Solved Secure boot update HowTo

jimbo45 · Nov 23, 2025

Buddywh said:
I wouldn't say "best"... but certainly the easiest.

I think there's a lot of security value even for home users with both Secure Boot and Bit Locker. I like knowing that should someone steal my computer it would take nation-state resources to go through my data to pull anything out of it like banking or credit card information.

Why would you leave credit card / banking stuff on a computer -- Banks etc hold this stuff off your machine -- even if someone saw you had say a Barclays Bank account by reading emails / purchases via say amazon etc - any attempt to use it usually requires all sorts of security measures from that bank to verify it's you - often by so many different layers of security it gets almost impossible to spend YOUR OWN money. !!!!

Scams are much more a problem. A.I and other software is still a long way of being better than "Human Brains".

Cheers
jimbo

Buddywh · Nov 23, 2025

jimbo45 said:
Why would you leave credit card / banking stuff on a computer -- Banks etc hold this stuff off your machine -- even if someone saw you had say a Barclays Bank account by reading emails / purchases via say amazon etc - any attempt to use it usually requires all sorts of security measures from that bank to verify it's you - often by so many different layers of security it gets almost impossible to spend YOUR OWN money. !!!!

Scams are much more a problem. A.I and other software is still a long way of being better than "Human Brains".

Cheers
jimbo

Stuff left behind in caches mainly, but also financial records of all sorts including tax records. What's the value of having a computer if I can't use it for the thing it does best: maintaining records in machine searchable archives. And if I DIDN'T keep them on my computer then I'd have to maintain them in a paper filing system... well that's so last century. Keeping track of something like that is WAY more difficult than updating secure boot keys has been, and keeping track of a Bitlocker key. And it's a far greater security risk for even a half-smart burglar to harvest data from. And then just how fragile it is in house fire or flooding: all I have to do is grab my external, BitLocker-to-Go protected drive and I have my life's business data with no loss while dragging a file cabinet out is pretty dumb when I'm dying of asphyxiation.

Banking security is pretty silly, when you think about it. I'm rather amazed how easy it is to withdraw funds at my bank... all I need is account number and an ID that shows them my name. It's easy to fool them with the pitiful driver license photos, and signatures are never validated.

jimbo45 · Nov 23, 2025

Buddywh said:
Stuff left behind in caches mainly, but also financial records of all sorts. What's the value of having a computer if I can't use it for the thing it does best: maintaining records in machine searchable archives. And if I DIDN'T keep them on my computer then I'd have to maintain them in a paper filing system... well that's so last century. Keeping track of something like that is WAY more difficult than updating secure boot keys has been, and keeping track of a Bitlocker key. And it's a far greater security risk for a half-smart burglar to harvest data from. And then just how fragile it is in house fire or flooding: all I have to do is grab my external, BitLocker-to-Go protected drive and I have my life's business data with no loss while dragging a file cabinet out is pretty dumb when I'm dying of asphyxiation.

Banking security is pretty silly, when you think about it. I'm rather amazed how easy it is to withdraw funds at my bank... all I need is account number and an ID that shows them my name. It's easy to fool them with the pitiful DL photos, and signatures are never validated.

Depends on where you are and what bank(s) you use.
Over in Isl and in the UK Banks - which might have the worst apalling customer service anywhere in the entire universe are usually pretty good with security (often too good) and will return any money unless it's quite obvious YOU have made transactions under no duress -- being scammed is NO excuse for a bank to refund money -- that type of fraud is 100% the customers own fault if they fall victim to this type of stuff.

Cheers
jimbo

Buddywh · Nov 23, 2025

jimbo45 said:
it's quite obvious YOU have made transactions under no duress

That one does make me laugh...

I can't imagine someone withdrawing a few hundred dollars to pay an impound lot to return your car that was towed because you were 5 minutes late to feed the meter is NOT under some level of duress. Highly specific example you might say... but it happened to me when we were on a vaca. in California. You could doubtless generalize to any number of different scenarios that might ring more familiar to your life experiences

jimbo45 · Nov 23, 2025

Buddywh said:
That makes me laugh

I can't imagine someone withdrawing a few hundred dollars to pay an impound lot to return your car that was towed because you were 5 minutes late to feed the meter is NOT under some level of duress. Highly specific example you might say... but you can generalize to any number of different scenarios that might ring more familiar to your life experiences

Paying even these sorts of jobsworths isn't a hack. It's 100% OK to verify if the towing company is legit - and if not then the Police or other authorities can be used - assuming you are in a reasonably democratic country.

It's hardly the authorities fault if you "overstay your welcome" at a parking lot -- I know there's a huge amount of these agressive jobsworths around and privately I'd love to have a 357 magnum and use it !!! but the law is the law and in most democratic jursidictions you have the power to elect people via the ballot box who can adjust these sorts of laws -- why not give people a 10 min grace period for example -- however this is drifting away from the point.

Cheers
jimbo

Buddywh · Nov 23, 2025

jimbo45 said:
Paying even these sorts of jobsworths isn't a hack. It's 100% OK to verify if the towing company is legit - and if not then the Police or other authorities can be used - assuming you are in a reasonably democratic country.

It's hardly the authorities fault if you "overstay your welcome" at a parking lot -- I know there's a huge amount of these agressive jobsworths around and privately I'd love to have a 357 magnum and use it !!! but the law is the law and in most democratic jursidictions you have the power to elect people via the ballot box who can adjust these sorts of laws -- why not give people a 10 min grace period for example -- however this is drifting away from the point.

Cheers
jimbo

It's not a question of "fault", 5 min's late is pretty pissy of them but I wouldn't have minded just the fine since I WAS late (it was probably a 60 min meter but think of it as a 55min meter with a 5 minute grace period the good citizens of that very democratic community had doubtless insisted on... i was there at 65 min's ). But there it was sitting there with out-of-state plates making me an easy mark. So they just play the easiest scam of all: one the law those good citizens also doubtless allowed. So I'm getting stuck with a tow fee, impound fee and repairs for whatever damage they do to it while thousands of miles from home (sure, I can file a claim for repairs but I have to get home first and that needs a safe vehicle).

Very much a duress-inducing situation, even though it drifts from the point.

jimbo45 · Nov 23, 2025

Buddywh said:
It's not a question of "fault", 5 min's late is pretty pissy of them but I wouldn't have minded just the fine since I WAS late (it was probably a 60 min meter but think of it as a 55min meter with a 5 minute grace period the good citizens of that very democratic community had doubtless insisted on... i was there at 65 min's ). But there it was sitting there with out-of-state plates making me an easy mark. So they just play the easiest scam of all: one the law those good citizens also doubtless allowed. So I'm getting stuck with a tow fee, impound fee and repairs for whatever damage they do to it while thousands of miles from home (sure, I can file a claim for repairs but I have to get home first and that needs a safe vehicle).

Very much a duress-inducing situation, even though it drifts from the point.

In the 1990's Police in Texas (where Car insurance at that time wasn't compulsory -- not sure now - it might still not be compulsory -- I like Texas but it's definitely unique in the USA !!!)) used to go to bars and put special UV paint over car license plates that were in the parking lots - especially from out of state one's -- and then would stop these cars detecting them via an infra red reader or similar and then they would award "DUI's" like confetti or if they had Texas plates they'd get payback from Insurance companies by issuing threats to drivers -- while suggesting or recommending "good Insurance companies" with severe penalties if they didn't take out car insurance.

Sounds in a similar vein to the late Robin Cook's great medical thrillers on malpractice in the US health system !!! Read / watch Coma as a starter !!

I know this sounds like Hollywood to anybody born around 2003 and later -- but this was definitely true !!!

However time to drop this political topic -- suffice to say I and many like me don't need / want / to use secure boot or bit locker and have never had problems with hacks etc. (Besides if you use an Ms account there's always the "Find my device" option if it goes missing).

Cheers
jimbo

Buddywh · Nov 23, 2025

jimbo45 said:
In the 1990's Police in Texas (where Car insurance at that time wasn't compulsory -- not sure now - it might still not be compulsory -- I like Texas but it's definitely unique in the USA !!!)) used to go to bars and put special UV paint over car license plates that were in the parking lots - especially from out of state one's -- and then would stop these cars detecting them via an infra red reader or similar and then they would award "DUI's" like confetti or if they had Texas plates they'd get payback from Insurance companies by issuing threats to drivers -- while suggesting or recommending "good Insurance companies" with severe penalties if they didn't take out car insurance.

Sounds in a similar vein to the late Robin Cook's great medical thrillers on malpractice in the US health system !!! Read / watch Coma as a starter !!

I know this sounds like Hollywood to anybody born around 2003 and later -- but this was definitely true !!!

However time to drop this political topic -- suffice to say I and many like me don't need / want / to use secure boot or bit locker and have never had problems with hacks etc. (Besides if you use an Ms account there's always the "Find my device" option if it goes missing).

Cheers
jimbo

Much better than going to Mexico back in the day... that's where you haggle out the "mordida" the cops expected. Woe unto you if you didn't have the cash to pay it.

That's probably better than today though... now-a-days the cartels take care of business entirely differently. Getting that way in a few of the more "democratic" cities of the US too, as the cartels are taking over city "life" there in many areas.

Car insurance was compulsory in Texas in the 90's (liability by the state, collision/comp by whoever's financing it so if not financed it was the owner if they found it important). It's just like now, but many people could just ignore liability before they started closing up the loopholes that made it easy to do so. I know these things because I lived there, right on the Mexico border.

If you want to rag on Texas do so for something real: like allowing open containers of alcohol in your vehicle. Yep, it was legal, and there were even drive-throughs where you could get your Harvy Wallbangers served up just like a Starbucks. Only in a "wet" county, of course, since there were (maybe still are!) "dry" counties where no liquor sales are allowed at all... if that's not strange I don't know what is.

loomajoo · Nov 24, 2025

Thierry 83200 said:
Hello, what does my screenshot mean? Am I on the right track, or do I need to make further changes? Thank you for your answers.View attachment 153989

The entries in your UEFU DBX look encouraging (although I dont really know what they're actally supposed to look like), but I would have expected all the green, ticked 2011 entries in the DBs and KEKs to be"(revoked: True)".

And I certainly dont understand why your Option ROM UEFI CA 2023 is "revoked: True"!

Did you use Check UEFI KEK, DB and DBX.ps1 created by github.com/cjee21? Maybe a chat with him might clarify?

Could you share your method for how you applied the revocations?

loomajoo · Nov 24, 2025

I see the script auther provides an example output of the script, very much like yours...

Including un-revoked 2011 certificates...

Confusing! What does this mean?

zapbuzz · Nov 24, 2025

After updating my RAID status on boot doesn't show I now have to disable secure boot to see it and get into its setup menu
ASUS H97M Plus

neves · Nov 24, 2025

loomajoo said:
The entries in your UEFU DBX look encouraging (although I dont really know what they're actally supposed to look like), but I would have expected all the green, ticked 2011 entries in the DBs and KEKs to be"(revoked: True)".

And I certainly dont understand why your Option ROM UEFI CA 2023 is "revoked: True"!

Did you use Check UEFI KEK, DB and DBX.ps1 created by github.com/cjee21? Maybe a chat with him might clarify?

Could you share your method for how you applied the revocations?

Revoked: False = Certificate is valid and trusted. Not on the DBX blacklist.

Revoked: True = Certificate is in the DBX blacklist and will be blocked for security reasons.

Microsoft Option ROM UEFI CA 2023 should normally be Revoked: False. Tho, even If his system shows Revoked: True - it's still not wrong.... That simply means his firmware OEM (Asus, Dell, etc) - chose to block it for extra security. There are two different kinds of UEFI certificates:

1 > Bootloader certificates (DB / KEK) - intended for Windows Boot Manager, Linux shim (contains and launches the Linux boot manager), OEM bootloaders (usually, these shouldn't be revoked unless compromised).

2 > Option ROM certificates - intended for GPU UEFI drivers, RAID and/or Storage controller firmware and NIC drivers (these run before the OS bootloader - and can pose a high-risk).

Anyway... Option ROM UEFI CA 2023 - is actually a certificate Microsoft provides to hardware vendors (Intel, AMD, NVIDIA, Broadcom, etc.) - to sign their embedded Option ROM UEFI driver code. It's not required for Windows to boot. It is only needed for some PCIe expansion cards to load their own UEFI drivers.

Dirtyflash · Nov 24, 2025

A lot of emphasis is being placed on the Windows UEFI CA 2023 certificate. Is that the only one really required to run the Windows OS? So, if it's installed, where do the other certificates come into play?

Marcus Vinicus · Nov 24, 2025

Dirtyflash said:
A lot of emphasis is being placed on the Windows UEFI CA 2023 certificate. Is that the only one really required to run the Windows OS? So, if it's installed, where do the other certificates come into play?

KEK: Key Enrollment Key
CA: Certificate Authority
DB: Secure Boot Signature Database
DBX: Secure Boot Revoked Signature Database

From this MS webpage.

Windows Secure Boot certificate expiration and CA updates - Microsoft Support

support.microsoft.com

Dirtyflash · Nov 24, 2025

I found this on a MS FAQ, though it made for interesting reading:

Frequently asked questions about the Secure Boot update process - Microsoft Support

support.microsoft.com

ChrisVie · Nov 24, 2025

Here are my results, some of which are quite alarming, such as “Do not ship, OEM1 Test DB” and “59/60 failures.” I'm wondering what I should do with this now. The computer is a brand new device that was delivered to me a week ago.

XxXxX · Nov 24, 2025

@ChrisVie
you have the secure boot cert available but not enabled.
please read post #1 > part B

using > part B in post #1 < should enable the 2023 secure boot cert.
best of luck Steve ..

Anibor_11 · Nov 24, 2025

About the "DO NOT TRUST" thing, there is an explanation here:

Secure Boot is completely broken on 200+ models from 5 big device makers

This link comes from Mosby - More Secure Secure Boot

Buddywh · Nov 24, 2025

Anibor_11 said:
About the "DO NOT TRUST" thing, there is an explanation here:

Secure Boot is completely broken on 200+ models from 5 big device makers

This link comes from Mosby - More Secure Secure Boot

That's due to those machines' PK being compromised. That potential problem doesn't get mitigated by revoking trust in the Windows CA 2011 key.

MOSBY generates a unique-in-all-the-world PK for your machine and then signs KEK (both 2011 and 2023) with it before installing in it's secure boot variables. THAT is what mitigates that problem.

fg2001gf11F · Nov 24, 2025

What does this mean?
Boot Manager [ ] is BANNED.

Solved Secure boot update HowTo

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Semper paratus

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer