to experience start-up problems.

Apparently both the (current) 2011 Boot Manager and the 2023 Boot Manager files are trusted with SVN 7.0.
Click to expand...
Thanks. I have already revoked two CA 2011 certs. I think SVN is not fully operational for now. When the time comes, sometime after June 2026, MS may put SVN in full operation.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro build 26200.8524Intel i7-4790Teams DDR3-1600 4x4 GBMSI Nvidia GeForce GTX 1050Ti
    OS
    Windows 11 Pro build 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Built
    CPU
    Intel i7-4790
    Motherboard
    Asus H97 Pro Gamer with add-on TPM1.2 module
    Memory
    Teams DDR3-1600 4x4 GB
    Graphics Card(s)
    MSI Nvidia GeForce GTX 1050Ti
    Sound Card
    Realtek ALC1150
    Monitor(s) Displays
    Dell P2425D
    Screen Resolution
    2560 by 1440 pixels
    Hard Drives
    Corsair NVMe M.2 Core XT 1000 GB (Windows 11 v.25H2); Samsung SATA Evo 870 500 GB (Windows 11 v.25H2);
    PSU
    Corsair HX850
    Case
    Gigabyte Solo 210
    Cooling
    Zalman CNPS7X Tower
    Keyboard
    Microsoft AIO Wireless (includes touchpad)
    Mouse
    HP S1000 Plus Wireless
    Internet Speed
    500 Mb fiber optic
    Browser
    Chrome; MS Edge
    Antivirus
    Windows Defender

  • At a glance

    MacOS 12 MontereyIntel Core i58 GBIntel integrated
    Operating System
    MacOS 12 Monterey
    Computer type
    Laptop
    Manufacturer/Model
    Apple Macbook Air
    CPU
    Intel Core i5
    Memory
    8 GB
    Graphics card(s)
    Intel integrated
    Screen Resolution
    1440 by 900 pixels
    Hard Drives
    128 GB
    Keyboard
    Built-in
    Mouse
    Microsoft Wireless
    Internet Speed
    802.11 ac
    Browser
    Chrome; Safari
    Antivirus
    N/A
Buddywh said:
You have to also revoke trust in the 2011 Windows PCA key to experience start-up problems.
Click to expand...
Done that a while back

suatcini54 said:
Most probably, SVN is not put into effect as yet. This is my judgement. Please read my post #42 above.
Click to expand...

Yes, agreed, that could be the reason.
 

My Computer My Computer

At a glance

Windows 11 Pro 25H212th Gen Intel(R) Core(TM) i7-1255U (1.70 GHz16.0 GBIntel iRIS Xe
OS
Windows 11 Pro 25H2
Computer type
Laptop
Manufacturer/Model
HP 15s-fq5xxx
CPU
12th Gen Intel(R) Core(TM) i7-1255U (1.70 GHz
Memory
16.0 GB
Graphics Card(s)
Intel iRIS Xe
Screen Resolution
1920 x 1080
Hard Drives
Samsung SSD 512 GB
Mouse
Logitech Pebble
Internet Speed
500/50 Mb/sec
Browser
Chrome
Antivirus
Defender
This is revoked certs on my PC:

my-system-certs.webp

Two old certs in UEFI DB Certs section were banned. I don't know what else I can ban.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro build 26200.8524Intel i7-4790Teams DDR3-1600 4x4 GBMSI Nvidia GeForce GTX 1050Ti
    OS
    Windows 11 Pro build 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Built
    CPU
    Intel i7-4790
    Motherboard
    Asus H97 Pro Gamer with add-on TPM1.2 module
    Memory
    Teams DDR3-1600 4x4 GB
    Graphics Card(s)
    MSI Nvidia GeForce GTX 1050Ti
    Sound Card
    Realtek ALC1150
    Monitor(s) Displays
    Dell P2425D
    Screen Resolution
    2560 by 1440 pixels
    Hard Drives
    Corsair NVMe M.2 Core XT 1000 GB (Windows 11 v.25H2); Samsung SATA Evo 870 500 GB (Windows 11 v.25H2);
    PSU
    Corsair HX850
    Case
    Gigabyte Solo 210
    Cooling
    Zalman CNPS7X Tower
    Keyboard
    Microsoft AIO Wireless (includes touchpad)
    Mouse
    HP S1000 Plus Wireless
    Internet Speed
    500 Mb fiber optic
    Browser
    Chrome; MS Edge
    Antivirus
    Windows Defender

  • At a glance

    MacOS 12 MontereyIntel Core i58 GBIntel integrated
    Operating System
    MacOS 12 Monterey
    Computer type
    Laptop
    Manufacturer/Model
    Apple Macbook Air
    CPU
    Intel Core i5
    Memory
    8 GB
    Graphics card(s)
    Intel integrated
    Screen Resolution
    1440 by 900 pixels
    Hard Drives
    128 GB
    Keyboard
    Built-in
    Mouse
    Microsoft Wireless
    Internet Speed
    802.11 ac
    Browser
    Chrome; Safari
    Antivirus
    N/A
suatcini54 said:
Two old certs in UEFI DB Certs section were banned. I don't know what else I can ban.
Click to expand...
How did you revoke trust in the Microsoft Corp UEFI CA 2011 cert?
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 ProRyzen 7 5800XGSkill 3200, 2x8GBMSI RX 6800 XT Gaming Z
    OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 5800X
    Motherboard
    Gigabyte B550M Aorus Pro
    Memory
    GSkill 3200, 2x8GB
    Graphics Card(s)
    MSI RX 6800 XT Gaming Z
    Sound Card
    on-board Realtek
    Monitor(s) Displays
    MSI 180hz
    Screen Resolution
    1440p
    Hard Drives
    Samsung 980 Pro, Samsung 870 Evo, generic PCIe NVME, WD 1TB 2.5" laptop spinner
    PSU
    Corsair RM 650
    Case
    mATX
    Cooling
    BeQuiet 240mm AIO and a bunch of case fans
    Keyboard
    one that clacks softly
    Mouse
    logitech
    Internet Speed
    bunches of bps
    Browser
    Firefox
    Antivirus
    Windows' own

  • At a glance

    Win11 ProRyzen 7 170016GB DDR4RX-480
    Operating System
    Win11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 1700
    Motherboard
    GA-AB350M G-3
    Memory
    16GB DDR4
    Graphics card(s)
    RX-480
    Sound Card
    In-Built Realtek
    Monitor(s) Displays
    Samsung
    Screen Resolution
    1440p
    Hard Drives
    NVME/SSD's
    PSU
    Thermaltake BX1 550W
    Case
    Some junky thing
    Cooling
    ThermalTake Assassin(?)
    Browser
    FF/Edge
    Antivirus
    Whatever Windows does
    Other Info
    Secure Boot enabled updated to 2023 CA keys, TPM2.0 enabled with system drive Bitlocker'd.
Brian48 said:
Done that a while back



Yes, agreed, that could be the reason.
Click to expand...
But also... some systems have a setting in Secure Boot section of BIOS to allow image execution even if the Boot Manager files aren't signed or are signed by an untrusted certificate. This effectively the same as disabling Secure Boot.

MSI motherboard BIOS's (in particular) are known to ship with that as the default setting, you have to disable Allow Image Execute to get true protections of Secure Boot. But I believe there may be others.
 
Last edited:

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 ProRyzen 7 5800XGSkill 3200, 2x8GBMSI RX 6800 XT Gaming Z
    OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 5800X
    Motherboard
    Gigabyte B550M Aorus Pro
    Memory
    GSkill 3200, 2x8GB
    Graphics Card(s)
    MSI RX 6800 XT Gaming Z
    Sound Card
    on-board Realtek
    Monitor(s) Displays
    MSI 180hz
    Screen Resolution
    1440p
    Hard Drives
    Samsung 980 Pro, Samsung 870 Evo, generic PCIe NVME, WD 1TB 2.5" laptop spinner
    PSU
    Corsair RM 650
    Case
    mATX
    Cooling
    BeQuiet 240mm AIO and a bunch of case fans
    Keyboard
    one that clacks softly
    Mouse
    logitech
    Internet Speed
    bunches of bps
    Browser
    Firefox
    Antivirus
    Windows' own

  • At a glance

    Win11 ProRyzen 7 170016GB DDR4RX-480
    Operating System
    Win11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 1700
    Motherboard
    GA-AB350M G-3
    Memory
    16GB DDR4
    Graphics card(s)
    RX-480
    Sound Card
    In-Built Realtek
    Monitor(s) Displays
    Samsung
    Screen Resolution
    1440p
    Hard Drives
    NVME/SSD's
    PSU
    Thermaltake BX1 550W
    Case
    Some junky thing
    Cooling
    ThermalTake Assassin(?)
    Browser
    FF/Edge
    Antivirus
    Whatever Windows does
    Other Info
    Secure Boot enabled updated to 2023 CA keys, TPM2.0 enabled with system drive Bitlocker'd.
Buddywh said:
How did you revoke trust in the Microsoft Corp UEFI CA 2011 cert?
Click to expand...
First of all, your motherboard must allow you to append certificates to the DBX list. Then you must find the Microsoft Corporation UEFI CA 2011 certificate and append the certificate under DBX list. If you wish, I can tell you how I did it.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro build 26200.8524Intel i7-4790Teams DDR3-1600 4x4 GBMSI Nvidia GeForce GTX 1050Ti
    OS
    Windows 11 Pro build 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Built
    CPU
    Intel i7-4790
    Motherboard
    Asus H97 Pro Gamer with add-on TPM1.2 module
    Memory
    Teams DDR3-1600 4x4 GB
    Graphics Card(s)
    MSI Nvidia GeForce GTX 1050Ti
    Sound Card
    Realtek ALC1150
    Monitor(s) Displays
    Dell P2425D
    Screen Resolution
    2560 by 1440 pixels
    Hard Drives
    Corsair NVMe M.2 Core XT 1000 GB (Windows 11 v.25H2); Samsung SATA Evo 870 500 GB (Windows 11 v.25H2);
    PSU
    Corsair HX850
    Case
    Gigabyte Solo 210
    Cooling
    Zalman CNPS7X Tower
    Keyboard
    Microsoft AIO Wireless (includes touchpad)
    Mouse
    HP S1000 Plus Wireless
    Internet Speed
    500 Mb fiber optic
    Browser
    Chrome; MS Edge
    Antivirus
    Windows Defender

  • At a glance

    MacOS 12 MontereyIntel Core i58 GBIntel integrated
    Operating System
    MacOS 12 Monterey
    Computer type
    Laptop
    Manufacturer/Model
    Apple Macbook Air
    CPU
    Intel Core i5
    Memory
    8 GB
    Graphics card(s)
    Intel integrated
    Screen Resolution
    1440 by 900 pixels
    Hard Drives
    128 GB
    Keyboard
    Built-in
    Mouse
    Microsoft Wireless
    Internet Speed
    802.11 ac
    Browser
    Chrome; Safari
    Antivirus
    N/A
suatcini54 said:
First of all, your motherboard must allow you to append certificates to the DBX list. Then you must find the Microsoft Corporation UEFI CA 2011 certificate and append the certificate under DBX list. If you wish, I can tell you how I did it.
Click to expand...
That's OK... I have one system with a BIOS that will allow appending directly into DBX, I also know MOSBY allows adding cert's of your choice to any of the variables (even PK with the system in SetupMode). I was mainly wondering if there was a way using the Microsoft Secure Boot Update task to do it.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 ProRyzen 7 5800XGSkill 3200, 2x8GBMSI RX 6800 XT Gaming Z
    OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 5800X
    Motherboard
    Gigabyte B550M Aorus Pro
    Memory
    GSkill 3200, 2x8GB
    Graphics Card(s)
    MSI RX 6800 XT Gaming Z
    Sound Card
    on-board Realtek
    Monitor(s) Displays
    MSI 180hz
    Screen Resolution
    1440p
    Hard Drives
    Samsung 980 Pro, Samsung 870 Evo, generic PCIe NVME, WD 1TB 2.5" laptop spinner
    PSU
    Corsair RM 650
    Case
    mATX
    Cooling
    BeQuiet 240mm AIO and a bunch of case fans
    Keyboard
    one that clacks softly
    Mouse
    logitech
    Internet Speed
    bunches of bps
    Browser
    Firefox
    Antivirus
    Windows' own

  • At a glance

    Win11 ProRyzen 7 170016GB DDR4RX-480
    Operating System
    Win11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 1700
    Motherboard
    GA-AB350M G-3
    Memory
    16GB DDR4
    Graphics card(s)
    RX-480
    Sound Card
    In-Built Realtek
    Monitor(s) Displays
    Samsung
    Screen Resolution
    1440p
    Hard Drives
    NVME/SSD's
    PSU
    Thermaltake BX1 550W
    Case
    Some junky thing
    Cooling
    ThermalTake Assassin(?)
    Browser
    FF/Edge
    Antivirus
    Whatever Windows does
    Other Info
    Secure Boot enabled updated to 2023 CA keys, TPM2.0 enabled with system drive Bitlocker'd.
suatcini54 said:
On my PC I have two Windows installations (both 25H2 same builds). They are not dual-booting. I can boot to one or to the other through the BIOS boot selection menu.

Normally, I update one Windows installation first and the other, a week or so later, thinking that the update may be buggy.

I updated SVN in one Windows installation two days ago. It was 2.0 before the update and it went up to 7.0 after the update. After doing this, I thought my second Windows installation would not boot because it did not have its boot manager configured to SVN 7.0. But it booted fine. This led me to think that SVN is not yet in effect and it's not controlling Windows boot for now. Am I right ???

Or putting it the other way, assuming the first Windows installation has a night-raid SVN update from MS, does this mean my other Windows installation will not boot ?

Will turning both Windows installations into dual-boot setup while I have time save the day ?
Click to expand...
24H2's boot manager has always been compliant with SVN 7.0.

MS began shipping the current round of boot files in the April 2024 CU. 24H2 was officially released on Oct. 2024, and 25H2 is simply 24H2 with patches. If you're not using an older Windows release, your boot manager doesn't have to be replaced (as long as you're using the CA 2023 version).

There are three steps in updating the SVN after Windows get installed.

Out of the box, a clean 24H2/25H2 install will try to add SVN 2.0 to UEFI.
AvailableUpdates=0x80 will bump SVN to 5.0 when DBX cancels CA 2011 at the same time.
AvailableUpdates=0x200 will bump SVN to 7.0

Systems configured for dual boot will share the same EFI partition for boot purposes. Once the first Windows instance has been updated, then it's updated for the dual boot setup. If you have two, non-dual boot setups, then the changes need to be applied for both instances. But since you're on 25H2 (or upgraded from 24H2), it's really the same boot file from when it was installed (as long as it's the CA 2023 version).

Boot manager changes are intended to be rare, because of the hassle. It's only changed for a severe security hole.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
Brian48 said:
Well, I decided to update it anyway using the commands in the first post by @garlin after saying earlier that I was going to wait.
Now I am on SVN 7.0

View attachment 155671

Interestingly, I tried my 2 USB's (24H2 & 25H2) that I have here without updating the boot files and the computer still booted fine with both and with Secure Boot enabled.
So I'm not real sure what updating the SVN actually achieves. 🤷‍♂️ :unsure:
Click to expand...
Applying SVN 7.0 prevents an older version of the boot manager from loading. 24H2 always had the right boot files (for SVN enforcement) from the start.

If you found an old W10 or W11 (before 24H2) system drive and moved it to this PC, then it wouldn't boot with Secure Boot enabled. The older releases would fail the SVN check, unless you replaced their boot files also.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
Buddywh said:
That's OK... I have one system with a BIOS that will allow appending directly into DBX, I also know MOSBY allows adding cert's of your choice to any of the variables (even PK with the system in SetupMode). I was mainly wondering if there was a way using the Microsoft Secure Boot Update task to do it.
Click to expand...
The scheduled task is only written to perform exactly the steps MS intended it do. It's not a general purpose tool for adding other certs.

There are ways to append certs (if they're signed EDK binary files) to the UEFI variables from a live Windows without Mosby. I have a working script, but it can't be shared until MS fixes a really stupid mistake they've done to a reference JSON file on their GitHub.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
You must log in or register to reply here.

Latest Support Threads

Latest Tutorials

Back
Top Bottom