Solved Secure boot update HowTo

fg2001gf11F · Nov 17, 2025

XxXxX said:
@fg2001gf11F
restart the system in to safe mode with network enabled.

then try the update part A in safe mode.
then after restarting TWICE
in an elevated PowerShell

if the result comes back 'True'
then continue with part B.

best of luck Steve ..

I already had the True result. But part B never gets the Updated status even waiting 5 minutes before rebooting.

XxXxX · Nov 17, 2025

fg2001gf11F said:
I already had the True result. But part B never gets the Updated status even waiting 5 minutes before rebooting.

then restart the system in safe mode with the network enabled
and complete part B.
after restarting the system check the registry to see if part B has updated the system.

each of these parts can be done in safe mode but they must be done separately in safe mode.
then the only way to check to see if the system has updated is after restarting the system in normal mode.

it would also be an idea to see if there are any BIOS updates if this doesn't work.
best of luck Steve ..

Fabler2 · Nov 17, 2025

Used this to check certs,

Checking for Updated Secure Boot Certificates

A couple of months back Microsoft published a blog about Secure Boot certificates expiring in June 2026 and of the potential need to take action. It would appear that as long as Secure Boot is enab…

smsagent.blog

fg2001gf11F · Nov 17, 2025

XxXxX said:
then restart the system in safe mode with the network enabled
and complete part B.
after restarting the system check the registry to see if part B has updated the system.

each of these parts can be done in safe mode but they must be done separately in safe mode.
then the only way to check to see if the system has updated is after restarting the system in normal mode.

it would also be an idea to see if there are any BIOS updates if this doesn't work.
best of luck Steve ..

The BIOS is the latest available for that Dell XPS 8930.
Also, in safe mode the Part B # 2 command cannot run from PS

XxXxX · Nov 17, 2025

fg2001gf11F said:
The BIOS is the latest available for that Dell XPS 8930.
Also, in safe mode the Part B # 2 command cannot run from PS

this is now of the top of my head but its worth a try.
restart into safe mode with networking enabled

use an elevated CMD prompt for the first command in the CMD prompt.

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

then restart the system into normal mode
and then do the second PowerShell command in normal mode in an elevated PowerShell

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

then restart the system and then check if the update has taken place.
after this i am out of ideas and you may have to wait for the update via Microsoft.

edit. i am not sure if both commands would work in an elevated CMD prompt
you could try both 1 and 2 commands while in safe mode in the CMD prompt
best of luck Steve ..

fg2001gf11F · Nov 17, 2025

XxXxX said:
this is now of the top of my head but its worth a try.
restart into safe mode with networking enabled

use an elevated CMD prompt for the first command in the CMD prompt.

then restart the system into normal mode
and then do the second PowerShell command in normal mode in an elevated PowerShell

then restart the system and then check if the update has taken place.
after this i am out of ideas and you may have to wait for the update via Microsoft.

best of luck Steve ..

Already tried that, shows still InProgress.

XxXxX · Nov 17, 2025

@fg2001gf11F
did you try both commands at an elevated CMD prompt in safe mode
unsure if the 2nd command would work in the CMD prompt.

bit of a mess around, sorry about that.
best of luck Steve ..

PerpetualCycle · Nov 17, 2025

HeavyHemi said:
I think I am okay after running the scripts. EVGA X99 board from 2016.
View attachment 153246

Tho your KEK Cert needs updated

neves · Nov 17, 2025

hsehestedt said:
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

-match can be case insensitive, -like works better:

Code:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -like '*Windows UEFI CA 2023*'

Dirtyflash · Nov 17, 2025

fg2001gf11F said:
Already tried that, shows still InProgress.

Same, I ran the script in post #42 and it at least solved the mystery of " In Progress " I have 2 of the 4 certificates installed, the two missing are the KEK and Microsoft UEFI CA 2023. The most import one is installed: Windows UEFI CA 2023 and to a lesser degree: Option ROM UEFI. It seems that the Microsoft UEFI CA 2023 is not completely installed, don't know why, but it seems to be a work in progress, no pun intended. In my case, I won't get the KEK anytime soon as the device is unsupported (no BIOS update) and I'll have to wait for MS to push it out at a later date ( hopefully).

Buddywh · Nov 17, 2025

Dirtyflash said:
Same, I ran the script in post #42 and it at least solved the mystery of " In Progress " I have 2 of the 4 certificates installed, the two missing are the KEK and Microsoft UEFI CA 2023. The most import one is installed: Windows UEFI CA 2023 and to a lesser degree: Option ROM UEFI. It seems that the Microsoft UEFI CA 2023 is not completely installed, don't know why, but it seems to be a work in progress, no pun intended. In my case, I won't get the KEK anytime soon as the device is unsupported (no BIOS update) and I'll have to wait for MS to push it out at a later date ( hopefully).

What is your motherboard or system manufacturer (you get some points for filling out your Computer configuration!)

A KEK needs to be signed by your machine's PK, which the manufacturer does. If the manufacturer never returns a signed KEK for your system you may not get a KEK. There are other ways to get one though.

The Microsoft UEFI CA is used for third parties... I think something like Linux running in a VM. The OpROM CA is needed for expansion device firmware that runs in pre-boot, something like a PXE Lan card or RAID drive controller. These are all pretty special-case scenarios that may not apply to everybody. But the KEK is pretty important since it helps establish the root of trust Microsoft will need for future security updates.

XxXxX · Nov 17, 2025

@fg2001gf11F
someone updated their 2023 cert by allow all in the firewall
maybe disable the firewall and try updating the 2023 cert.

just a thought
best of luck Steve ..

Anibor_11 · Nov 17, 2025

Buddywh said:
The Microsoft UEFI CA is used for third parties... I think something like Linux running in a VM.

Or simply a Linux-based UFD to run an image or partition manager, like Terabyte IFL.

fg2001gf11F · Nov 17, 2025

XxXxX said:
@fg2001gf11F
someone updated their 2023 cert by allow all in the firewall
maybe disable the firewall and try updating the 2023 cert.

just a thought
best of luck Steve ..

I get this with the script mentioned earlier in this thread.

Buddywh said:
What is your motherboard or system manufacturer (you get some points for filling out your Computer configuration!)

A KEK needs to be signed by your machine's PK, which the manufacturer does. If the manufacturer never returns a signed KEK for your system you may not get a KEK. There are other ways to get one though.

The Microsoft UEFI CA is used for third parties... I think something like Linux running in a VM. The OpROM CA is needed for expansion device firmware that runs in pre-boot, something like a PXE Lan card or RAID drive controller. These are all pretty special-case scenarios that may not apply to everybody. But the KEK is pretty important since it helps establish the root of trust Microsoft will need for future security updates.

This is a Dell XPS 8930 with latest Bios 1.1.31 running Windows 11 Pro

Ghot · Nov 17, 2025

@hsehestedt

Could you make a batch file that gives results like the "script" in post #32
I really hate scripts.

fg2001gf11F · Nov 17, 2025

On Dell XPS 8940 I got this result showing KEKCertUpdated.

Why is it not getting KEKCertUpdated on the Dell XPS 8930?

Buddywh · Nov 17, 2025

fg2001gf11F said:
On Dell XPS 8940 I got this result showing KEKCertUpdated.

View attachment 153308

Why is it not getting KEKCertUpdated on the Dell XPS 8930?

It's possible that Dell just isn't playing nice for that model by providing Microsoft a KEK signed with it's PK. At any rate, that may be a question for a Dell support forum.

I know Dell BIOS's are anything but complete with controls for users to manage their systems, but look for Secure Boot key management controls. If there isn't a signed KEK to be got from Microsoft you could append an unsigned public KEK (download it from Microsoft's GitHub). But the BIOS has to provide controls to do that.

DJNelson · Nov 17, 2025

Just a shot in the dark , but I eliminated the last of the recurring logged errors related to secure boot on my Dell Precision by changing the Secure Boot Mode from "deployed" to "audit", running the update, then changing it back to "deployed". Might work on your XPS @fg2001gf11F.

fg2001gf11F · Nov 17, 2025

DJNelson said:
Just a shot in the dark , but I eliminated the last of the recurring logged errors related to secure boot on my Dell Precision by changing the Secure Boot Mode from "deployed" to "audit", running the update, then changing it back to "deployed". Might work on your XPS @fg2001gf11F.

Where did you see the logged errors, and where did you change from "deployed" to "audit" and back?
Please clarify. Thanks.

HeavyHemi · Nov 17, 2025

PerpetualCycle said:
Tho your KEK Cert needs updated

I'll just have to hope that all works out. If I try to use the 0x5944 key in the registry, it will hard lock my system about 30 seconds after a reboot. I have to quickly enter regedit and zero out the key and reboot.

Solved Secure boot update HowTo

Well-known member

My Computer My Computer

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Syzygy

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computers

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer

My Computer

My Computers

My Computers

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer