Solved garlin's PowerShell scripts for updating Secure Boot CA 2023


Shinji92 said:
Would it work on my old dell e6430s laptop?
Click to expand...
I did a little research and from screenshots of your bios it looks as though version A12 has secure boot and expert key management so it has potential like my M4800. Has this laptop been upgraded to win 11 2H52? (Via Rufus?)
 

My Computer My Computer

At a glance

win 11Intell Core i7 4900 MQDDR3 16 GB
OS
win 11
Computer type
Laptop
Manufacturer/Model
Dell Precision M4800
CPU
Intell Core i7 4900 MQ
Motherboard
Dell QT3YTY A00
Memory
DDR3 16 GB
Shinji92 said:
Would it work on my old dell e6430s laptop?
Click to expand...
Your last BIOS is Jan 2019, so it's unsupported. Using Setup Mode might work after you've Reset All Keys from the BIOS menu.

PurSpyk!! said:
Would this work on an old X99 based Asus motherboard?
Click to expand...
Depends on the last BIOS date. You should name the exact motherboard model.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
LeeElectrode said:
I did a little research and from screenshots of your bios it looks as though version A12 has secure boot and expert key management so it has potential like my M4800. Has this laptop been upgraded to win 11 2H52? (Via Rufus?)
Click to expand...
Looks like A21 is the latest BIOS.
A21 BIOS
 

My Computer My Computer

At a glance

win 11Intell Core i7 4900 MQDDR3 16 GB
OS
win 11
Computer type
Laptop
Manufacturer/Model
Dell Precision M4800
CPU
Intell Core i7 4900 MQ
Motherboard
Dell QT3YTY A00
Memory
DDR3 16 GB
All 3 of my desktops appear to have downloaded new keys automatically.

All that remains is an
Acer 2023 laptop which im surprised per your comments doesnt already have support
HP Elitebook 820 G4 which is like 9 years old so I am sure that wont be supported by HP.
 

My Computers My Computers

System One System Two

  • At a glance

    11Ryzen 5900HX32GBRTX 3080 16GB
    OS
    11
    Computer type
    Laptop
    Manufacturer/Model
    ASUS
    CPU
    Ryzen 5900HX
    Motherboard
    Built In
    Memory
    32GB
    Graphics Card(s)
    RTX 3080 16GB
    Sound Card
    Onboard
    Monitor(s) Displays
    Built in
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 1TB
    Sabrent 2TB
    PSU
    240W Poorly Designed Asus Charger
    Case
    Built In
    Cooling
    Liquid Metal
    Keyboard
    Built in RGB

  • At a glance

    Windows 119900K32GB2080 TI
    Operating System
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Made
    CPU
    9900K
    Motherboard
    Asus Z390-P
    Memory
    32GB
    Graphics card(s)
    2080 TI
    Sound Card
    Onboard
    Monitor(s) Displays
    25 Inch
    Screen Resolution
    1920x1080
    Hard Drives
    256gb Crucial SSD
    1 TB WD SSD
    8 TB Samsung SSD
    PSU
    750W
    Case
    Corsair
    Cooling
    Corsair H100I
    Keyboard
    HyperX
    Mouse
    Razer Death Adder 2021 (Not full price lol)
The blocking factor in all cases is whether your OEM has provided a signed KEK CA 2023 cert, which underpins the entire migration.

Newer BIOS'es will have it pre-installed, or a recent firmware update will get you the KEK CA 2023 cert.
For older BIOS'es (like 9 years old), HP isn't going to do that. So you will have to test if replacing all the keys in Setup Mode is possible.

A not so old Acer will probably have an UEFI Setup menu which supports KEK key enrollment. In that case, the script copies the KEK CA 2023 in file format to the EFI and it can be installed by the UEFI menu from there.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
Your last BIOS is Jan 2019, so it's unsupported. Using Setup Mode might work after you've Reset All Keys from the BIOS menu.


Depends on the last BIOS date. You should name the exact motherboard model.
Click to expand...
Hi, its the Asus X99 Deluxe, with BIOS version 4101

1774208839963.webp

Probably too old
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 25H2Intel i9 14900KF64GB Corsair Vengeance RGBMSI 4090 Suprim X
    OS
    Windows 11 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom Built
    CPU
    Intel i9 14900KF
    Motherboard
    ASUS Z790 ProArt Creator WiFi
    Memory
    64GB Corsair Vengeance RGB
    Graphics Card(s)
    MSI 4090 Suprim X
    Sound Card
    Onboard
    Monitor(s) Displays
    1 x Asus 24". 1 x Asus 32"
    Screen Resolution
    1920 x 1080 & 2560 x 1440
    Hard Drives
    Multiple
    PSU
    Corsair 1200HX
    Case
    Corsair 7000D RGB
    Cooling
    Corsair H150I Capellix XT
    Keyboard
    Corsair K70 RGB PRO
    Mouse
    Corsair M55 RGB Pro
    Internet Speed
    1000Mbps
    Browser
    Edge
    Antivirus
    Windows Default

  • At a glance

    Windows 11 25H2Intel i7 6800K32GB DDR4 (Corsair)ASUS GTX 1080ti
    Operating System
    Windows 11 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom Built
    CPU
    Intel i7 6800K
    Motherboard
    ASUS Z99 Deluxe
    Memory
    32GB DDR4 (Corsair)
    Graphics card(s)
    ASUS GTX 1080ti
    Sound Card
    Onboard
    Monitor(s) Displays
    1x Viewsonic 24" 1x LG 19"
    Screen Resolution
    1920 x 1080 & 1600 x 900
    Hard Drives
    3 x SATA SSD
    PSU
    650W Gigabyte Bronze
    Case
    Coolermaster HAF-X
    Cooling
    Noctua NH-15 Chroma black
    Keyboard
    Generic RGB
    Mouse
    Microsoft Basic
    Internet Speed
    1000Mbps
    Browser
    Edge
    Antivirus
    Windows Default
Too old to be factory supported, but might work in Setup Mode.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
Can I just upload the cert from a file into bios after highlighting kek ?
bios22.webp
 

My Computer My Computer

At a glance

windows 11Intel i5-10600kf32gb corsair vengerance proAMD RX 6500XT
OS
windows 11
Computer type
PC/Desktop
Manufacturer/Model
Antec/Case
CPU
Intel i5-10600kf
Motherboard
GIGABYTE Z590 UD AC
Memory
32gb corsair vengerance pro
Graphics Card(s)
AMD RX 6500XT
Sound Card
onboard
Monitor(s) Displays
40" Hisense
Hard Drives
Samsung 850
Samsung 870
Seagate 2TB
PSU
EVGA GQ 750
If you have an unsupported BIOS, the update script will copy the KEK CA 2023 cert file to the EFI partition under folder "\EFI\Certs". You can search the system disk from the setup menu (instead of using a spare USB drive).

Some old Dell's will complain that the file is in the wrong format (expecting an .auth file).

In that case, you will need to "Delete All Keys" and run the update script. The script should detect it's in Setup Mode and install a replacement set of Secure Boot keys. But the PK will switch from Dell to a MS-issued "Windows OEM Devices PK". From there, it can finish the update process.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
If you have an unsupported BIOS, the update script will copy the KEK CA 2023 cert file to the EFI partition under folder "\EFI\Certs". You can search the system disk from the setup menu (instead of using a spare USB drive).

Some old Dell's will complain that the file is in the wrong format (expecting an .auth file).

In that case, you will need to "Delete All Keys" and run the update script. The script should detect it's in Setup Mode and install a replacement set of Secure Boot keys. But the PK will switch from Dell to a MS-issued "Windows OEM Devices PK". From there, it can finish the update process.
Click to expand...
I don't have \EFI\Certs folder
 

My Computer My Computer

At a glance

windows 11Intel i5-10600kf32gb corsair vengerance proAMD RX 6500XT
OS
windows 11
Computer type
PC/Desktop
Manufacturer/Model
Antec/Case
CPU
Intel i5-10600kf
Motherboard
GIGABYTE Z590 UD AC
Memory
32gb corsair vengerance pro
Graphics Card(s)
AMD RX 6500XT
Sound Card
onboard
Monitor(s) Displays
40" Hisense
Hard Drives
Samsung 850
Samsung 870
Seagate 2TB
PSU
EVGA GQ 750
Did you run Update_UEFI-CA2023.ps1? It should instruct to manually install the KEK key. After it does that, you need to select the boot device (trial and error, if you don't know it), until you see a "Certs" folder. The copied cert should be under the folder.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
man00 said:
Can I just upload the cert from a file into bios after highlighting kek ?
View attachment 166574
Click to expand...
Enter Bios
Enable Secure Boot
Under Expert Key Management check the box Enable Custom Mode
Delete (not reset) all Keys.
Save and exit and the PC should boot to windows.
.....................................
Run Update_UEFI-CA2023.ps1 -Revoke
Reboot to windows
Run Check_UEFI-CA2023.ps1 and you should now see:
UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

In the bios leave Expert Key Management, Enable Custom Mode "checked". Just don't go back into the bios...
 

My Computer My Computer

At a glance

win 11Intell Core i7 4900 MQDDR3 16 GB
OS
win 11
Computer type
Laptop
Manufacturer/Model
Dell Precision M4800
CPU
Intell Core i7 4900 MQ
Motherboard
Dell QT3YTY A00
Memory
DDR3 16 GB
I recommend users try the manual KEK enrollment first, and if that doesn't work, then delete all keys as the next step.

Start with the normal method, and then work your way to the next workaround. It only takes a few minutes to see if your attempt at manual enrollment is rejected or not.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
man00 said:
I don't have \EFI\Certs folder
Click to expand...
Hey friends!

The @man00 Dell bios type look exactly like mine.
Yes, it was a litle tricky to find the certs under folder "\EFI\Certs", but when i find them a error message pop-up said the certs are not properly signed (both formats).
Soo...i think in the case of @man00 the best is:

Enter Bios
Check if Secure Boot is enabled
Under Expert Key Management check the box Enable Custom Mode
Delete all Keys.
Disable secure boot
Save and exit and the PC should boot to windows.

Run the check script to unsure that the bios is in setup mode.
If yes, run the update script.

Then run check script again and see if the KEK CA 2K is presente.

If soo, reenter the bios and enable secure boot again.
Leave the custom mode enable and exit bios.

Done.
Best luck ;-)
 

My Computer My Computer

At a glance

Windows 11 Pro 25H2Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz8 GB
OS
Windows 11 Pro 25H2
Computer type
Laptop
Manufacturer/Model
Dell XPS 13 9360
CPU
Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz
Memory
8 GB
Thanks I tried everything so far thats been posted but still unable to run any of those ps1 scripts maybe changing the bios from expert to custom mode may
allow it.
Did your results look like this?
bios dell.webp
 
Last edited:

My Computer My Computer

At a glance

windows 11Intel i5-10600kf32gb corsair vengerance proAMD RX 6500XT
OS
windows 11
Computer type
PC/Desktop
Manufacturer/Model
Antec/Case
CPU
Intel i5-10600kf
Motherboard
GIGABYTE Z590 UD AC
Memory
32gb corsair vengerance pro
Graphics Card(s)
AMD RX 6500XT
Sound Card
onboard
Monitor(s) Displays
40" Hisense
Hard Drives
Samsung 850
Samsung 870
Seagate 2TB
PSU
EVGA GQ 750
man00 said:
Thanks I tried everything so far thats been posted but still unable to run any of those ps1 scripts maybe changing the bios from expert to custom mode may
allow it.
Did your results look like this?
View attachment 166594
Click to expand...
Before the update yes.

You must be able to run garlin scripts.

Lets try this:

1- Right click powershell and select "run as admistrator"

2- type this command: "Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass" without cotes and press enter.

3-Then powershell will ask if you are shure to allow to run the scrip: Tipe Y and press enter.

4- Let the powershell Windows open

5- Right click garlin Check_UEFI-CA2023.ps1 and select "copy as path"

6- Open notepad and paste what you copy in point 5.

7-When you paste you will see that the path as cotes in begining and end that you must delete.

8-After delete the path cotes, copy the result and paste in powershell

9- Press enter

With luck you will be able to run the garlin scripts

PS- This procedure just allow one time script runnings in power shell, and if you want to run one other you have to repeat this process.
 

My Computer My Computer

At a glance

Windows 11 Pro 25H2Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz8 GB
OS
Windows 11 Pro 25H2
Computer type
Laptop
Manufacturer/Model
Dell XPS 13 9360
CPU
Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz
Memory
8 GB
How does one know, from the text below, if the 2011 cert has been Revoked?

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 7.0

EFI Files
---------
Disk 1: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

STATUS REPORT
-------------
Registry: UEFICA2023Status = Updated

SUCCESS: NO UPDATES ARE REQUIRED.
 

My Computer My Computer

At a glance

win 11Intell Core i7 4900 MQDDR3 16 GB
OS
win 11
Computer type
Laptop
Manufacturer/Model
Dell Precision M4800
CPU
Intell Core i7 4900 MQ
Motherboard
Dell QT3YTY A00
Memory
DDR3 16 GB
LeeElectrode said:
How does one know, from the text below, if the 2011 cert has been Revoked?

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 7.0

EFI Files
---------
Disk 1: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

STATUS REPORT
-------------
Registry: UEFICA2023Status = Updated

SUCCESS: NO UPDATES ARE REQUIRED.
Click to expand...
Hello!
I think because its listed in UEFI DBX ;-)
 

My Computer My Computer

At a glance

Windows 11 Pro 25H2Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz8 GB
OS
Windows 11 Pro 25H2
Computer type
Laptop
Manufacturer/Model
Dell XPS 13 9360
CPU
Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz
Memory
8 GB
cool59 said:
Hello!
I think because its listed in UEFI DBX ;-)
Click to expand...
Alighty then! That led me to explore the definition of :
UEFI DBX (Forbidden Signature Database) certificates are part of the UEFI Secure Boot standard used to revoke trust in compromised or vulnerable bootloaders and drivers. It is a "blacklist" stored in firmware that prevents specific, insecure code from running, thereby protecting the system from rootkits and unauthorized, malicious firmware
 

My Computer My Computer

At a glance

win 11Intell Core i7 4900 MQDDR3 16 GB
OS
win 11
Computer type
Laptop
Manufacturer/Model
Dell Precision M4800
CPU
Intell Core i7 4900 MQ
Motherboard
Dell QT3YTY A00
Memory
DDR3 16 GB
cool59 said:
Before the update yes.

You must be able to run garlin scripts.

Lets try this:

1- Right click powershell and select "run as admistrator"

2- type this command: "Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass" without cotes and press enter.

3-Then powershell will ask if you are shure to allow to run the scrip: Tipe Y and press enter.

4- Let the powershell Windows open

5- Right click garlin Check_UEFI-CA2023.ps1 and select "copy as path"

6- Open notepad and paste what you copy in point 5.

7-When you paste you will see that the path as cotes in begining and end that you must delete.

8-After delete the path cotes, copy the result and paste in powershell

9- Press enter

With luck you will be able to run the garlin scripts

PS- This procedure just allow one time script runnings in power shell, and if you want to run one other you have to repeat this process.
Click to expand...
Got it to run the results
he execution policy helps protect you from scripts that you do not trust. Changing the execution policy might expose
you to the security risks described in the about_Execution_Policies help topic at
https:/go.microsoft.com/fwlink/?LinkID=135170. Do you want to change the execution policy?
[Y] Yes [A] Yes to All [N] No [L] No to All Suspend [?] Help (default is "N"): y
PS C:\WINDOWS\system32> C:\temp\Update_UEFI-CA2023.ps1
Downloading "KEKUpdate_Dell_PK4.bin" from GitHub.
ERROR: Failed to append "KEKUpdate_Dell_PK4.bin" to UEFI KEK.
Unexpected Result, status error: 0xC000000D
 

My Computer My Computer

At a glance

windows 11Intel i5-10600kf32gb corsair vengerance proAMD RX 6500XT
OS
windows 11
Computer type
PC/Desktop
Manufacturer/Model
Antec/Case
CPU
Intel i5-10600kf
Motherboard
GIGABYTE Z590 UD AC
Memory
32gb corsair vengerance pro
Graphics Card(s)
AMD RX 6500XT
Sound Card
onboard
Monitor(s) Displays
40" Hisense
Hard Drives
Samsung 850
Samsung 870
Seagate 2TB
PSU
EVGA GQ 750
You must log in or register to reply here.

Latest Support Threads

Latest Tutorials

Back
Top Bottom