Solved Secure Boot question

Scramjet · Dec 2, 2025

Hi All,
I am just curious about how MS will upgrade the Secure Boot Certificate on my computer if I had it disabled up to now. . If I have Secure Boot enabled, does WU scan my computer and see if I have the older certificate and upgrade to the 2023 automatic? I am sure there are people like me who would attempt to manually upgrade if needed. but I just wanted to be sure if I don't need to attempt that route.

Cheers

garlin · Dec 2, 2025

Updated versions of W10 22H2 and W11 have a SecureBootUpdates folder and a separate scheduled task.

The scheduled task runs at certain intervals and informs Windows that your Secure Boot certs are out of compliance. Right now, that creates an alert in the Event Viewer logs. Technically it's informational, but it's categorized as an "error" for reporting purposes.

If you manually set a certain reg key, that same task can attempt to install the missing Secure Boot certs into your UEFI as needed. Right now, this operation is optional and can be manually done. Next year, Windows will roll out changes in a future Monthly Update so that process is mandatory.

MS is allowing some PC and motherboard makers a few last months to ship BIOS updates, or provide Secure Boot signed files (KEK CA 2023) to MS for inclusion in their repository. For a large number of PC's, the update process should work fine. For the others, either a manual update process or running the Mosby tool will work.

Windows Update isn't involved, except to push new Monthly Updates (which will contain future programs to finish the Secure Boot migration process).

Ghot · Dec 2, 2025

Scramjet said:
Hi All,
I am just curious about how MS will upgrade the Secure Boot Certificate on my computer if I had it disabled up to now. . If I have Secure Boot enabled, does WU scan my computer and see if I have the older certificate and upgrade to the 2023 automatic? I am sure there are people like me who would attempt to manually upgrade if needed. but I just wanted to be sure if I don't need to attempt that route.

Cheers

Secure boot update HowTo

i have put this together as i had problems updating 2 desktops and 3 laptops. which have now all had their Secure Boot Certs updated to the new 2023 secure boot cert also the other post about this were getting very long and confusing. this is in two parts. part A and part B. edit by me. please...

www.elevenforum.com

OK, I finally got the results as shown in post #1 above.

I used Terminal (Admin), instead of my old shortcuts to powershell (admin) and Command prompt (admin).

How to check if your Secure Boot certs are updated. (three methods)

Method One Download cjee21's files, attached to the bottom of this post. 1. Save the file to your desktop. 2. Extract the contents to your desktop. 3. Open: Check-UEFISecureBootVariables-main 4. Right click: Check UEFI PK, KEK, DB and DBX.cmd ...and choose: Run as administrator. Your...

www.elevenforum.com

Scramjet · Dec 2, 2025

Thank you for the replies. @ghost I clicked on 'how to check your secure boot certs' and i can't seem to get both methods to work. I copied the scripts to the desktop and when I right-click and open in terminal it prompts me and I click on to run, but i can see a flash of the power terminal and it is red. When I copy the scripts in the powershell and execute they show red text. not sure what I am doing wrong here

pparks1 · Dec 2, 2025

My son was installing some new games on his PC and i guess some of the anti-cheat stuff is requiring TPM2 and Secure Boot to run.

Scramjet · Dec 2, 2025

I know the reason why I can't run the scripts. PowerShell execution policy is preventing scripts from running because it is set to 'Restricted'. I tried to change it but it still denies all scripts. Wonder if that is caused because I enabled secure boot? Sorry new at trying this today.

Ghot · Dec 2, 2025

Scramjet said:
I know the reason why I can't run the scripts. PowerShell execution policy is preventing scripts from running because it is set to 'Restricted'. I tried to change it but it still denies all scripts. Wonder if that is caused because I enabled secure boot? Sorry new at trying this today.

Copy and paste the command(s)

Open Terminal (Admin) and type: set-executionpolicy unrestricted
Run the script(s), then...
To close it again afterward... set-executionpolicy restricted

Scramjet · Dec 2, 2025

Thank you ghot. I went into the bios to see if i could find it there but could not. I rebooted and came here and read your reply. I did try the set-executionpolicy unrestricted script before I rebooted and all I got was errors about being restricted. It would not change. After a reboot I copied and paste it in admin powershell with no errors. I then ran the scripts perfect. Something must have been bugged in Windows or I may have been required to reboot again after I enabled Secure Boot to execute commands in the Powershell I guess.
The results were:
UEFI KEK Certs CA 2011
UEFI DB Certs CA 2011 ans PCA 2011
EFI Files Disk 2: Boot Manager PCA 2011 is ALLOWED.
Registry: WindowsUEFICA2023Capable = 0
[Windows UEFI CA 2023] is not in UEFI DB.

So I guess this means I only have 2011 and not 2023 at this time.
Apologies for my confusion here. Greatly appreciate the replies.

cheers

andrew129260 · Dec 2, 2025

pparks1 said:
My son was installing some new games on his PC and i guess some of the anti-cheat stuff is requiring TPM2 and Secure Boot to run.

yes for anticheat more and more games will require it.

Ghot · Dec 2, 2025

Scramjet said:
So I guess this means

Go back and do this again. Follow the directions exactly.

Secure boot update HowTo

i have put this together as i had problems updating 2 desktops and 3 laptops. which have now all had their Secure Boot Certs updated to the new 2023 secure boot cert also the other post about this were getting very long and confusing. this is in two parts. part A and part B. edit by me. please...

www.elevenforum.com

Scramjet · Dec 2, 2025

Ghot said:
Go back and do this again. Follow the directions exactly.

Secure boot update HowTo

i have put this together as i had problems updating 2 desktops and 3 laptops. which have now all had their Secure Boot Certs updated to the new 2023 secure boot cert also the other post about this were getting very long and confusing. this is in two parts. part A and part B. edit by me. please...

www.elevenforum.com

That worked perfect ghot. I am now on Certificate 2023....woot!
Thank you so much for all your help.
Seasons Greetings to you!

KevTech · Dec 2, 2025

Ghot said:
Copy and paste the command

Or just put this before the script.

powershell -nop -ep bypass -f

So if script was in D: drive.

powershell -nop -ep bypass -f "D:\Check_EFIBootFile.ps1"

Scott · Dec 2, 2025

Ghot said:
Copy and paste the command(s)

Open Terminal (Admin) and type: set-executionpolicy unrestricted
Run the script(s), then...
To close it again afterward... set-executionpolicy restricted

I found a shortcut for that today. New feature?

Ghot · Dec 2, 2025

Scott said:
I found a shortcut for that today. New feature?

I dunno. Probably came with Terminal, but was hidden so well... LOL

XxXxX · Dec 2, 2025

Scramjet said:
That worked perfect ghot. I am now on Certificate 2023....woot!
Thank you so much for all your help.
Seasons Greetings to you!

from the link @Ghot posted
you are going to have to do part B again

only part B
as you have the 2023 cert available but the system is not using it at boot

the WindowsUEFICA2023Capable should = 2

so please do part B of this link again.

Secure boot update HowTo

i have put this together as i had problems updating 2 desktops and 3 laptops. which have now all had their Secure Boot Certs updated to the new 2023 secure boot cert also the other post about this were getting very long and confusing. this is in two parts. part A and part B. edit by me. please...

www.elevenforum.com

best of luck Steve ..

Ghot · Dec 2, 2025

Scott said:
To get WindowsUEFICA2023Capable should = 2 he needs to add the “Windows Production PCA 2011”
certificate to the Secure Boot UEFI Forbidden List (DBX).

I got it without doing that...

Scott · Dec 2, 2025

Ghot said:
I got it without doing that...

Interesting...

XxXxX · Dec 2, 2025

Scott said:
Part B won't do it for @Scramjet , he has all the required certificates.

To get WindowsUEFICA2023Capable should = 2 he needs to add the “Windows Production PCA 2011”
certificate to the Secure Boot UEFI Forbidden List (DBX). Once it's revoked, the computer will boot with the
new certificate. Only then will it = 2.

Part 3 in this doc, about half way down.
View attachment 155327

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x80 /f

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Verify installation and revocation list was successfully applied by looking for event 1037 in the event log.
For information about Event 1037, see KB5016061: Secure Boot DB and DBX variable update events. Or, run the following
PowerShell command as Administrator and make sure it returns True:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbx).bytes) -match 'Microsoft Windows Production PCA 2011'

there is no need to revoke the 2011 cert

the 2011 cert can remain but by default if the 2023 cert is available the system can be set to boot from that 2023 cert only.

my systems, 2 desktops and 3 laptops, still have the 2011 cert within secure boot
but boot from the 2023 cert once i had activated it for the systems to use
MS will revoke the 2011 cert at a later time, i would leave that to MS.

best of luck Steve ..

Scott · Dec 2, 2025

Maybe part B will work for him.

XxXxX said:
my systems, 2 desktops and 3 laptops, still have the 2011 cert within secure boot

Which leaves your system vulnerable to all kinds of nasty stuff, like BlackLotus, for example.

My Windows Production PCA 2011 certificate has been revoked for over two years now.

I'll go ahead and delete my post, so as to not add any confusion.

XxXxX · Dec 2, 2025

Scott said:
Maybe part B will work for him.

Which leaves your system vulnerable to all kinds of nasty stuff, like BlackLotus, for example.

My Windows Production PCA 2011 certificate has been revoked for over two years now.

I'll go ahead and delete my post, so as to not add any confusion.

but also means i can re-install Windows 11 24H2 and/or 25H2
if the 2011 cert is removed 24H2 and/or 25H2 wont recognise secure boot
as they dont have the secure boot 2023 cert within the install
as the default at the moment is 2011 secure boot cert.

best to leave the secure boot 2011 cert in place and let MS revoke it when and if they decide to.
best of luck Steve ..

Solved Secure Boot question

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Similar threads

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer

My Computer

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers