Solved Secure Boot and BIOS update

I have a fully updated Windows 11 system, but I would like to update my UEFI BIOS. I am a little hesitant, though, as I have Secure Boot enabled (mandatory), but no bitlocker going or something alike.

So, can safely update my BIOS? Or do I run the risk of changed BIOS keys preventing my machine to boot into Windows any more? (even though I use no cryptography).

Thanks.

meimeiriver said:

I have a fully updated Windows 11 system, but I would like to update my UEFI BIOS. I am a little hesitant, though, as I have Secure Boot enabled (mandatory), but no bitlocker going or something alike.

So, can safely update my BIOS? Or do I run the risk of changed BIOS keys preventing my machine to boot into Windows any more? (even though I use no cryptography).

Thanks.

Click to expand...

Your manual says to "load BIOS defaults", before flashing the BIOS.

Two things...

1. I've successfully flashed the BIOS with and without, loading the BIOS defaults.
2. Your manual was written 2/11/2022


Two other things...

1. My manual says the same thing.
2. My manual was written before May 2020.

And another thing...

1. The last time I flashed my BIOS was 7/30/2021

Ghot said:

Your manual says to "load BIOS defaults", before flashing the BIOS.

Two things...

1. I've successfully flashed the BIOS with and without, loading the BIOS defaults.
2. Your manual was written 2/11/2022

Click to expand...

And what has this to do with secure boot, BIOS keys, and a BIOS update? Or did you just read the first few words?

meimeiriver said:

And what has this to do with secure boot, BIOS keys, and a BIOS update? Or did you just read the first few words?

Click to expand...

I only enabled Secure Boot after the first time I installed the Insider Windows 11.
Right now, I'm trying to figure out when that was.

I know I joined this forum 6/16/2021

Ghot said:

I only enabled Secure Boot after the first time I installed the Insider Windows 11.
Right now, I'm trying to figure out when that was.

Click to expand...

Let me clarify then. The moment of turning secure boot on is not that relevant to me (should indeed be after you first set BIOS values to default, then flashed, then re-able secure boot). The real question is, are the BIOS keys used by Secure Boot going to get changed by the BIOS update? (In such a way that Windows won't be able to boot any more).

meimeiriver said:

Let me clarify then. The moment of turning secure boot on is not that relevant to me (should indeed be after you first set BIOS values to default, then flashed, then re-able secure boot). The real question is, are the BIOS keys used by Secure Boot going to get changed by the BIOS update? (In such a way that Windows won't be able to boot any more).

Click to expand...

Did you or did you not.... SET a Secure Boot Key?

Your downloadable manual doesn't mention anything about Secure Boot.
It only mentions how to flash the BIOS.
Mine says I have to SET a Secure Boot key.... just enabling Secure Boot doesn't SET a key.


So... without a screenshot of your Secure Boot settings in YOUR BIOS...

Ghot said:

Did you or did you not.... SET a Secure Boot Key?

Click to expand...

Nope, I set nothing. :) I only enabled Secure Boot and TPM, as Windows 11 wanted me to do so. But that's the crux of the matter: do Secure Boot keys get used merely by enabling Secure Boot, or only when you're using bitlocker or the like? Because if the former, then I will have just bricked my OS after a BIOS update.

meimeiriver said:

Nope, I set nothing. :) I only enabled Secure Boot and TPM, as Windows 11 wanted me to do so. But that's the crux of the matter: do Secure Boot keys get used merely by enabling Secure Boot, or only when you're using bitlocker or the like? Because if the former, then I will have just bricked my OS after a BIOS update.

Click to expand...

This is what I'm trying to figure out by "dates".
I have never used Bitlocker, and I never SET a Secure Boot key.

IF your BIOS also requires you to SET a Secure Boot Key... then the answer is... you can safely flash your BIOS.
I, we, can't answer the question of whether or not YOUR BIOS set a Secure Boot key automatically, until we SEE your Secure Boot BIOS settings. :)


According to MY BIOS settings and WHEN I enabled Secure Boot... Secure Boot keys don't get set by default.




You can use a smart phone to take pics of your BIOS, or a USB stick and the F12 key, to take screenshots of your BIOS.

Ghot said:

Your manual says to "load BIOS defaults", before flashing the BIOS.

Click to expand...

That doesn't make sense as the BIOS will reset after a flash so it should be "Load Optimized Defaults" after the flash. NOT before.

Yeah, I just read Section 3.3, page 3-3 of the owner's manual (PDF), and see the Note (pointed finger) is misplaced. It should be after the BIOS update procedures. BTW it's "Load Optimized Defaults" not "load BIOS defaults".

meimeiriver said:

I have a fully updated Windows 11 system, but I would like to update my UEFI BIOS. I am a little hesitant, though, as I have Secure Boot enabled (mandatory), but no bitlocker going or something alike.

So, can safely update my BIOS? Or do I run the risk of changed BIOS keys preventing my machine to boot into Windows any more? (even though I use no cryptography).

Thanks.

Click to expand...

You can safely update your UEFI BIOS. The cryptography keys will change because of the update, but this will not prevent you from booting into Windows. And because you have not activated Bitlocker, you also don't need to use your recovery key. I did update my own Secure Boot BIOS and it did go well. I updated my Secure Boot BIOSto Prime X299-AII BIOS Ver. 1004 (with Resize BAR enabled). See attached screenshot for showing my update from Version 0901 to Version 1004.

memo09 said:

You can safely update your UEFI BIOS. The cryptography keys will change because of the update, but this will not prevent you from booting into Windows. And because you have not activated Bitlocker, you also don't need to use your recovery key. I did update my own Secure Boot BIOS and it did go well.

Click to expand...

Thank you. :) This is what I needed to hear.

meimeiriver said:

Thank you. :) This is what I needed to hear.

Click to expand...

So did I... which is what I was trying to figure out in post #2.
"Whether or not I had Secure Boot enabled when I did the last BIOS Flash".


But none of us are on a Z690 motherboard.
Which is why, rather than "guessing", you should "read" or take screen shots of your Secure Boot settings in YOUR BIOS.

meimeiriver said:

And what has this to do with secure boot, BIOS keys, and a BIOS update? Or did you just read the first few words?

Click to expand...

Here's a basic video of how to enable Secure Boot on an Asus board...


Note if you don't get the Secure Boot enable button you may need to disable CSM - that's how it works on my Gigabyte board.

Before ASUS stopped including relevant information in downloadable motherboard pdf manuals...
This is what MY BIOS has for Secure Boot settings...




If your settings look like this... and you never SET a Secure Boot key, you'll probably be OK.

Ah ha!
It seems ASUS did the same thing for the Z600 series chipset manuals... that they did for the X500 series chipset manuals.

In other words... your manual "for" your actual BIOS settings is ONLY available,
on the ASUS TUF GAMING Z690-PLUS D4 motherboard manuals page.

Here's the link for the BIOS settings manual for the Z600 series motherboards.




YOUR Secure Boot settings seem to be the same, as mine anyway, so you should be OK.
Please post back with your flashing results. :)

​

I like the way that my new Dell XPS 9510, that you see in "My Computer" below, just now handled my BIOS update. I have the "Dell Command Update" app installed and it informed me that a BIOS update was ready. I was informed that Updating the BIOS required that my charger remain connected. I initiated the process and from there everything was fully automated. I have BitLocker active and turned ON. As I watched the process, BitLocker was turned OFF for the update and then turned back ON again when finished. After the auto restart I was fully updated to BIOS 1.10.1. My BitLocker Key did not change and remained the same. The entire BIOS update took less than 10 minutes.

meimeiriver said:

I have Secure Boot enabled (mandatory)

Click to expand...

Who is mandating that?
It is not MS. MS only specify that Windows 11 computers are Secure-boot-capable not that Secure boot is enabled.
See, for example, Windows 11 and Secure Boot - MSSupport

Denis

Try3 said:

Who is mandating that?
It is not MS. MS only specify that Windows 11 computers are Secure-boot-capable not that Secure boot is enabled.
See, for example, Windows 11 and Secure Boot - MSSupport

Denis

Click to expand...

True. But I figured I might as well enable it when I bought my new system (needed for TPM). But maybe it's indeed not a bad idea to disable secure boot first, before I do the BIOS update -- just in case.

A note of caution, I bought a new system and used my old system Windows image (Macrium created) restored to the new systems drive, the new system had already been setup with secure boot enabled from the system builders.
The image restored successfully and booted but threw up a message about the TPM keys had changed and my PIN was no longer valid.
The reason I am mentioning this is because Windows presents a dialogue to allow you to reset the PIN, but the function seemed broken for me, and just loops between "set new PIN" and "something went wrong".
This has been mentioned in other threads on this forum, it may have been fixed in a new build though.
The only option was to fresh install, which worked fine and I could set my PIN to the one I used on the old system during setup with no issue.
So if your BIOS update clears your TPM keys (again, an issue mentioned in other threads on this forum) then it is entirely possible your Windows will need a new PIN/ password setting and this may well bug out, necessitating a fresh install.
It might be an idea to check the forums for your hardware to see if others have had issues with BIOS updates.

Secure boot is a feature to verify if the OS is digitally signed. It wont interfere on BIOS update and BIOS update wont interfere on booting Windows.
Don't use a Windows BIOS update app. Update your BIOS using BIOS Update on BIOS.