Solved Secure boot update HowTo

drminer · Nov 19, 2025

fg2001gf11F said:
I opened a case with Dell support.
This is the last reply I got today.

View attachment 153515

If you opt for using the Mosby tool, you will need to know how to put Secure Boot in Setup mode on your computer. On a Dell, this is how: Enter the UEFI. Delete all 4 Secure Boot keys. Then disable Secure Boot. This puts the computer into Setup mode. Lastly, you will need to enable booting from a USB drive; it probably disabled by default. It is at this point that you will want to boot to the USB drive that has the Mosby installation. You have till June 2026 to see if Dell comes through, but I really doubt that they will.

fg2001gf11F · Nov 19, 2025

drminer said:
If you opt for using the Mosby tool, you will need to know how to put Secure Boot in Setup mode on your computer. On a Dell, this is how: Enter the UEFI. Delete all 4 Secure Boot keys. Then disable Secure Boot. This puts the computer into Setup mode. Lastly, you will need to enable booting from a USB drive; it probably disabled by default. It is at this point that you will want to boot to the USB drive that has the Mosby installation. You have till June 2026 to see if Dell comes through, but I really doubt that they will.

Too complicated, I'll wait for an official fix. I have also a GMKTec mini M2 with problems, where I cannot change any of the UEFI BIOS settings to allow the update. They locked everything on that mini-PC.

Dirtyflash · Nov 19, 2025

Buddywh said:
It sounds more difficult than it actually is. It's a tool very useful for installing custom boot objects, but we'd be using it in it's default mode which is prepare it for booting Windows in Secure Boot with a unique PK .

The way I'd go about it is to download the latest RUFUS, then use it to create a UEFI bootable USB using version 2.2. When it's done, check the USB and it should have the MOSBY files on it. Read through the README's in there too.

Then restart into BIOS, disable Secure Boot, find a setting to put Secure Boot into SETUP MODE, or DELETE ALL KEYS... not reset them, delete them. Don't worry, if it has a DELETE KEYS or SETUP MODE then it has a RESTORE DEFAULT KEYS setting too (or d**mn well better) so you can go back to where you are now if it all goes south.

Then reboot into the USB.

Run MOSBY. It will prepare a cryptographicaly unique PK, sign a KEK with it, then install the PK, KEK and DB secure boot keys. It will also revoke trust in the 2011 key if you use the -X option, but I wouldn't do that until you know for a fact you have a 2023 signed boot files or it will not start in Secure Boot mode.

Then restart back into BIOS, put it in Secure Boot mode, restart.

If you don't use -X , can you revoke the 2011 keys at a later stage using Mosby, or would you need to use a different method?

Buddywh · Nov 19, 2025

Dirtyflash said:
If you don't use -X , can you revoke the 2011 keys at a later stage using Mosby, or would you need to use a different method?

Yes you can... or you can wait until Microsoft does it, which they plan to. I understand Microsoft will make updates to DBX as needed, a part of their security updates, by revoking trust in boot manager files that have been compromised.

That also means people with Bitlocker encrypted drives had best keep their keys handy since changes to the secure boot variables (especially if BL is binding PCR-7) can trigger a recovery situation.

Dirtyflash · Nov 19, 2025

Buddywh said:
Yes you can... or you can wait until Microsoft does it, which they plan to. I understand Microsoft will routinely do updates to DBX revocations as a part of their security updates by revoking trust in boot files that are compromised.

Okay, that makes sense. I've come to the conclusion Mosby is an effective tool, especially for unsupported devices that have been abandoned by OEMs, in so far as it relates to BIOS updates that deal with the certs.

Buddywh · Nov 19, 2025

Dirtyflash said:
especially for unsupported devices that have been abandoned by OEMs

I have an older AM3 computer that I really want to keep running. I'm not really super-techie, and definitely not an IT guru; just persistent since I knew Gigabyte (the m'board mfr) had long ago abandoned it. But luckily not before they'd released one last BIOS rev with a decent enough UEFI implementation that included Secure Boot and controls for key management.

And realizing there was nothing more coming is what prompted me to spend a few hours with ChatGPT and pouring through Microsoft KB articles while experimenting with MOSBY on that old machine. I was actually surprised with how easy MOSBY made it, and really everything else is too.

XxXxX · Nov 19, 2025

Buddywh said:
I have an older AM3 computer that I really want to keep running. I'm not really super-techie, and definitely not an IT guru; just persistent since I knew Gigabyte (the m'board mfr) had long ago abandoned it, but luckily not before they'd released one last BIOS rev with a decent enough UEFI implementation that included Secure Boot and controls for key management.

And realizing there was nothing more coming is what prompted me to spend a few hours with ChatGPT and pouring through Microsoft KB articles while experimenting with MOSBY on that old machine. I was actually surprised with how easy MOSBY made it, and really everything else is too.

i think you may have to do a plain and simple step by step guide on how to use Mosby.
best of luck Steve ..

Buddywh · Nov 19, 2025

XxXxX said:
plain and simple step by step guide on how to use Mosby

I don't think I could do any better than what I did a few posts back. And besides, for updating SB keys my preferred suggestion for people is to go look for an updated BIOS first, then the Microsoft method. Honestly, MOSBY is and should be one of the last options for just updating to 2023 keys (it's still very useful if you want a cryptographicaly unique PK... or to install custom keys but that's WAY beyond my experience ).

