Let's install Windows 11 on incompatible hardware

LASTBOOMER66 said:

This PC may not get feature updates but it will get security updates. It seams a good path to go VRS going the route of paying for the ESU each year. ?

Click to expand...

My unsupported System Two has been running W11 since the launch in 2021. Windows Update has delivered every update that any supported device would get - except for Feature Updates. Those I had to install myself.

Only organizations have to pay for ESU. Windows 10 Consumer ESU is easy to get for free as long as you have a Microsoft account. I don't think I've seen anyone actually pay for it, I certainly didn't.

If you can bypass compatibility check and upgrade to Windows 11 24H2 or 25H2, it is much better than staying with Windows 10. Free ESU is up to October 2026, then you will have to upgrade to Windows 11 anyway. I see no reason to postpone it. All applications and games work both on Windows 10 and 11.

With the secure boot certificates expiring soon, how does this affect older computers that support secure boot but will never recieve any BIOS updates? I have a 2 test computers with a X99 and X79 chipset (ASUS)

If you own a PC that stopped receiving BIOS updates after 2023, you may have to run W11 with Secure Boot disabled.

Windows works fine without Secure Boot, but you don't get the additional security benefits (like Virtualization Based Security). MS can't remotely enable or disable Secure Boot, since it can only be changed from the BIOS menu. They might introduce a "nag" warning later this year that your PC is insecure, but they will allow W11 to operate on non-Secure Boot PC's.

garlin said:

If you own a PC that stopped receiving BIOS updates after 2023, you may have to run W11 with Secure Boot disabled.

Windows works fine without Secure Boot, but you don't get the additional security benefits (like Virtualization Based Security). MS can't remotely enable or disable Secure Boot, since it can only be changed from the BIOS menu. They might introduce a "nag" warning later this year that your PC is insecure, but they will allow W11 to operate on non-Secure Boot PC's.

Click to expand...

What are some ways we can compensate for having this secure boot off ? Apparently compromised boot files can not be detected after the fact with windows already loaded - but we can make a flash drive with ESET security and boot up with that and check the hidden EFI partition ? or do a special thing with windows defender to detect. ?

LASTBOOMER66 said:

What are some ways we can compensate for having this secure boot off ? Apparently compromised boot files can not be detected after the fact with windows already loaded - but we can make a flash drive with ESET security and boot up with that and check the hidden EFI partition ? or do a special thing with windows defender to detect. ?

Click to expand...

The Secure Boot certs don't just protect the boot file, they also authorize any embedded UEFI code which can execute before Windows or Linux is loaded. A rootkit can bury itself in the UEFI, so it remains even after you wiped the disk and re-installed the OS.

Black Lotus is very real, and after someone demonstrates an exploit it's likely that other players will try duplicating the technique.

Secure Boot exists in the first place because OS-based security measures aren't enough in the first place.

garlin said:

The Secure Boot certs don't just protect the boot file, they also authorize any embedded UEFI code which can execute before Windows or Linux is loaded. A rootkit can bury itself in the UEFI, so it remains even after you wiped the disk and re-installed the OS.

Black Lotus is very real, and after someone demonstrates an exploit it's likely that other players will try duplicating the technique.

Secure Boot exists in the first place because OS-based security measures aren't enough in the first place.

Click to expand...

How would one know if a device is already compromised? There's this big push to update the Secure Boot certs, but would it be too late in some instances?

PurSpyk!! said:

With the secure boot certificates expiring soon, how does this affect older computers that support secure boot but will never recieve any BIOS updates? I have a 2 test computers with a X99 and X79 chipset (ASUS)

Click to expand...

There are methods of manually updating your platform Key for X99 systems. I am currently good to go using the Windows OEM PK. Like you, there is not going to be a BIOS update.
The only thing I've not done yet is revoke the 2011 certs.

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

BIOS Firmware
-------------
EVGA INTERNATIONAL CO. Default string
Version: 2.08
Date: 2019-06-27

Factory Default UEFI PK Cert
----------------------------
DO NOT TRUST - AMI Test PK

UEFI PK Cert
------------
Windows OEM Devices PK

Factory Default UEFI KEK Certs
------------------------------
Microsoft Corporation KEK CA 2011

UEFI KEK Certs
--------------
Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
(NONE)
EFI_CERT_SHA256_GUID Signatures: 13

UEFI DBX Certs
--------------
(NONE)
Windows BootMgr SVN 7.0
EFI_CERT_SHA256_GUID Signatures: 436

EFI Files
---------
Disk 0: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
bootmgfw.efi File version: 26100.30227

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.


