Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Marie SWE · 2026-06-21T09:56:04-0400

garlin said:
If you try entering a password guess 3 times, and it returns a 8-digit error code onscreen, you might be able to use this website to recover the password:
BIOS Master Password Generator for Laptops

BIOS Password Backdoors in Laptops

Sadly those don't work on my HP EliteBook 840 G3
My bios is locked and i dont have the password. and the company this came from had gone bankruptcy so they had a lot of computer stuff out on auction to bring in as much to pay of the company debts.... and this sucks as there is no IT department to call.

I have used the computer for a few years now with locked bios password.. but it starts to suck as i cant flash the Bios.
(this is the one i will install win2024LTSC on, so if i want to use secure boot i need to solve this)

KevTech · 2026-06-21T10:18:11-0400

Marie SWE said:
My bios is locked and i dont have the password.

Have you tried HP bios configuration utility?

HP BIOS Configuration Utility | HP Client Management Solutions

HP BIOS Configuration Utility

ftp.ext.hp.com

Marie SWE · 2026-06-21T10:41:33-0400

KevTech said:
Have you tried HP bios configuration utility?

HP BIOS Configuration Utility | HP Client Management Solutions

HP BIOS Configuration Utility

ftp.ext.hp.com

I dont remember... I do see that i have visit that page and clicked on the user guide https://ftp.hp.com/pub/caps-softpaq/cmit/whitepapers/BIOS_Configuration_Utility_User_Guide.pdf as it was marked as visited.

But i dont remember if i tried it, as it was almost two years ago i tried unlock the Bios.

But thanks for the tip i will have a look..

I dont have a windows version on that computer right now, so i can test it right now on the spot... So i have to open it up and switch the disk to make a bare metal install first.

anchamp65 · 2026-06-21T11:45:55-0400

Marie SWE said:
I dont remember... I do see that i have visit that page and clicked on the user guide https://ftp.hp.com/pub/caps-softpaq/cmit/whitepapers/BIOS_Configuration_Utility_User_Guide.pdf as it was marked as visited.
But i dont remember if i tried it, as it was almost two years ago i tried unlock the Bios.

But thanks for the tip i will have a look..
I dont have a windows version on that computer right now, so i can test it right now on the spot... So i have to open it up and switch the disk to make a bare metal install first.

I used this tool many years ago and to change the password, you need to provide the current password.
Has you can see in the extract from page 7 of the PDF.
AFAIK, the only way to remove the password, without knowing the current password, is the CMOS battery removal method.

Also, the save/restore of config (get, set) don't work on all computers, it's more for entreprise models. And I've had issues in the past where it did not extract all settings and when trying to apply them to other computers with same BIOS version it would leave some settings in unknown state and ended up doing a factory reset on the those computers. I never used the tools afterwards because of that.

garlin · 2026-06-21T11:49:03-0400

CMOS battery removal only works for motherboards. Laptops are different, there is no internal space to fit a "coin battery".

anchamp65 · 2026-06-21T12:00:20-0400

garlin said:
CMOS battery removal only works for motherboards. Laptops are different, there is no internal space to fit a "coin battery".

Even laptops have a CMOS batteries, it's just harder to get to and usually implies removing a bunch of other parts to get to the battery.
Complexity depends on each brand and model.

I've opened enough desktops and laptops in my carreer, they all have a CMOS batteries....

And some laptops have a plugable battery which is a CR2032 but encapsulated with a 2 pin connector that plugs into the motherboard.
Desktops usually have a standard CR2032 that inserts into the dedicated slot on the motherboard.

XxXxX · 2026-06-21T12:00:39-0400

Marie SWE said:
Sadly those don't work on my HP EliteBook 840 G3
My bios is locked and i dont have the password. and the company this came from had gone bankruptcy so they had a lot of computer stuff out on auction to bring in as much to pay of the company debts.... and this sucks as there is no IT department to call.

I have used the computer for a few years now with locked bios password.. but it starts to suck as i cant flash the Bios.
(this is the one i will install win2024LTSC on, so if i want to use secure boot i need to solve this)

you are goiing to have to contact HP support

Contact HP - Office locations

www.hp.com

you will need to ask for a SMC.bin file .. How To here

https://h30434.www3.hp.com/t5/Notebooks-Archive-Read-Only/How-to-get-SMC-bin-file/td-p/6086763

which will open your BIOS as Admin so the BIOS password can be deleted or changed.
best of luck Steve ..

Marie SWE · 2026-06-21T12:00:40-0400

anchamp65 said:
I used this tool many years ago and to change the password, you need to provide the current password.
Has you can see in the extract from page 7 of the PDF.
AFAIK, the only way to remove the password, without knowing the current password, is the CMOS battery removal method.

View attachment 174848

Sadly this laptop dont have the password stored in the bios itself, so that method to erase the password don't work.
Instead they have a tiny chip that is almost next to the bios on the motherboard that handle the password and isn't depended on external power from the cmos battery. The way to erase that can be done by shorten it out by shorten two pins and hit the power button, and 1second after the power starts flowing you remove the shorten pin.
Downside with this method is that its a 40% chance you fry the chip and the laptop become a paperweight.. so its not recommended and that is why i haven't tried it, as a locked bios is better then a paperweight. *LOL*

garlin said:
CMOS battery removal only works for motherboards. Laptops are different, there is no internal space to fit a "coin battery".

True, they dont have the classic 2032.. they have tiny ones that is solder on cable and then have a tiny connector to the board.

I recently got angry at that new stupid solution, so on my newest MSI laptop, i looked up some free space in the case and put in a 2032 holder and ran cables to the MB-connector so i now have a classic cmos battery solution.

Marie SWE · 2026-06-21T12:04:19-0400

XxXxX said:
you are goiing to have to contact HP support

Contact HP - Office locations

www.hp.com

you will need to ask for a SMC.bin file .. How To here

https://h30434.www3.hp.com/t5/Notebooks-Archive-Read-Only/How-to-get-SMC-bin-file/td-p/6086763

which will open your BIOS as Admin so the BIOS password can be deleted or changed.
best of luck Steve ..

Yeah i know i have to do that... and i hate talking to them nowadays when i dont call in as a business... as private person you have to explain half the world before you actually get help... as a business, you just state the problem and you are served the solution within 2 minutes.

LeeElectrode · 2026-06-21T12:06:58-0400

garlin said:
CMOS battery removal only works for motherboards. Laptops are different, there is no internal space to fit a "coin battery".

On all my Dell laptops there is a CMOS battery. Although these batteries are of the "coin" type they generally have postitive and negative wires flash welded to them and a tiny connector on the other end. Pull the connector from the mother board and the bios gets reset... at least the time and date and the hard drive configuration. The pic is of a Dell Precision M6800 MB but the cmos battery is from a HP laptop I junked some time ago.

anchamp65 · 2026-06-21T12:11:40-0400

Marie SWE said:
The way to erase that can be done by shorten it out by shorten two pins and hit the power button

Yup, seen those too

Marie SWE said:
True, they dont have the classic 2032.. they have tiny ones that is solder on cable and then have a tiny connector to the board.
I recently got angry at that new stupid solution, so on my newest MSI laptop, i looked up some free space in the case and put in a 2032 holder and ran cables to the MB-connector so i now have a classic cmos battery solution.

Soldered one are the worst and riskiest to replace

anchamp65 · 2026-06-21T12:13:46-0400

LeeElectrode said:
On all my Dell laptops there is a CMOS battery. Although these batteries are of the "coin" type they generally have postitive and negative wires flash welded to them and a tiny connector on the other end. Pull the connector from the mother board and the bios gets reset... at least the time and date and the hard drive configuration. The pic is of a Dell Precision M6800 MB but the cmos battery is from a HP laptop I junked some time ago.View attachment 174849

Yup, 2 pins and double sided tape to hold them in place

Marie SWE · 2026-06-21T12:19:03-0400

anchamp65 said:
Yup, seen those too

Soldered one are the worst and riskiest to replace

Yeah.. soldering on motherboards do require some experience... and i do not recommend people trying to "fix" hardware without have some experience of it.

But it feels like this thread are starting to derailing, so lets all get back to topic.

anchamp65 · 2026-06-21T12:25:02-0400

Marie SWE said:
But it feels like this thread are starting to derailing, so lets all get back to topic.

True, my bad...

Bottom line, as Garlin mentioned multiple times, people need to find how to clear the keys and go into setup mode.
If they have a password portected BIOS, they need to figure out how to remove it and in some cases they actually have to set a password to access advance settings.

gunrunnerjohn · 2026-06-21T13:23:49-0400

anchamp65 said:
Even laptops have a CMOS batteries, it's just harder to get to and usually implies removing a bunch of other parts to get to the battery.
Complexity depends on each brand and model.

I've opened enough desktops and laptops in my carreer, they all have a CMOS batteries....
And some laptops have a plugable battery which is a CR2032 but encapsulated with a 2 pin connector that plugs into the motherboard.
Desktops usually have a standard CR2032 that inserts into the dedicated slot on the motherboard.

Most have batteries, but modern laptops are a Royal PITA to open up, so it's not a simple slide the battery out affair!

hsehestedt · 2026-06-21T16:12:05-0400

I'm late to the party. I've been ignoring this topic until now.

I used Garlin's script to update my secure boot on a Mini PC today. I should note that before today this BIOS had no Secure Boot option. I had to request an updated BIOS from the Mini PC maker to get that option.

After performing the required steps, Windows reported that Secure Boot was enabled and that all required certs were present. Everything seemned fine at this point. But at that point I went back into the BIOS and changed Secure Boot from Custom to Standard. Upon doing so, the system will no longer boot with Secure Boot enabled, I get the invalid signature error at boot.

So, my question: Am I supposed to leave Secure Boot in Custom mode or am I supposed to be changing it back to Standard? If the intention is to change it to Standard, what else am I supposed to be doing to prevent the error?

Br0die · 2026-06-21T16:17:04-0400

You have to leave it in custom. My bios says that if you change back to standard it reverts back to the original settings.

garlin · 2026-06-21T16:26:26-0400

Standard mode implies you're only using the factory defaults. This is a specific security setting, as this set of certs cannot be compromised after you install the firmware image.

If your BIOS never got a later update to add the CA 2023 certs, you must use Custom mode to make new additions and permanently leave it in Custom. Switching from Custom to Standard mode gets you a security violation error on most BIOS'es.

It's probably a symptom of poor BIOS design. If you wanted to switch back to Standard mode, the BIOS should inform that it's clearing the current keys and reloading factory defaults instead of throwing a violation error. Instead, your BIOS doesn't make this clear.

hsehestedt · 2026-06-21T18:54:15-0400

Br0die said:
You have to leave it in custom. My bios says that if you change back to standard it reverts back to the original settings.

garlin said:
Standard mode implies you're only using the factory defaults. This is a specific security setting, as this set of certs cannot be compromised after you install the firmware image.

If your BIOS never got a later update to add the CA 2023 certs, you must use Custom mode to make new additions and permanently leave it in Custom. Switching from Custom to Standard mode gets you a security violation error on most BIOS'es.

It's probably a symptom of poor BIOS design. If you wanted to switch back to Standard mode, the BIOS should inform that it's clearing the current keys and reloading factory defaults instead of throwing a violation error. Instead, your BIOS doesn't make this clear.

Thanks, much appreciated. I had two Mini PCs that both had no way to enable Secure Boot but falsely reported to the OS that they were Secure Boot capable. That way they pass Windows 11 requirement checks without really being Secure Boot capable. Fortunately, I was able to get a BIOS update for both by contacting the manufacturer of those Mini PCs.

garlin · 2026-06-21T19:03:33-0400

hsehestedt said:
Thanks, much appreciated. I had two Mini PCs that both had no way to enable Secure Boot but falsely reported to the OS that they were Secure Boot capable. That way they pass Windows 11 requirement checks without really being Secure Boot capable. Fortunately, I was able to get a BIOS update for both by contacting the manufacturer of those Mini PCs.

I'm guessing they cheated by setting the UEFI's "SecureBoot" variable as true, and called it a day.

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

I almost never bite.......

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

I almost never bite.......

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

I almost never bite.......

My Computers My Computers

At a glance

At a glance

I almost never bite.......

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

I almost never bite.......

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computers

My Computers

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer

My Computer

My Computers

My Computer