Solved Secure boot update HowTo


garlin said:
When you use File Explorer's context menu to run a PS script, it runs the script inside a PS window. But when the script is done, the default behavior is to close the window. This is fine if all the script does is to perform a task without you needing to see it.

But this script outputs something, then it doesn't help you.

So you can just open Terminal or PowerShell, and run the script so you can see the final output.
Click to expand...
Thanks, got my answer: " 'No vendor-provided KEK is currently available.' ".
 

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
garlin said:
That's what I thought. Dell hasn't yet (or never will) post a signed KEK for this generation of BIOS.

As @itsme1 noted, you can use Mosby or manually add the KEK CA 2023.der (certificate file) from the UEFI setup menu. Now I don't have this Dell (since there's so many generations of Dell's out there) to know how difficult it is to navigate the UEFI menus.
Click to expand...
Yesterday when I tried to navigate through the BIOS without even changing anything I ended up with the Boot problem that you helped fixing.
I really don't want to mess with the BIOS anymore.
I have no idea how Mosby works. Could you please clarify? Thanks.

1765561101117.webp
 

My Computer My Computer

At a glance

Windows 11 Pro 25H2Intel I9-9900K64GBNVIDIA RTX 2060
OS
Windows 11 Pro 25H2
Computer type
PC/Desktop
Manufacturer/Model
Dell XPS 8930
CPU
Intel I9-9900K
Memory
64GB
Graphics Card(s)
NVIDIA RTX 2060
Sound Card
NVIDIA High Definition Audio
Monitor(s) Displays
4k Samsung
Screen Resolution
3840 x 2160
Hard Drives
512GB NVMe, ADATA SU 800, 2TB HDD
1. Disable Secure Boot.
2. Re-run the mountvol S: and copy command like you did yesterday.

Mosby works by booting its own platform (without needing Windows) and overwrites the UEFI with its own data.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
1. Disable Secure Boot.
2. Re-run the mountvol S: and copy command like you did yesterday.

Mosby works by booting its own platform (without needing Windows) and overwrites the UEFI with its own data.
Click to expand...
Where do I get this Mosby and how do I use it?
 

My Computer My Computer

At a glance

Windows 11 Pro 25H2Intel I9-9900K64GBNVIDIA RTX 2060
OS
Windows 11 Pro 25H2
Computer type
PC/Desktop
Manufacturer/Model
Dell XPS 8930
CPU
Intel I9-9900K
Memory
64GB
Graphics Card(s)
NVIDIA RTX 2060
Sound Card
NVIDIA High Definition Audio
Monitor(s) Displays
4k Samsung
Screen Resolution
3840 x 2160
Hard Drives
512GB NVMe, ADATA SU 800, 2TB HDD
You can search for Mosby on the other 3-4 Secure Boot threads on ElevenForum.

I think the problem is my script never expected the update process to fail to add KEK CA 2023, while simultaneously allowing the CA 2023 certs to be added to DB. Which means while the new DB certs are added, but they're not enforceable without the KEK 2023. MS has the 0x4000 flag added to AvailableUpdates just for this contingency.

I'll have to add another sanity check and report the newer boot file is disallowed if you don't have KEK 2023 enrolled.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
fg2001gf11F said:
Where do I get this Mosby and how do I use it?
Click to expand...
Don't take any offense, but quit while you’re ahead, I've been down the Mosby path and it was disastrous as my BIOS just doesn't want to play nice, much like yours. I just finished getting my Lenovo unsupported device running again this morning, thinking I might somehow use @garlin 's method last night without success.
 
Last edited:

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
Hello.

I am one of the users who cannot install the KEK cert on a Dell (XPS 13 9360), for which Dell has confirmed that it will not release any BIOS update.
However, I ran @garlin's script and got this result.
Perhaps there is still some hope for me.
I have avoided venturing into the BIOS of my Dell, which several users say is tricky.
I think I'll wait for Microsoft.
PS-Sorry, this post refers to post #252 by @garlin.
;-)!Untitled-1.webp
 

My Computer My Computer

At a glance

Windows 11 Pro 25H2Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz8 GB
OS
Windows 11 Pro 25H2
Computer type
Laptop
Manufacturer/Model
Dell XPS 13 9360
CPU
Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz
Memory
8 GB
cool59 said:
Hello.

I am one of the users who cannot install yhe KEK cert on a Dell (XPS 13 9360), for which Dell has confirmed that it will not release any BIOS update.
However, I ran @garlin's script and got this result.
Perhaps there is still some hope for me.
I have avoided venturing into the BIOS of my Dell, which several users say is tricky.
I think I'll wait for Microsoft.
;-)!View attachment 156671
Click to expand...
MS can update your PC for you, since Dell has cooperated and submitted a signed KEK for this family of PC's (all running the same BIOS version).

You're one of the lucky ones.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
I get the same response as @cool59 with the lenovo.ps1 script.:crossed
 

My Computer My Computer

At a glance

windows 11
OS
windows 11
in the right window you will see ..
UEFICA2023Status which will show 'updating'
WindowsUEFICA2023Capable 0x00000001
Click to expand...

says not started

ca2023-not-started.webp
 
Last edited:

My Computers My Computers

System One System Two

  • At a glance

    Win7,Win11i7-97002x16gb 3600mhz
    OS
    Win7,Win11
    Computer type
    PC/Desktop
    CPU
    i7-9700
    Motherboard
    gigabyte b365m ds3h
    Memory
    2x16gb 3600mhz
    Monitor(s) Displays
    benq gw2480
    PSU
    bequiet pure power 11 400CM
    Cooling
    cryorig m9i

  • At a glance

    win7,win11i5-84002x8gb 3200
    Operating System
    win7,win11
    Computer type
    PC/Desktop
    CPU
    i5-8400
    Motherboard
    gigabyte b365m ds3h
    Memory
    2x8gb 3200
    PSU
    xfx pro 450
So I ran part B in the first post. Then it said updating which later changed to in progress

ca2023-in-progress.webp
 

My Computers My Computers

System One System Two

  • At a glance

    Win7,Win11i7-97002x16gb 3600mhz
    OS
    Win7,Win11
    Computer type
    PC/Desktop
    CPU
    i7-9700
    Motherboard
    gigabyte b365m ds3h
    Memory
    2x16gb 3600mhz
    Monitor(s) Displays
    benq gw2480
    PSU
    bequiet pure power 11 400CM
    Cooling
    cryorig m9i

  • At a glance

    win7,win11i5-84002x8gb 3200
    Operating System
    win7,win11
    Computer type
    PC/Desktop
    CPU
    i5-8400
    Motherboard
    gigabyte b365m ds3h
    Memory
    2x8gb 3200
    PSU
    xfx pro 450
garlin said:
You can search for Mosby on the other 3-4 Secure Boot threads on ElevenForum.

I think the problem is my script never expected the update process to fail to add KEK CA 2023, while simultaneously allowing the CA 2023 certs to be added to DB. Which means while the new DB certs are added, but they're not enforceable without the KEK 2023. MS has the 0x4000 flag added to AvailableUpdates just for this contingency.

I'll have to add another sanity check and report the newer boot file is disallowed if you don't have KEK 2023 enrolled.
Click to expand...
I see 0x4000 in SecureBoot AvailableUpdates on this machine that also shows Updated in the Servicing registry.
I believe this one is done and ready, correct?

1765568227800.webp

1765568282322.webp

1765568470355.webp
 

My Computer My Computer

At a glance

Windows 11 Pro 25H2Intel I9-9900K64GBNVIDIA RTX 2060
OS
Windows 11 Pro 25H2
Computer type
PC/Desktop
Manufacturer/Model
Dell XPS 8930
CPU
Intel I9-9900K
Memory
64GB
Graphics Card(s)
NVIDIA RTX 2060
Sound Card
NVIDIA High Definition Audio
Monitor(s) Displays
4k Samsung
Screen Resolution
3840 x 2160
Hard Drives
512GB NVMe, ADATA SU 800, 2TB HDD
garlin said:
That's what I thought. Dell hasn't yet (or never will) post a signed KEK for this generation of BIOS.

As @itsme1 noted, you can use Mosby or manually add the KEK CA 2023.der (certificate file) from the UEFI setup menu. Now I don't have this Dell (since there's so many generations of Dell's out there) to know how difficult it is to navigate the UEFI menus.
Click to expand...

Where is the KEK CA 2023.der file ?
 

My Computers My Computers

System One System Two

  • At a glance

    Win7,Win11i7-97002x16gb 3600mhz
    OS
    Win7,Win11
    Computer type
    PC/Desktop
    CPU
    i7-9700
    Motherboard
    gigabyte b365m ds3h
    Memory
    2x16gb 3600mhz
    Monitor(s) Displays
    benq gw2480
    PSU
    bequiet pure power 11 400CM
    Cooling
    cryorig m9i

  • At a glance

    win7,win11i5-84002x8gb 3200
    Operating System
    win7,win11
    Computer type
    PC/Desktop
    CPU
    i5-8400
    Motherboard
    gigabyte b365m ds3h
    Memory
    2x8gb 3200
    PSU
    xfx pro 450
Gigabyte b365m ds3h

I left it few minutes, restarted and now

ca2023-updated.webp

WEll done post #1 :-)
 

My Computers My Computers

System One System Two

  • At a glance

    Win7,Win11i7-97002x16gb 3600mhz
    OS
    Win7,Win11
    Computer type
    PC/Desktop
    CPU
    i7-9700
    Motherboard
    gigabyte b365m ds3h
    Memory
    2x16gb 3600mhz
    Monitor(s) Displays
    benq gw2480
    PSU
    bequiet pure power 11 400CM
    Cooling
    cryorig m9i

  • At a glance

    win7,win11i5-84002x8gb 3200
    Operating System
    win7,win11
    Computer type
    PC/Desktop
    CPU
    i5-8400
    Motherboard
    gigabyte b365m ds3h
    Memory
    2x8gb 3200
    PSU
    xfx pro 450
I dont know how you get to see what is in there


bios-screen1.webp

bios-screen2.webp
 

My Computers My Computers

System One System Two

  • At a glance

    Win7,Win11i7-97002x16gb 3600mhz
    OS
    Win7,Win11
    Computer type
    PC/Desktop
    CPU
    i7-9700
    Motherboard
    gigabyte b365m ds3h
    Memory
    2x16gb 3600mhz
    Monitor(s) Displays
    benq gw2480
    PSU
    bequiet pure power 11 400CM
    Cooling
    cryorig m9i

  • At a glance

    win7,win11i5-84002x8gb 3200
    Operating System
    win7,win11
    Computer type
    PC/Desktop
    CPU
    i5-8400
    Motherboard
    gigabyte b365m ds3h
    Memory
    2x8gb 3200
    PSU
    xfx pro 450
SIW2 said:
I dont know how you get to see what is in there


View attachment 156741

View attachment 156742
Click to expand...
It looks like you have a Gigabyte BIOS? if like mine...

Down arrow to (or click on) each of the variables... the first is the PK, the second the KEK, third DB, fourth DBX. There will be a window with a list, click on DETAILS in the list and it shows you all the keys in that variable.

In that list there's also one for appending the .DER.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 ProRyzen 7 5800XGSkill 3200, 2x8GBMSI RX 6800 XT Gaming Z
    OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 5800X
    Motherboard
    Gigabyte B550M Aorus Pro
    Memory
    GSkill 3200, 2x8GB
    Graphics Card(s)
    MSI RX 6800 XT Gaming Z
    Sound Card
    on-board Realtek
    Monitor(s) Displays
    MSI 180hz
    Screen Resolution
    1440p
    Hard Drives
    Samsung 980 Pro, Samsung 870 Evo, generic PCIe NVME, WD 1TB 2.5" laptop spinner
    PSU
    Corsair RM 650
    Case
    mATX
    Cooling
    BeQuiet 240mm AIO and a bunch of case fans
    Keyboard
    one that clacks softly
    Mouse
    logitech
    Internet Speed
    bunches of bps
    Browser
    Firefox
    Antivirus
    Windows' own

  • At a glance

    Win11 ProRyzen 7 170016GB DDR4RX-480
    Operating System
    Win11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY
    CPU
    Ryzen 7 1700
    Motherboard
    GA-AB350M G-3
    Memory
    16GB DDR4
    Graphics card(s)
    RX-480
    Sound Card
    In-Built Realtek
    Monitor(s) Displays
    Samsung
    Screen Resolution
    1440p
    Hard Drives
    NVME/SSD's
    PSU
    Thermaltake BX1 550W
    Case
    Some junky thing
    Cooling
    ThermalTake Assassin(?)
    Browser
    FF/Edge
    Antivirus
    Whatever Windows does
    Other Info
    Secure Boot enabled updated to 2023 CA keys, TPM2.0 enabled with system drive Bitlocker'd.
I have switched back to csm now.

In this bios just changing csm to enabled in bios tab main screen makes the secure boot label disappear. But in spite of Save and exit, it doesnt stick.

Need to go into secure boot menu , disable it. Then back to main bios screen csm enable. Save and exit
 

My Computers My Computers

System One System Two

  • At a glance

    Win7,Win11i7-97002x16gb 3600mhz
    OS
    Win7,Win11
    Computer type
    PC/Desktop
    CPU
    i7-9700
    Motherboard
    gigabyte b365m ds3h
    Memory
    2x16gb 3600mhz
    Monitor(s) Displays
    benq gw2480
    PSU
    bequiet pure power 11 400CM
    Cooling
    cryorig m9i

  • At a glance

    win7,win11i5-84002x8gb 3200
    Operating System
    win7,win11
    Computer type
    PC/Desktop
    CPU
    i5-8400
    Motherboard
    gigabyte b365m ds3h
    Memory
    2x8gb 3200
    PSU
    xfx pro 450
When I run latest cjee21 Check UEFI PK, KEK, DB and DBX.cmd it shows my bootmgr svn as red 3.0
but when I run Check Windows state.cmd from same zip it tells my bootmgr svn is 7.0 (which current one i think)
 

My Computer My Computer

At a glance

Windows 11 Pro 64bit (release preview channel)i5 840016 GB DDR4RTX 3060 Ti
OS
Windows 11 Pro 64bit (release preview channel)
Computer type
PC/Desktop
Manufacturer/Model
Asus
CPU
i5 8400
Motherboard
ROG STRIX Z370-H GAMING
Memory
16 GB DDR4
Graphics Card(s)
RTX 3060 Ti
Sound Card
On Board
Monitor(s) Displays
Acer VG242Y P
Screen Resolution
1080p
Hard Drives
Intel 660p SSD
PSU
800w
Internet Speed
1000 Mbps
You must log in or register to reply here.

Similar threads

Secure boot update via Windows update
Replies
3
Views
2K
hader
hader
Secure Boot Update Issue for 2014 Dell Laptop
Replies
7
Views
2K
SIW2
SIW2
Solved Successful manual update of Secure Boot on Dell XPS8930 with older BIOS that will never update.
2
Replies
23
Views
3K
trabel
T
Solved garlin's PowerShell scripts for updating Secure Boot CA 2023
139 140 141
Replies
3K
Views
238K
t2s50
T
Solved Finding the UEFI's DBX SVN number using PowerShell
2 3 4
Replies
73
Views
11K
Ghot
Ghot

Latest Support Threads

Latest Tutorials

Back
Top Bottom