How to check if your Secure Boot certs are updated. (three methods)

HeavyHemi · Dec 18, 2025

Okay... one more little thing cleared up.

I'm not sure why this wasn't showing up before that my system was using the Do Not Trust AMI test platform key. I was able to append the microsoft platform key without issues directly in the BIOS using the Windows OEM PK certificate.

nikki605 · Dec 18, 2025

nikki605 said:
I followed the steps in the other thread and got as far as "True" but then the Registry showed NotStarted rather than Updating.

View attachment 157316

View attachment 157317

@Ghot I ran your instructions a second time and PowerShell again came back with "True" but this time when I checked the Registry, it said "InProgress", not "Updating"

I DID NOT GO ON TO THE STEPS IN PART B. SHOULD I HAVE?

Yes - I hate Microsoft for making this so complicated.

starchase · Dec 18, 2025

nikki605 said:
@Ghot I ran your instructions a second time and PowerShell again came back with "True" but this time when I checked the Registry, it said "InProgress", not "Updating"

I DID NOT GO ON TO THE STEPS IN PART B. SHOULD I HAVE?

View attachment 157324

Yes, feel free to proceed to Step 2. The InProgress state is where I am, even after doing Step 2, probably twice. But as reported by some it may take even a few days to have the cert transferred to the EFI partition. You may have to practice patience. I post this because I don't see the following in the output you've included:

Code:

EFI Files
---------
    Disk 0: Boot Manager [Windows UEFI CA 2023] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] is in UEFI DB, and Windows is starting from CA 2023 Boot Manager.

colinp · Dec 18, 2025

Did I win?

Thanks guys for the detailed help for an old b@$t@red like me

"you like me, you really like me!"

edit: Oh yeah, my registry status said "in progress" too.

garlin · Dec 18, 2025

colinp said:
Did I win?

You're good for 2025. Next year is the mandatory revocation step, but that won't happen for 6 months.

nikki605 · Dec 18, 2025

starchase said:
Yes, feel free to proceed to Step 2. The InProgress state is where I am, even after doing Step 2, probably twice. But as reported by some it may take even a few days to have the cert transferred to the EFI partition. You may have to practice patience. I post this because I don't see the following in the output you've included:

Code:

EFI Files --------- Disk 0: Boot Manager [Windows UEFI CA 2023] is ALLOWED. Registry: WindowsUEFICA2023Capable = 2 [Windows UEFI CA 2023] is in UEFI DB, and Windows is starting from CA 2023 Boot Manager.

@starchase @garlin and @Ghot - I THINK I GOT IT!! I went ahead and did the steps in Part B. and these were my results:

Registry shows Updated

Check Script shows Windows is starting from CA 2023 Boot Manager

Is that it? Have I successfully installed the 2023 certificates on my Lenovo T490 laptop?

garlin · Dec 18, 2025

nikki605 said:
Is that it? Have I successfully installed the 2023 certificates on my Lenovo T490 laptop?

Yes.

nikki605 · Dec 18, 2025

garlin said:
Yes.

FANTASTIC!! I'll take a couple of deep breaths and try it on my M83 unsupported hardware in a couple days.

Ghot · Dec 18, 2025

nikki605 said:
I THINK I GOT IT!!

Yep. You got it. Good job.

nikki605 · Dec 19, 2025

Ghot said:
Yep. You got it. Good job.

I'm going to rest my brain for a couple days and then try the same steps on my wife's older, unsupported hardware, Lenovo M83 desktop (2014 vintage that shipped with Win 7 Pro, later upgraded to Win 10 Pro and now Win 11 Pro 25H2). If I break it, she will kill me. Macrium full backup before attempting.

hader · Dec 19, 2025

HeavyHemi said:
Okay... one more little thing cleared up. View attachment 157319

I'm not sure why this wasn't showing up before that my system was using the Do Not Trust AMI test platform key. I was able to append the microsoft platform key without issues directly in the BIOS using the Windows OEM PK certificate.

If you still getting this screen you must run "Apply 2023 KEK, DB and bootmgfw update.cmd" also because your KEK and DB is not updated yet. After that; There should be green checkmarks visible inside Current UEFI KEK and Current UEFI DB. (DBX is OK)

pietcorus2 · Dec 19, 2025

Should I worry if "secure boot" is not enabled in bios..........? :wink:

ASUS did not updated my Z97-K !

nikki605 · Dec 19, 2025

HeavyHemi said:
Okay... one more little thing cleared up. View attachment 157319

I'm not sure why this wasn't showing up before that my system was using the Do Not Trust AMI test platform key. I was able to append the microsoft platform key without issues directly in the BIOS using the Windows OEM PK certificate.

@HeavyHemi What did you run to get the above information? I've not seen that screen before. Just curious.

hader · Dec 19, 2025

nikki605 said:
@HeavyHemi What did you run to get the above information? I've not seen that screen before. Just curious.

Can answer that; Get the zip-file (under code) at: GitHub - cjee21/Check-UEFISecureBootVariables: PowerShell scripts to check the UEFI KEK, DB and DBX Secure Boot variables as well as scripts for other Secure Boot related items. A neat set of scripts. Colors, Checkmarks and crosses says it all.

nikki605 · Dec 19, 2025

Thanks @hader ! Interesting. Now I just have to interpret it...

Looking through the readme info, it looks like some of the other commands can be dangerous and cause unintended problems. Not sure I want to mess with those since I don't know what I'm doing. One red X and 3 red Nones.

gunrunnerjohn · Dec 19, 2025

I decided to run this analysis, I'm guessing the two red X marks are because the BIOS doesn't have these default certs? What exactly is the meaning of the entries under the UEFI DBX listing? I know I have the Windows 2011 cert revoked, but that's all that appears there in other listings.

pietcorus2 · Dec 19, 2025

Im on ASUS Z97-K , legacy-bios , no secure-boot enabled , latest bios-update from 05-02-2020.
Just checked ; no updates available , from the ASUS-site.

WHAT ?? , should I do , after reading the secure-boot forums .............?
(btw; this PC works very fine on latest Win11 , booting fast also......)

Do I really need " secure boot" and EUFI instead of legacy..............!!!?

HeavyHemi · Dec 19, 2025

hader said:
If you still getting this screen you must run "Apply 2023 KEK, DB and bootmgfw update.cmd" also because your KEK and DB is not updated yet. After that; There should be green checkmarks visible inside Current UEFI KEK and Current UEFI DB. (DBX is OK)

The only thing that I still don't have, that I have been told I do not need, is the Microsoft UEFI CA 2023 in the Current UEFI DB. I've run that script you suggested several times and I get an access error in the event viewer.

hader · Dec 19, 2025

nikki605 said:
Thanks @hader ! Interesting. Now I just have to interpret it...

Looking through the readme info, it looks like some of the other commands can be dangerous and cause unintended problems. Not sure I want to mess with those since I don't know what I'm doing. One red X and 3 red Nones.

View attachment 157430

View attachment 157424

You have to worry if there are red crosses at "Current UEFI". Default UEFI are values if you reset the stuff which is not needed.
You can get rid of those None values by Appyling a SVN update to the firmware. You can initiate that by the following commands; (Powershell as admin)

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Everything else now is as it should. When SVN shows 7.0, 3.0, 3.0 then you are done! Current UEFI, PK, KEK, DB and DBX are already OK.

nikki605 · Dec 19, 2025

hader said:
You have to worry if there are red crosses at "Current UEFI". Default UEFI are values if you reset the stuff which is not needed.
You can get rid of those None values by Appyling a SVN update to the firmware. You can initiate that by the following commands; (Powershell as admin)
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Everything else now is as it should. When SVN shows 7.0, 3.0, 3.0 then you are done! Current UEFI, PK, KEK, DB and DBX are already OK.

@hader The commands in your post didn't display.

How to check if your Secure Boot certs are updated. (three methods)

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers