Solved Secure boot update HowTo

john1955 · Jan 2, 2026

Dirtyflash said:
I have the impression you were trying to determine the status of the Windows UEFI CA 2023, whether it was, or wasn't installed. Don't know if you had done any other PowerShell commands, or changes prior, so it's hard to say how you got to into Setup mode. Somehow things went off the rails for you. The quick fix, which I'm not suggesting you do, is to Restore Factory Keys, that usually causes my system to exit Setup and switch to User mode. If you choose to do that, once you're done, save the change, reboot your device and it should be good to go. If it for whatever reason it doesn't boot, go back into BIOS and turn off Secure Boot. It will mean you'll have to do a quick fix of the bootloader and then you'll be able to turn Secure Boot back on.

That's the way it was when I looked at the BIOS. Nothing really went off the rails. I exited without saving any changes.
Gigabyte has the exact steps I need to do which is to restore the factory keys. I have to switch from "Standard" mode to "Custom" mode reset the keys and then put it back to Standard mode. I'm pretty sure the have the drive as GPT partition style. It does not show that but it does not say MBR either, it just shows Healthy EFI System
So I used Diskpart and it shows this (assuming the asterisks means affirmative)

Apparently I just never finished setting this up two years ago when I built the system

Dirtyflash · Jan 2, 2026

john1955 said:
That's the way it was when I looked at the BIOS. Nothing really went off the rails. I exited without saving any changes.
Gigabyte has the exact steps I need to do which is to restore the factory keys. I have to switch from "Standard" mode to "Custom" mode reset the keys and then put it back to Standard mode. I'm pretty sure the have the drive as GPT partition style. It does not show that but it does not say MBR either, it just shows Healthy EFI System
So I used Diskpart and it shows this (assuming the asterisks means affirmative)

View attachment 158686

Yeah, I recall that's how you verify it's partitioned for GPT.

Brian48 · Jan 2, 2026

After installing the latest BIOS update dated Dec 18, 2025 for my HP Laptop this is my system now.

So I think I'm fully up to date

TrebleTA · Jan 4, 2026

Another noob question, In secure boot I have two options, User or Custom. When I setup the bios I set as user and it loads fail safe defaults.
Question is where i've updated secure boot via windowes, should I really of had the setting as custom in bios?.
I'm on a Gigabyte Z390 motherboard.

XxXxX · Jan 4, 2026

TrebleTA said:
Another noob question, In secure boot I have two options, User or Custom. When I setup the bios I set as user and it loads fail safe defaults.
Question is where i've updated secure boot via windowes, should I really of had the setting as custom in bios?.
I'm on a Gigabyte Z390 motherboard.

when you have secure boot in the 'user' setting please check this registry key
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

if it shows these settings in the right Window you are all good ..
UEFICA2023Status which will now show 'Updated'
WindowsUEFICA2023Capable 0x00000002

best of luck Steve ..

john1955 · Jan 4, 2026

TrebleTA said:
Another noob question, In secure boot I have two options, User or Custom. When I setup the bios I set as user and it loads fail safe defaults.
Question is where i've updated secure boot via windowes, should I really of had the setting as custom in bios?.
I'm on a Gigabyte Z390 motherboard.

Gigabyte has step by step instructions on their web page for my Z690
You only use Custom to make changes then you switch back after.
I found this doing an AI Mode Google question on how to do it

My GA-Z77 had a 100 page User Manual. My Z690 manual is only 35 pages and nothing on this part of the BIOS

TrebleTA · Jan 4, 2026

hmm when I swap from custom to user it now reset to factory defaults apon swaping.

Rollback_Jockey · Jan 4, 2026

TrebleTA said:
hmm when I swap from custom to user it now reset to factory defaults apon swaping.

Did you try importing the new keys in the secure boot setup.?

TrebleTA · Jan 4, 2026

XxXxX said:
when you have secure boot in the 'user' setting please check this registry key
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

if it shows these settings in the right Window you are all good ..
UEFICA2023Status which will now show 'Updated'
WindowsUEFICA2023Capable 0x00000002

best of luck Steve ..

as Steve says I get the result above in regedit.

Rollback_Jockey said:
Did you try importing the new keys in the secure boot setup.?

No I have not tried importing new keys, should I?

SIW2 · Jan 4, 2026

TrebleTA said:
hmm when I swap from custom to user it now reset to factory defaults apon swaping.

gigabyte

TrebleTA · Jan 4, 2026

Mine is different from the above.

TrebleTA · Jan 5, 2026

So I have changed my secure boot setting's, so now it more like how you have in the above picture as custom.

TrebleTA · Jan 6, 2026

SIW2 said:
gigabyte

View attachment 158977

something I did notice in yours to mine is for Vendor keys I have Modified.
I did try to post a screen shot but BMP is not allowed as a image
P.s I did a windows clean install, and the windows reg is still reporting as expected, updated etc.
also when i run the Check_EFIBootFile.ps1 all looks fine but UEFI DBX Certs has nothing.

TrebleTA · Jan 6, 2026

and on the other testing app

Ghot · Jan 6, 2026

TrebleTA said:
and on the other testing app

How to do the SVN Update...

Open Terminal (Admin), and run the following two commands, one at a time.

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Might have to reboot afterwards. I reboot every time I do any registry patches.

TrebleTA · Jan 6, 2026

Would I be better to reset to factory defaults and start the process from the start?

P.s I'm guessing, it may of messed up when I played with secure boot settings yesterday.

Ghot · Jan 6, 2026

TrebleTA said:
Would I be better to reset to factory defaults and start the process from the start?

Reset what to factory defaults? The BIOS?
I don't understand the question.

The only thing those two commands do is to update the SVN... (Secure Version Number)

So it looks like this...

After you update the SVN, just run the same check you did in post #434

TrebleTA · Jan 6, 2026

Ghot said:
Reset what to factory defaults? The BIOS?
I don't understand the question.

The only thing those two commands do is to update the SVN... (Secure Version Number)

View attachment 159148

So it looks like this...

View attachment 159149

So yesterday I played with the bios secure boot settings changing from user to custom after the other user posted there info, doing so some setting in bios for secure boot changed, and I also noticed that I have vendor keys modified, this was before I did a clean install of windows 11 and did not think that secure boot setting may of changed
.
Once windows was installed I did the reg check

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

if it shows these settings in the right Window you are all good ..
UEFICA2023Status which will now show 'Updated'
WindowsUEFICA2023Capable 0x00000002

and all come back ok, until I did the system checks, Check_EFIBootFile.ps1, etc.

Thanks for all the advice

Ghot · Jan 6, 2026

TrebleTA said:
So yesterday I played with the bios secure boot settings changing from user to custom after the other user posted there info, doing so some setting in bios for secure boot changed, and I also noticed that I have vendor keys modified, this was before I did a clean install of windows 11 and did not think that secure boot setting may of changed
.
Once windows was installed I did the reg check

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

if it shows these settings in the right Window you are all good ..
UEFICA2023Status which will now show 'Updated'
WindowsUEFICA2023Capable 0x00000002

and all come back ok, until I did the system checks, Check_EFIBootFile.ps1, etc.

Thanks for all the advice

In post #434 you ran cjee21's check and it came up all green checkmarks (which is good), except for the SVN items at the bottom.

In post #435 I showed you what to do to get the SNV items updated.

In post #437, I showed you two pics.
The top one is the bottom of YOUR check, and the bottom pic is the bottom of MY check.

TrebleTA · Jan 6, 2026

Ghot said:
In post #434 you ran cjee21's check and it came up all green checkmarks (which is good), except for the SVN items at the bottom.

In post #435 I showed you what to do to get the SNV items updated.

See so all looked ok, but would I need to do this after every windows 11 clean install?

also what about the two Microsoft ones

Or is that fine.

Solved Secure boot update HowTo

Jack of all trades

My Computers

Well-known member

My Computer

Active member

My Computer

Well-known member

My Computer

Just a Computer User

My Computers

Jack of all trades

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

How to do the SVN Update...​

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Similar threads

How to do the SVN Update...