How to check if your Secure Boot certs are updated. (three methods)

Dirtyflash said:

You need to reset the bootloader back to 2011. Once done, you can turn secure boot back on.

Type the following commands one at a time with administrator privileges:


Mountvol s: /s

del s:\*.* /f /s /q

bcdboot %systemroot% /s S:

Click to expand...

mountvol S: /s
copy \Windows\Boot\EFI\bootmgfw.efi S:\EFI\Microsoft\Boot\bootmgfw.efi
mountvol S: /d

garlin said:

A safer method (without wiping the EFI's contents, because other features might be keeping files stored there) is:

Code:

mountvol S: /s
copy \Windows\Boot\EFI\bootmgfw.efi S:\EFI\Microsoft\Boot\bootmgfw.efi
mountvol S: /d

Click to expand...

garlin said:

A safer method (without wiping the EFI's contents, because other features might be keeping files stored there) is:

Code:

mountvol S: /s
copy \Windows\Boot\EFI\bootmgfw.efi S:\EFI\Microsoft\Boot\bootmgfw.efi
mountvol S: /d

Click to expand...

garlin said:

Due to the UEFI security model, you can't delete an already enrolled cert from Windows.

What you can do:

- If your UEFI menu allows, manually delete PCA 2011 from the DBX variable​

- Otherwise, clear the entire DBX variable​

- If that's not supported, delete all the variables (Setup Mode), and repeat the update process without the revocation.​

Hopefully you have a relatively "modern" UEFI and you get an option to delete individual certs from DBX. The reason you can't do this from Windows is an attacker would have the same abilities as you. Therefore the override has to be done physically from the UEFI menu.

Click to expand...

LongScaryName said:

Intel Compute Stick STK1A32SC w/fully updated Windows 10 32bit installation. (Yeah, I know.....). Here's what I have done:


View attachment 163197
View attachment 163198
View attachment 163193
View attachment 163195
View attachment 163199
View attachment 163200

As you can see, I used MOSBY to do the update in the bios. It seemed to go just fine, but now when I enable secure boot, I get the error message "A bootable device has not been detected." Boots fine without secure boot enabled. I'm really, REALLY stumped at this point. Any advice anyone has would be greatly appreciated. I've done, checked, redone, rechecked, SO many times now, I'm about to pull what's left of my hair out. Thanks in advance.

Click to expand...

Sequence said:

Current UEFI DB
√ Microsoft Windows Production PCA 2011 (revoked: False)
√ Microsoft Corporation UEFI CA 2011 (revoked: False)
√ Windows UEFI CA 2023 (revoked: False)
X Microsoft UEFI CA 2023
X Microsoft Option ROM UEFI CA 2023
√ GIGABYTE (revoked: False)
√ GIGABYTE (revoked: False)

Click to expand...

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x1800 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Sequence said:

Current UEFI DBX
2025-10-14 (v1.6.0) [x64] : SUCCESS: 431 successes detected
Windows Bootmgr SVN : None
Windows cdboot SVN : None
Windows wdsmgfw SVN : None

Click to expand...

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x282 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Sequence said:

Hi garlin,

thanks for your reply. So i won't care about the "Microsoft"-ones anymore, nice.

What would the first two commands you posted exactly change in my list?

I think i won't revoke the 2011, if i don't need to. But would i get a version output under SVN then?

Click to expand...

How to do the SVN Update...​

Sequence said:

Hi there,

i just registered here, because it seems as if there was not enough profound knowledge about this topic in German-speaking forums.

Could somebody of you tell me if i have to follow further steps, especially with the "Microsoft UEFI CA 2023, the "Microsoft Option ROM UEFI CA 2023" and the "none"-output under "Current UEFI DBX"?

I read through many threads on elevenforum, but can't quite sort out what to do now and what to avoid, as there seem to be different opinions.



My output reads as follows:

-----

Click to expand...

In order to get rid off those 1801 TPM errors; run the following commands first (powershell as admin)
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f
schtasks /run /tn "\Microsoft\Windows\PI\Secure-Boot-Update"

Then read this post; (Get the latest script from cjee21)

How to check if your Secure Boot certs are updated. (three methods)

Method Two... 1. Download the script at the bottom of this post. 2. Extract the Check-SecureBootCerts.ps1 script and place it on your desktop. 3. Go to: C:\Users\your account name\Desktop and right click Desktop and choose: Open in Terminal 4. In the powershell window that pops up, type...

www.elevenforum.com

In order to get rid of those None values, read this post;

How to check if your Secure Boot certs are updated. (three methods)

Okay... one more little thing cleared up. I'm not sure why this wasn't showing up before that my system was using the Do Not Trust AMI test platform key. I was able to append the microsoft platform key without issues directly in the BIOS using the Windows OEM PK certificate.

www.elevenforum.com

If the values are not 7.0, 3.0 and 3.0 that means you have not updated your Windows to the current version.

You can solve all red crosses inside the current section of the UEFI DB. (Those are the currently active and the most important ones)
If there are red crosses in the default section of the UEFI DB; They can only be solved by a BIOS update.
If there isn't one. Don't worry, important is that the current settings of the UEFI DBX are green. Those are the ones that must be in order.
Goodluck.

Sequence said:

Is it okay to have no output for the defaults on a Surface Pro 7?:

Click to expand...