And it's really not a sure thing it can be used anyway since when the Microsoft method fails it's quite likely because the OEM/Mfr. mucked up the last BIOS so badly it can't be updated using the "push" and that might easily mean they also don't provide the necessary user controls for key management. I've come to the conclusion HP, Dell, Lenovo are not owner-friendly computers, especially those made for deployment into institutional environments with professional IT to manage them.

ChrisVie · Nov 19, 2025

Can someone please tell me where to find the “Check_EFIBootFile.PS1” script?

KevTech · Nov 19, 2025

ChrisVie said:
Can someone please tell me where to find the “Check_EFIBootFile.PS1” script?

ChrisVie · Nov 19, 2025

Strange result, especially Bootmanager[] is banned. Doesn't tell me anything.

Buddywh · Nov 19, 2025

ChrisVie said:
View attachment 153608

View attachment 153607

Strange result, especially Bootmanager[] is banned. Doesn't tell me anything.

Try this one instead. It tells you the correct status of boot manager files in a way that makes sense. It will also report if there's a MOSBY key, which you won't have if you didn't use MOSBY to install the keys. But it still reports all the 2011 and 2023 keys if it finds them, and as well as boot file status of bootable USB recovery drives that are plugged in at the time.

KevTech · Nov 19, 2025

ChrisVie said:
View attachment 153608

View attachment 153607

Strange result, especially Bootmanager[] is banned. Doesn't tell me anything.

You have the 2023 in the database but are not booting from it.

Margarita · Nov 19, 2025

Thanks, It was showing as "NotStarted" but after applying the steps..

I completed all the steps and restart and got "inProgress" for 5 minutes after restart but then it changed to "Updated."

fg2001gf11F · Nov 19, 2025

KevTech said:
You have the 2023 in the database but are not booting from it.

View attachment 153615

This is strange too, on my Dell XPS 8930, still shows InProgress, but the next REG_DWORD changed to (2).

Pretty confusing.

Margarita · Nov 19, 2025

fg2001gf11F said:
This is strange too, on my Dell XPS 8930, still shows InProgress, but the next REG_DWORD changed to (2).
Pretty confusing.

Try repeating steps A and B, restarting twice after each step.
After completing everything, wait 5 minutes and then recheck the registry value.

fg2001gf11F · Nov 19, 2025

Margarita said:
Try repeating steps A and B, restarting twice after each step.
After completing everything, wait 5 minutes and then recheck the registry value.

Already tried that several times. Did not work on this Dell XPS 8930 with BIOS 1.1.31 which is the latest available for this system.
I have other models of Dell where it shows updated.

This below is on Dell XPS 8940 that has a more recent BIOS.

ChrisVie · Nov 20, 2025

Buddywh said:
Try this one instead. It tells you the correct status of boot manager files in a way that makes sense. It will also report if there's a MOSBY key, which you won't have if you didn't use MOSBY to install the keys. But it still reports all the 2011 and 2023 keys if it finds them, and as well as boot file status of bootable USB recovery drives that are plugged in at the time.

Thanks @Buddywh ! Stiil the same output.

808 · Nov 20, 2025

ChrisVie said:
Thanks @Buddywh ! Stiil the same output.

View attachment 153660

For some reason, the script isn't able to get the certificate of the boot manager on the EFI partition. That's why you see [ ] and BANNED.
Since the script seems to think your system disk is Disk 0, if you want to troubleshoot, try running the following commands:

This is what the script is doing so I assume it will fail (no result)
powershell -ExecutionPolicy Bypass -Command "(Get-Partition -DiskNumber 0 | Where-Object { $_.Type -eq 'System' }).Guid"

If that's the case, try
powershell -ExecutionPolicy Bypass -Command "(Get-Partition -DiskNumber 0 | Where-Object { $_.Type -eq 'System' })"

If there is still no System partition, try
powershell -ExecutionPolicy Bypass -Command "Get-Partition -DiskNumber 0"

If that still doesn't work, the next step will be to determine where your EFI partition is and/or why the script method to identify it isn't working.

ChrisVie · Nov 20, 2025

808 said:
For some reason, the script isn't able to get the certificate of the boot manager on the EFI partition. That's why you see [ ] and BANNED.
Since the script seems to think your system disk is Disk 0, if you want to troubleshoot, try running the following commands:

This is what the script is doing so I assume it will fail (no result)
powershell -ExecutionPolicy Bypass -Command "(Get-Partition -DiskNumber 0 | Where-Object { $_.Type -eq 'System' }).Guid"

If that's the case, try
powershell -ExecutionPolicy Bypass -Command "(Get-Partition -DiskNumber 0 | Where-Object { $_.Type -eq 'System' })"

If there is still no System partition, try
powershell -ExecutionPolicy Bypass -Command "Get-Partition -DiskNumber 0"

If that still doesn't work, the next step will be to determine where your EFI partition is and/or why the script method to identify it isn't working.

Thanks! The first two are not executed in Powershell, error message due to “.Type”:

+ (Get-Partition -DiskNumber 0 | Where-Object { .Type -eq ‘System’ })
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (.Type:String) [Where-Object], CommandNotFoundException
[I] + FullyQualifiedErrorId : CommandNotFoundException,Microsoft.PowerShell.Commands.WhereObjectCommand[/I]

This is the output of the third one:

Solved Secure boot update HowTo

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computers

My Computers

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer