Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

anchamp65 said:

You ran the commands in the MStore one, try them in the other window, this one

View attachment 178107

But have you tried Garlin's commands again ? in either one ?

EDIT:
I think I found why your not finding the new one you installed with winget.
On my systems, I uninstalled all Powershell versions except the one from winget.
So when I search for PowerShell, that's the only one it finds.
Instead of searching for "PowerShell" in the Start Menu, search for "pwsh", it should show you the one you installed with winget.
You should now see this one, right click and start as administrator and test Garlin's commands.

View attachment 178125

Click to expand...

Searching the start menu for pwsh doesn't look like your screen shot.

@garlin
Going back to 26200.8894 makes all your scripts work for me as they did before.
Right clicking on them and selecting Run with Powershell opens admin powershell and they run as expected.
Whatever broke that when I installed 26200.8973 is either a me problem, or a they problem, not a you problem.

Sorry for any confusion.

peace
wanna

garlin said:

Normally Secure Boot (as related to the certs) only prevents a boot file from booting. It shouldn't have other bad effects.

The exceptions are conflicts with a GPU's signed firmware (this is a well-known issue in the NVIDIA community, but the problem is the same) where it's not allowed once CA 2011 is revoked, and on occasion where your UEFI's NVRAM has corruption issues and "freezes" up whenever the Secure Boot task tries to check in there's any new work to be performed.

There hasn't been any NVRAM corruption issues reported on ASRock motherboards, so it's more likely a GPU issue with older cards. Newer cards have signed firmware which is compatible with CA 2023.

Click to expand...

On my HP Z440 workstation I have an old Nvidia Quadro K2200, running with bios version 82.07.A4.00.0C from 30 jan 2017 (is the newest bios available). How can I determine if the firmware of the GPU may give problems or not with the new sec boot certs 2023? I have the new sec boot certs 2023 installed, and revoked the 2011 certs. And my computer runs well. Does it mean that all is well, or can the GPU still cause problems in October?

nikki605 said:

Searching the start menu for pwsh doesn't look like your screen shot.

Click to expand...

ok, but did you retry Garlin's command in it or any other that you now have ?

Capricornus said:

On my HP Z440 workstation I have an old Nvidia Quadro K2200, running with bios version 82.07.A4.00.0C from 30 jan 2017 (is the newest bios available). How can I determine if the firmware of the GPU may give problems or not with the new sec boot certs 2023? I have the new sec boot certs 2023 installed, and revoked the 2011 certs. And my computer runs well. Does it mean that all is well, or can the GPU still cause problems in October?

Click to expand...

The problem isn't compatibility with new CA 2023 certs, it's because the old GPU firmware was signed with CA 2011.

After you explicitly ban CA 2011, old GPU's can no longer present a trusted cert to the UEFI and won't be allowed to handle video setup through the GOP. Some 3rd-party projects are trying to switch the existing firmware by re-signing them with a CA 2023 cert, so they can be trusted again.

Unfortunately, I don't have a legacy NVIDIA card that old. You can scrounge around for a graphics card made in the last 3-4 years (which probably have a newer VBIOS or can be updated). Or try suffering through this Reddit thread:

PSA: Secure Boot 2026 June cert expiry can block older NVIDIA GOPs at POST

But the topic is of real concern to folks using really, really old NVIDIA's.

garlin said:

The problem isn't compatibility with new CA 2023 certs, it's because the old GPU firmware was signed with CA 2011.

After you explicitly ban CA 2011, old GPU's can no longer present a trusted cert to the UEFI and won't be allowed to handle video setup through the GOP. Some 3rd-party projects are trying to switch the existing firmware by re-signing them with a CA 2023 cert, so they can be trusted again.

Unfortunately, I don't have a legacy NVIDIA card that old. You can scrounge around for a graphics card made in the last 3-4 years (which probably have a newer VBIOS or can be updated). Or try suffering through this Reddit thread:

PSA: Secure Boot 2026 June cert expiry can block older NVIDIA GOPs at POST

But the topic is of real concern to folks using really, really old NVIDIA's.

Click to expand...

Thank you very much for that link.
I tried the different official nvidia tools. First v2, and v1.2 but those did offer nothing. But v1.1 did offer an upgrade, which I accepted. Afterwards, on restarting my computer, it booted normally, and my graphics card works well too.
I also had a quick look at the unofficial tools, but they are way beyond my present knowledge, so I will stay well away.

In order to check what happened, I did try to run the powershell script that was mentioned in that reddit thread, but it threw an exception I did not understand.

I then looked further into that thread and saw this workaround:
How to Easily Check GOP Version

1. Download and install GPU-Z Click here to download GPU-Z - techpowerup.com
2. Open GPU-Z
3. Save your BIOS using GPU-Z with the button next to the BIOS version on the right side.
4. Download GOP updater / Click here to download GOP_Updater - pCloud
5. Choose version v0.5.2
6. Extract it somewhere on the disk
7. Move the saved VBIOS file to the extracted folder
8. Drag and drop the VBIOS onto the GOPupd batch file (GOPupd.bat) and check the GOP version

I tried that and got this result:

************************* GOPupd 1.9.6.5.k mod v0.5 *************************


************************ Drop VBIOS file on this .bat ***********************


Using python from GOPupd

Dumping info from = bios 82.07.a4.00.0c GM107.rom


Found Nvidia IFR header before ROM start, size 0x600

ID of IFR header = CC77-4956

ID of ROM file = 10DE-13BA


***************************************************************
*** Extracting with UEFIRomExtract by AndyV ***
***************************************************************

Found compressed EFI ROM start at 0x50
Input size: 69552, Output size: 134528, Scratch size: 13368

---------------------------------------------------------------

***************************************************************
*** Extracting with GOPupd... ***
***************************************************************

Nvidia GOP 0x10036 Variant 0x0000000000000005 = GM1xx

Dated: Jan 16 2017 Changelist 21577143

Most likely signed by: Microsoft Corporation UEFI CA 2011

Machine Code = x64

Checksum CRC32 = EB0E4B16

---------------------------------------------------------------

***************************************************************
*** Processing with Python... ***
***************************************************************

You already have the latest available GOP!


---------------------------------------------------------------


Press any key to exit..


So, it looks like I need to search for another graphics card. The big questions now is: which one and will it work on this computer? The K2200 is one without need for a power cable. Hence no power supply in this computer that can give me power for a modern graphics card. By the looks of it, a new computer may be a better investment.

Capricornus said:

So, it looks like I need to search for another graphics card. The big questions now is: which one and will it work on this computer? The K2200 is one without need for a power cable. Hence no power supply in this computer that can give me power for a modern graphics card. By the looks of it, a new computer may be a better investment.

Click to expand...

You could look at USB graphics cards if you want to keep your HP Z440 workstation running.
No idea on the price or if they have 2023 certs, but you could give it a look...
Maybe go to your local computer shop, they might be able to guide you.

garlin said:

I have a bare bones guide in the README_UEFI.TXT, which could be expanded with that text.

If you run the update script, it will temporarily suspend BitLocker for one reboot (following MS's guidance) whenever it applies any certs. I will have the script also suspend BitLocker when it copies the cert file to the EFI volume. Just in case the manual enrollment works, and you forgot to suspend or disable BitLocker before starting.

The suspension will clear when the reboot counter drops to zero.

Click to expand...

In my case, BitLocker recovery became necessary when I disabled secure boot, before running your script. Fortunately, I was prepared for that.

Edit: or at least that's how I remember it. I did a lot of different things before running your script.

Capricornus said:

So, it looks like I need to search for another graphics card. The big questions now is: which one and will it work on this computer? The K2200 is one without need for a power cable. Hence no power supply in this computer that can give me power for a modern graphics card. By the looks of it, a new computer may be a better investment.

Click to expand...

*******************************************************************************
hello,
-it seems i am in a pretty similar f**d situation; i have an ASUS pc from 2016 with a NVIDIA GeForce GT 720 graphic card with BIOS v 80.28.80.00.09 [UEFI] and driver v30.0.14.7514 (GeForce 475.14) from 2024 June------
-after make the update of the Secure Boot 2023 certs (thanks again to garlin), now comes this issue with the graphic card when the revocation comes (if i understand correctly..)
-i guess one possible and radical "solution" to keep using the pc, would be disable the Secure Boot in the BIOS with its inherent consequences; am i right?
best regards,
fernando
----------------------
PS C:\windows\system32> C:\Users\fbm\Desktop\Check_UEFI-CA2023.ps1 -Verbose
Windows 10 21H2 (19044.7548)

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

BIOS Firmware
-------------
ASUSTeK COMPUTER INC. M32CD_A_F_K20CD_K31CD
Version: 1102
Date: 2018-04-12

Factory Default UEFI PK Cert
----------------------------
ASUSTeK MotherBoard PK Certificate

UEFI PK Cert
------------
Windows OEM Devices PK

Factory Default UEFI KEK Certs
------------------------------
Microsoft Corporation KEK CA 2011
Canonical Ltd. Master Certificate Authority
ASUSTeK MotherBoard KEK Certificate

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Canonical Ltd. Master Certificate Authority
ASUSTeK MotherBoard SW Key Certificate
ASUSTeK Notebook SW Key Certificate

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
(NONE)
EFI_CERT_SHA256_GUID Signatures: 77

UEFI DBX Certs
--------------
(NONE)
Windows BootMgr SVN is MISSING.
EFI_CERT_SHA256_GUID Signatures: 445

UEFI Variables
--------------
SBAT (Linux only): sbat,1,2024010900 / shim,4 / grub,3 / grub.debian,4

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\\.\HarddiskVolume6\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.342, SVN 9.0

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.


REQUIRED ACTION
===============
To REVOKE the [PCA 2011] cert, run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x280 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

fernando BARBA said:

hello,
-it seems i am in a pretty similar f**d situation; i have an ASUS pc from 2016 with a NVIDIA GeForce GT 720 graphic card with BIOS v 80.28.80.00.09 [UEFI] and driver v30.0.14.7514 (GeForce 475.14) from 2024 June------
-after make the update of the Secure Boot 2023 certs (thanks again to garlin), now comes this issue with the graphic card when the revocation comes (if i understand correctly..)
-i guess one possible and radical "solution" to keep using the pc, would be disable the Secure Boot in the BIOS with its inherent consequences; am i right?

Click to expand...

fernando BARBA said:

UEFI DBX Certs
--------------
(NONE)
Windows BootMgr SVN is MISSING.
EFI_CERT_SHA256_GUID Signatures: 445

Click to expand...

Your BIOS has not revoked PCA 2011. When that change happens, your GT 720 will probably stop working since the firmware is not re-signed with a CA 2023 cert.

Just like everyone else, your options are:
1. Keep Secure Boot disabled.
2. Replace the graphics card with a less outdated model.

fernando BARBA said:

-i guess one possible and radical "solution" to keep using the pc, would be disable the Secure Boot in the BIOS with its inherent consequences; am i right?

Click to expand...

A third option is to switch to integrated graphics, which your CPU supports.

garlin said:

Your BIOS has not revoked PCA 2011. When that change happens, your GT 720 will probably stop working since the firmware is not re-signed with a CA 2023 cert.

Just like everyone else, your options are:
1. Keep Secure Boot disabled.
2. Replace the graphics card with a less outdated model.

Click to expand...

I only have theoretical experience.
But I think his graphics card will not stop working after revoking the "Windows Production PCA 2011" certificate, because the graphics card firmware is signed with the "Microsoft Corporation UEFI CA 2011" certificate. In order for his graphics card to stop working, he would have to revoke the "Microsoft Corporation UEFI CA 2011" certificate.

I installed Window 11 26H2 on my HP EliteBook notebook PC on 01 August. It runs without any issue so far.

When I run the Secure Boot check certificates script, I get this result in AUDIT REPORT section:



When I run the commands in REQUIRED ACTION section and, after restarting I re-check the certificates status, I get the same result. Nothing changes.

This is the bootmgfw.efi version in System partition:



What can be the reason ? Any ideas.

Scott said:

A third option is to switch to integrated graphics, which your CPU supports.

Click to expand...

*******************************
thank you, Scott
yes, the ASUS have another, (than the own NVIDIA card), HDMI port which i guess is an input only port and a VGA port which implies that i´d need an adapter VGA/HDMI as my monitor only has a HDMI and DISPLAY PORT inputs...,
fernando

fernando BARBA said:

... NVIDIA GeForce GT 720 graphic card ...
... revocation ...
...
REQUIRED ACTION
===============
To REVOKE the [PCA 2011] cert, run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x280 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Click to expand...

In my opinion, revoking the PCA 2011 certificate has no effect on the Nvidia GPU, because the Nvidia GPU is signed with the UEFI CA 2011 certificate. In my opinion, if you revoke the PCA 2011 certificate with the quoted command, the Nvidia GPU will continue to work, because the Nvidia GPU firmware is signed with the UEFI CA 2011 certificate and this certificate is not revoked by the quoted command.

Edit:
The above information is not true based on the information below from suatchini54.

Revoking PCA 2011 certificate causes boot failure on my Asus motherboard if GPU is signed with UEFI CA 2011 certificate and CSM support on the motherboard is disabled. Enabling CSM support eliminates boot failure and my PC boots fine.

suatcini54 said:

Revoking PCA 2011 certificate causes boot failure on my Asus motherboard if GPU is signed with UEFI CA 2011 certificate and CSM support on the motherboard is disabled. Enabling CSM support eliminates boot failure and my PC boots fine.

Click to expand...

I didn't know that, does Asus have some kind of faulty implementation? :-(

Monika1491 said:

I didn't know that, does Asus have some kind of faulty implementation? :-(

Click to expand...

Sorry I can't tell. When I disable CSM, I meet with beeps and a notice on red background window reading that there is boot failure. Press F1 to enter into BIOS, bla.. bla..

this maybe of help for those with Nvidia cards

you are most likely going to need a BIOS or firmware update for Nvidia GPU's for them to boot with the new windows secure boot certs

if they have any available.
best of luck Steve ..

This is the screen I get if I disable CSM support. Sorry for the background color. It was dark, not red.



The behavior was different before I revoked PCA 2011 certificate. My GFX card is UEFI compatible.



Hope this answers your question about Asus having some kind of faulty implementation.