REQUIRED ACTION
===============

To revoke the [PCA 2011] cert, run the commands, run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x80 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Dirtyflash said:

How would one know if a device is already compromised? There's this big push to update the Secure Boot certs, but would it be too late in some instances?

Click to expand...

You don't. That's why MS made the decision to ban the Production PCA 2011 cert. This blocks any rootkit code signed using the known hole with the old Windows boot loader. It's a drastic move since it breaks every older Windows release from W8 to W10 21H2, and older Linux versions.

MS doesn't know the extent of how far PCA 2011-based rootkits have gone, all they can do is the right decision to ban the cert.

In any event, CA 2011 certs will expire and can no longer sign updated boot files released past this October. So if there's a boot security hole that needs to patched in 2027, your existing UEFI won't honor it since it can't be validated using the existing certs.

garlin said:

You don't. That's why MS made the decision to ban the Production PCA 2011 cert. This blocks any rootkit code signed using the known hole with the old Windows boot loader. It's a drastic move since it breaks every older Windows release from W8 to W10 21H2, and older Linux versions.

MS doesn't know the extent of how far PCA 2011-based rootkits have gone, all they can do is the right decision to ban the cert.

In any event, CA 2011 certs will expire and can no longer sign updated boot files released past this October. So if there's a boot security hole that needs to patched in 2027, your existing UEFI won't honor it since it can't be validated using the existing certs.

Click to expand...

Garlin, I have had my head buried in the sand regarding this issue of late so I'm a bit late to the party on the current status. I just want to make sure that I understand what you are saying above. Are you saying that after October this year it really does not matter if the 2011 cert is revoked since it won't work anyway?

I seem to already have the 2023 cert on the machines I spot checked so far.

A signing cert remains effective as long as:
1. You've added it to your secure certificate store (in Windows) or added to the BIOS (UEFI).
2. The cert has not been revoked by being added to a revocation list. In Windows, CRL is the revocation list that's updated once a week. For the UEFI, it's the DBX list.

Assuming a cert is both trusted (stored) and not revoked, then it validates any file signed by the cert within the cert's lifetime.

The normal lifetime for PCA 2011 runs from 2011 to 2026 (15 years). When the cert expires, it cannot be used to validate a file since the date range is an inherent property of any signing cert. Any Windows file that was signed earlier between 2011 and late 2026 will be valid even after Oct. 2026, because it falls in the supported date range.

The only thing that can change that fact is to revoke the signing cert (untrusting all those files).

If you assume Windows is static (there's no more updates), then your end-of-life Windows and expired UEFI certs can continue operating past 2026, even with Secure Boot enabled. That's perfectly legal. The problem is Windows isn't static, and there's always updates as long as your release is supported. As soon as MS needs to close a new boot security hole, a new file must be released.

PCA 2011 can't be used to sign this new file after PCA 2011 expires. Therefore a new set of replacement certs is required (CA 2023), which resets the date range from 2023 to 2038 (15 years). Even if you didn't need to revoke CA 2011, future security fixes would need a valid signing cert covering future dates.

Hopefully history won't repeat itself and we're forced to revoke CA 2023. Everyone should have learned some hard lessons on how botched this rollout became (both from MS and the OEM's faults), and improve the process for the next time.

---

Ever installed an ancient device driver on a more recent Windows system? Chances are you could be using a really old driver which has never been rewritten, or re-signed by a current cert. But how can this outdated driver by trusted by newer Windows?

It's because the driver installer installs a copy of the (now expired) vendor cert into your Windows cert store. Since you blindly clicked on the OK button when the installer asked you to trust the vendor's cert (because everyone always clicks OK), then the outdated driver is now trusted. Both the driver and its matching vendor cert are out of date, but it works since you agreed to honor it in the cert store.

garlin said:

If you own a PC that stopped receiving BIOS updates after 2023, you may have to run W11 with Secure Boot disabled.

Windows works fine without Secure Boot, but you don't get the additional security benefits (like Virtualization Based Security). MS can't remotely enable or disable Secure Boot, since it can only be changed from the BIOS menu. They might introduce a "nag" warning later this year that your PC is insecure, but they will allow W11 to operate on non-Secure Boot PC's.

Click to expand...

I'm sure there will be patches to hide this annoying reminder.

Django said:

IoT Enterprise LTSC 2021support till 2032, which i installed

Click to expand...

There is no legit way to activate this, unless you have an Agreement with Microsoft.

spapakons said:

There is no legit way to activate this, unless you have an Agreement with Microsoft.

Click to expand...

1 minute search google found this, Or is it all pirated?

Django said:

how do i get win11 onto this machine? win 10 ltsc is running great and win11 23h2 is no option because support ends soon, so what do i do?

View attachment 162574

Click to expand...

I stopped worrying about updates and I'm using version 11 21h2, which ended support a year and four months ago, and the system is perfect. I've been using my PC for a month without restarting, putting it in standby every day, and it's working well, perfect stability and speed. I doubt that version 11 25h2 would make my PC faster than this 21h2. If you want to test this version, there's a link in my signature.

maur0 said:

1 minute search google found this, Or is it all pirated?

Microsoft Windows 10 IoT Enterprise LTSC

Windows 10 Enterprise LTSC 2021 builds on Windows 10 Enterprise LTSC 2019, adding premium features such as advanced protection against modern security threats and comprehensive device management, app management, and control capabilities.

www.buykeysoft.com

Power Your IoT Devices with Windows 10 IoT LTSC 2021 Key at VIP-SCDKeyss

Power your IoT devices with a Windows 10 IoT LTSC 2021 key from VIP-SCDKeyss, designed for dedicated device scenarios. Benefit from our fast delivery and professional deployment guidance.

www.vip-scdkeyss.com

Click to expand...

They are genuine volume keys but the EULA states to be used in specific situations. Certainly not on a home PC. While you are legally covered as soon as you buy them with a valid receipt or invoice, Microsoft thinks otherwise. If you don't mind violating the EULA, then you should be OK.

Thing is as always.. what is it you want Ltsc might be the way from my experience works well .. next to no feature updates to me a good thing and security updates for years to come ... Just don't expect MS support ....still better than a pirated key I think

Some confusion still, in the case that a PC can not update to the CA 2023 because there is not enough room or what ever. -- If I add a boot entry as a check to see if it will be overwritten after a BIOS flash as some BIOS does not wipe out the NVRAM during a flash if a PC has been re-flashed with the latest BIOS and it removed the boot entry I made, this would clean up any firmware modification that could exist. ? Because if the reflash of the bios removes the boot entry it will also remove everything from the NVRAM. ? NVRAM is the place where the bios puts all the CRT AND KEK and all the accept and reject information. THEN:

If the hard drive was cleaned with the manufactures CLEAN function - this wipes everything off the SSD drive --- and I did not add any drivers that were not on the windows 11 install unless they were checked to be safe, in this case this machine would be free of any firmware compromise. ? --
RIGHT? at least its 99.99% likely to be clean of any firmware modification. ?
Apparently the compromise happens when we allow a hardware driver that is not signed - it has the ability to infect the firmware. ? It seams if a Paid version of Antivirus was running on this machine then compromise of the firmware would be unlikely ? My understanding is firmware rootkit happens by installing unsigned programs that were not hash checked. IM still a bit confused as to how a firmware compromise happens without a person being present at the machine ? or even how the keys get updated to CA 2023 without me being present. I would at least like to find out if I can make a safe OFFLINE system out of these older machines that refuse to update to CA 2023

If I had a PC that cannot upgrade the certificate (mine doesn't even have Secure Boot), I would simply keep Secure Boot off and get on with my life. It is not the end of the World and certainly it is not a serious reason (for me at least) to spend a fortune on a new PC. Why a fortune? Because I don't want to relace my current PC with anything newer. I want to have comparable features or better. Now I have 3rd generation Core-i7 with 16GB, no way I am switching to humble Core-i3, I want a newer Core-i7 or Core-i9 which currently I cannot afford.