Solved Secure boot update HowTo


I keep saying TEMPORARILY disable Secure Boot. You can't tell what's wrong without a working system. No Secure Boot = no security violation.
 

My Computer

System One

  • OS
    Windows 7
garlin said:
I keep saying TEMPORARILY disable Secure Boot. You can't tell what's wrong without a working system. No Secure Boot = no security violation.
Click to expand...
I think that what is wrong is that it reset to the factory keys. Now I don't know how to get back to the ones it was using.
 

My Computer

System One

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8930
    CPU
    Intel I9-9900K
    Memory
    64GB
    Graphics Card(s)
    NVIDIA RTX 2060
    Sound Card
    NVIDIA High Definition Audio
    Monitor(s) Displays
    4k Samsung
    Screen Resolution
    3840 x 2160
    Hard Drives
    512GB NVMe, ADATA SU 800, 2TB HDD
You need to boot Windows without Secure Boot, so the script can report what the current settings are. I presume the boot file is CA 2023, and you have no CA 2023 certs to authorize it. That's the simplest explanation.

I'm going to Chipotle's and you should have disabled Secure Boot, by the time I get back...
 

My Computer

System One

  • OS
    Windows 7
fg2001gf11F said:
I think that what is wrong is that it reset to the factory keys. Now I don't know how to get back to the ones it was using.
Click to expand...
Yes, I already did that and came up, how do I fix it to get secure boot back?
 

My Computer

System One

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8930
    CPU
    Intel I9-9900K
    Memory
    64GB
    Graphics Card(s)
    NVIDIA RTX 2060
    Sound Card
    NVIDIA High Definition Audio
    Monitor(s) Displays
    4k Samsung
    Screen Resolution
    3840 x 2160
    Hard Drives
    512GB NVMe, ADATA SU 800, 2TB HDD
fg2001gf11F said:
Yes, I already did that and came up, how do I fix it to get secure boot back?
Click to expand...

start the update secure boot cert process again
if that fails

go back into the BIOS and reset the secure boot and TPM to system defaults.
best of luck Steve ..
 

My Computers

System One System Two

  • OS
    Windows 11 Home
    Computer type
    PC/Desktop
    Manufacturer/Model
    HP 24" AiO
    CPU
    Ryzen 7 5825u
    Motherboard
    HP
    Memory
    64GB DDR4 3200
    Graphics Card(s)
    Ryzen 7 5825u
    Sound Card
    RealTek
    Monitor(s) Displays
    24" HP AiO
    Screen Resolution
    1920 x 1080 @60 Hz
    Hard Drives
    1TB WD Blue SN580 M2 SSD Partitioned.
    2x 1TB USB HDD External Backup/Storage.
    PSU
    90W external power brick
    Case
    24" All in One
    Cooling
    Default Air Cooling
    Keyboard
    HP WiFi UK extended
    Mouse
    HP WiFi 3 Button
    Internet Speed
    1GB full fibre
    Browser
    Edge & Firefox
    Antivirus
    AVG Internet Security/Windows Defender
    Other Info
    Mainly Open Source Software
  • Operating System
    Ubuntu 22.04.5 LTS
    Computer type
    Laptop
    Manufacturer/Model
    Dell 13" Latitude 2017
    CPU
    i5 7200u
    Motherboard
    Dell
    Memory
    16GB DDR4
    Graphics card(s)
    Intel
    Sound Card
    Intel
    Monitor(s) Displays
    13" Dell Laptop
    Hard Drives
    250GB Crucial 2.5" SSD
    Mouse
    Generic WiFi 3 button
    Internet Speed
    WiFi only
    Browser
    Firefox
    Antivirus
    ClamAV TK
    Other Info
    Mainly Open Source Software
XxXxX said:
start the update secure boot cert process again
if that fails

go back into the BIOS and reset the secure boot and TPM to system defaults.
best of luck Steve ..
Click to expand...
I think the update for the CA 2023 only works if secure boot is on. Catch 22?
 

My Computer

System One

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8930
    CPU
    Intel I9-9900K
    Memory
    64GB
    Graphics Card(s)
    NVIDIA RTX 2060
    Sound Card
    NVIDIA High Definition Audio
    Monitor(s) Displays
    4k Samsung
    Screen Resolution
    3840 x 2160
    Hard Drives
    512GB NVMe, ADATA SU 800, 2TB HDD
fg2001gf11F said:
I think the update for the CA 2023 only works if secure boot is on. Catch 22?
Click to expand...

go back into your BIOS please.
re-enable secure boot then use the settings within the BIOS to set secure boot to its default settings.

or reset the BIOS to its factory defaults including the secure boot settings
save settings and exit .. restart the system.

now see if it boots into Windows
best of luck Steve ..
 

My Computers

System One System Two

  • OS
    Windows 11 Home
    Computer type
    PC/Desktop
    Manufacturer/Model
    HP 24" AiO
    CPU
    Ryzen 7 5825u
    Motherboard
    HP
    Memory
    64GB DDR4 3200
    Graphics Card(s)
    Ryzen 7 5825u
    Sound Card
    RealTek
    Monitor(s) Displays
    24" HP AiO
    Screen Resolution
    1920 x 1080 @60 Hz
    Hard Drives
    1TB WD Blue SN580 M2 SSD Partitioned.
    2x 1TB USB HDD External Backup/Storage.
    PSU
    90W external power brick
    Case
    24" All in One
    Cooling
    Default Air Cooling
    Keyboard
    HP WiFi UK extended
    Mouse
    HP WiFi 3 Button
    Internet Speed
    1GB full fibre
    Browser
    Edge & Firefox
    Antivirus
    AVG Internet Security/Windows Defender
    Other Info
    Mainly Open Source Software
  • Operating System
    Ubuntu 22.04.5 LTS
    Computer type
    Laptop
    Manufacturer/Model
    Dell 13" Latitude 2017
    CPU
    i5 7200u
    Motherboard
    Dell
    Memory
    16GB DDR4
    Graphics card(s)
    Intel
    Sound Card
    Intel
    Monitor(s) Displays
    13" Dell Laptop
    Hard Drives
    250GB Crucial 2.5" SSD
    Mouse
    Generic WiFi 3 button
    Internet Speed
    WiFi only
    Browser
    Firefox
    Antivirus
    ClamAV TK
    Other Info
    Mainly Open Source Software
XxXxX said:
go back into your BIOS please.
re-enable secure boot then use the settings within the BIOS to set secure boot to its default settings.

or reset the BIOS to its factory defaults including the secure boot settings
save settings and exit .. restart the system.

now see if it boots into Windows
best of luck Steve ..
Click to expand...
Already tried that, I still get this when I turn on secure boot. 🤷‍♂️


1765510619319.webp
 

My Computer

System One

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8930
    CPU
    Intel I9-9900K
    Memory
    64GB
    Graphics Card(s)
    NVIDIA RTX 2060
    Sound Card
    NVIDIA High Definition Audio
    Monitor(s) Displays
    4k Samsung
    Screen Resolution
    3840 x 2160
    Hard Drives
    512GB NVMe, ADATA SU 800, 2TB HDD
No this won't work if your boot file has already been replaced with the CA 2023 version.

Resetting to the factory gets you CA 2011 in Secure Boot mode. But the scheduled task has already swapped out the boot file with CA 2023. Since CA 2023 doesn't exist in the factory default, then it's not allowed because there's no cert authenticating it.

So disable Secure Boot, and no checking is done. Now you can boot Windows normally and restart the update process or manually copy the CA 2011 boot file to the EFI partition (so Secure Boot can be enabled again).
 

My Computer

System One

  • OS
    Windows 7
garlin said:
No this won't work if your boot file has already been replaced with the CA 2023 version.

Resetting to the factory gets you CA 2011 in Secure Boot mode. But the scheduled task has already swapped out the boot file with CA 2023. Since CA 2023 doesn't exist in the factory default, then it's not allowed because there's no cert authenticating it.

So disable Secure Boot, and no checking is done. Now you can boot Windows normally and restart the update process or manually copy the CA 2011 boot file to the EFI partition (so Secure Boot can be enabled again).
Click to expand...
How do I copy the CA 2011 boot file to the EFI partition?
It now shows this.

1765511281770.webp
 

My Computer

System One

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8930
    CPU
    Intel I9-9900K
    Memory
    64GB
    Graphics Card(s)
    NVIDIA RTX 2060
    Sound Card
    NVIDIA High Definition Audio
    Monitor(s) Displays
    4k Samsung
    Screen Resolution
    3840 x 2160
    Hard Drives
    512GB NVMe, ADATA SU 800, 2TB HDD
start the system with secure boot disabled

go back into the registry and check
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot
make sure that AvailableUpdates is set to 0x00000000

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing
then manually change these reg keys to this
1765511388314.webp

then open task scheduler and disable/delete
"\Microsoft\Windows\PI\Secure-Boot-Update"

restart the system
if that fails then you are looking at re-installing Windows
best of luck Steve ..
 

My Computers

System One System Two

  • OS
    Windows 11 Home
    Computer type
    PC/Desktop
    Manufacturer/Model
    HP 24" AiO
    CPU
    Ryzen 7 5825u
    Motherboard
    HP
    Memory
    64GB DDR4 3200
    Graphics Card(s)
    Ryzen 7 5825u
    Sound Card
    RealTek
    Monitor(s) Displays
    24" HP AiO
    Screen Resolution
    1920 x 1080 @60 Hz
    Hard Drives
    1TB WD Blue SN580 M2 SSD Partitioned.
    2x 1TB USB HDD External Backup/Storage.
    PSU
    90W external power brick
    Case
    24" All in One
    Cooling
    Default Air Cooling
    Keyboard
    HP WiFi UK extended
    Mouse
    HP WiFi 3 Button
    Internet Speed
    1GB full fibre
    Browser
    Edge & Firefox
    Antivirus
    AVG Internet Security/Windows Defender
    Other Info
    Mainly Open Source Software
  • Operating System
    Ubuntu 22.04.5 LTS
    Computer type
    Laptop
    Manufacturer/Model
    Dell 13" Latitude 2017
    CPU
    i5 7200u
    Motherboard
    Dell
    Memory
    16GB DDR4
    Graphics card(s)
    Intel
    Sound Card
    Intel
    Monitor(s) Displays
    13" Dell Laptop
    Hard Drives
    250GB Crucial 2.5" SSD
    Mouse
    Generic WiFi 3 button
    Internet Speed
    WiFi only
    Browser
    Firefox
    Antivirus
    ClamAV TK
    Other Info
    Mainly Open Source Software
fg2001gf11F said:
How do I copy the CA 2011 boot file to the EFI partition?
Click to expand...
Code: 
mountvol S: /s
copy C:\Windows\Boot\EFI\bootmgfw.efi S:\EFI\Microsoft\Boot\bootmgfw.efi
mountvol S: /d

Run the script afterwards to confirm it's CA 2011 again. If it's good, you can start the whole AvailableUpdates process.
 

My Computer

System One

  • OS
    Windows 7
garlin said:
Code: 
mountvol S: /s
copy C:\Windows\Boot\EFI\bootmgfw.efi S:\EFI\Microsoft\Boot\bootmgfw.efi
mountvol S: /d

Run the script afterwards to confirm it's CA 2011 again. If it's good, you can start the whole AvailableUpdates process.
Click to expand...

See below.

1765512701632.webp
 

My Computer

System One

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8930
    CPU
    Intel I9-9900K
    Memory
    64GB
    Graphics Card(s)
    NVIDIA RTX 2060
    Sound Card
    NVIDIA High Definition Audio
    Monitor(s) Displays
    4k Samsung
    Screen Resolution
    3840 x 2160
    Hard Drives
    512GB NVMe, ADATA SU 800, 2TB HDD
XxXxX said:
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing
then manually change these reg keys to this
View attachment 156620
Click to expand...
Those keys are written to by the scheduled task when it runs. Changing them doesn't modify the task's behavior, only AvailableUpdates (and I think one of the opt-out keys to block it) instructs it what to do.
 

My Computer

System One

  • OS
    Windows 7

My Computer

System One

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8930
    CPU
    Intel I9-9900K
    Memory
    64GB
    Graphics Card(s)
    NVIDIA RTX 2060
    Sound Card
    NVIDIA High Definition Audio
    Monitor(s) Displays
    4k Samsung
    Screen Resolution
    3840 x 2160
    Hard Drives
    512GB NVMe, ADATA SU 800, 2TB HDD
Run the check script. It should confirm whether this boot file is allowed or not.
 

My Computer

System One

  • OS
    Windows 7
garlin said:
Run the check script. It should confirm whether this boot file is allowed or not.
Click to expand...
1765512886971.webp


Can I turn on secure boot again?
 

My Computer

System One

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8930
    CPU
    Intel I9-9900K
    Memory
    64GB
    Graphics Card(s)
    NVIDIA RTX 2060
    Sound Card
    NVIDIA High Definition Audio
    Monitor(s) Displays
    4k Samsung
    Screen Resolution
    3840 x 2160
    Hard Drives
    512GB NVMe, ADATA SU 800, 2TB HDD

My Computer

System One

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Dell XPS 8930
    CPU
    Intel I9-9900K
    Memory
    64GB
    Graphics Card(s)
    NVIDIA RTX 2060
    Sound Card
    NVIDIA High Definition Audio
    Monitor(s) Displays
    4k Samsung
    Screen Resolution
    3840 x 2160
    Hard Drives
    512GB NVMe, ADATA SU 800, 2TB HDD
You must log in or register to reply here.

Similar threads

Secure boot update via Windows update
Replies
3
Views
2K
hader
hader
Secure Boot Update Issue for 2014 Dell Laptop
Replies
7
Views
2K
SIW2
SIW2
Solved garlin's PowerShell scripts for updating Secure Boot CA 2023
105 106 107
Replies
2K
Views
172K
garlin
G
Solved Finding the UEFI's DBX SVN number using PowerShell
2 3 4
Replies
73
Views
10K
Ghot
Ghot
Solved Secure Boot update failed to update a Secure boot variable - possible after 24H2 update
Replies
8
Views
11K
FreeBooter
FreeBooter

Latest Support Threads

Latest Tutorials

Back
Top Bottom