Some the Lenovo's can get a signed KEK CA 2023, even if there's no recent BIOS update. Lenovo has been submitting them to MS.
The fallback is you can ALWAYS disable Secure Boot mode, and have Windows working again. You will have less security against rootkit attacks, but it will allow you to run check scripts, and figure out what to do next.
The update script does a best effort to update your PC.
My Wife's ASUS Laptop just got a BIOS Update maybe on Tuesday.
Some of the Taiwanese OEM's are pumping out last minute BIOS updates. It's crunch time before this summer's deadline.
Your BIOS is probably too old for factory certs. But you should check the UEFI menus, and see if there's manual key enrollment (option 2). It's the less disruptive than option 3 (Setup Mode). Every BIOS will have slightly different screens.
@garlin a little help please. I need to get the Macrium boot drive working again.
Thanks for the info.
Sorry. I turned off my PC. It is late into the night here. I am typing off my iPad. The script I advised you to run is harmless. If you get a true value after running the script, it means your m/b is capable of accepting the CA2023 certificates. You may continue to install other updated certificates as I did in my PC about a year ago. If you do not continue, you may continue using your PC as before. If you get a false value, it means your PC does not readily accept the new certificates. You have to try other ways.
1. First run the update script, it will create a new \EFI\Certs folder on the EFI partition.
Thanks for the report.
if (Test-Path $EFI_BootMgr) {
$EFI_BootMgr_Hash = (Get-FileHash -LiteralPath $EFI_BootMgr).Hash
if ($EFI_BootMgr_Hash -ne $BootMgrEX_File_Hash) {
$BCD = "${DriveLetter}:\EFI\Microsoft\Boot\BCD"
$Backup_BCD = "$env:TEMP\BCD.BAK"
try {
Copy-Item $BCD $Backup_BCD -Force
Start-Process 'bcdboot' -ArgumentList "$env:SystemRoot /s $EFI_DriveLetter /f UEFI /bootex" -NoNewWindow -Wait
Copy-Item $Backup_BCD $BCD -Force
Remove-Item $Backup_BCD -Force
}
catch {
$_.Exception.Message
exit 1
}
}
}Pick the ones that say "HD(Part 1)" or partition 1. It should list any folders or files present. If you don't see any files, then it was the wrong disk. And try a different one until you find it.
