Solved Secure boot update HowTo

Ghot · Nov 24, 2025

fg2001gf11F said:
What does this mean?

Where did you get that script?

ChrisVie · Nov 24, 2025

XxXxX said:
@ChrisVie
you have the secure boot cert available but not enabled.
please read post #1 > part B

using > part B in post #1 < should enable the 2023 secure boot cert.
best of luck Steve ..

Thanks, but I I have tried this several times, so far without success.

ChrisVie · Nov 24, 2025

fg2001gf11F said:
What does this mean?
Boot Manager [ ] is

See post #92 and the following posts.

Ghot · Nov 24, 2025

OK, here's how to check your Certs...

1. Download the script at the bottom of this post.
2. Extract the Check_BootFile.ps1 script and place it on your desktop.
3. Go to: C:\Users\your account name\Desktop and right click Desktop and choose: Open in Terminal
4. In the powershell windows that pops up, type the following...

.\Check_EFIBootFile.ps1 and hit the ENTER key.

You should get a result similar to this...

Here is the script...

fg2001gf11F · Nov 24, 2025

Ghot said:
Where did you get that script?

From post #90 on the thread below. Is that a valid script?

Secure boot update HowTo

I opened a case with Dell support. This is the last reply I got today. 😵‍💫🤷‍♂️ If you opt for using the Mosby tool, you will need to know how to put Secure Boot in Setup mode on your computer. On a Dell, this is how: Enter the UEFI. Delete all 4 Secure Boot keys. Then disable Secure Boot...

www.elevenforum.com

Same result with the script from your post #144 above.

Ghot · Nov 24, 2025

fg2001gf11F said:
Is that a valid script?

Worked for me as follows...

1. Download the script at the bottom of this post.
2. Extract the Check-SecureBootCerts.ps1 script and place it on your desktop.
3. Go to: C:\Users\your account name\Desktop and right click Desktop and choose: Open in Terminal
4. In the powershell windows that pops up, type the following...

.\Check-SecureBootCerts.ps1 and hit the ENTER key.

You should get a result similar to this...

Here is the script...

Ghot · Nov 24, 2025

fg2001gf11F said:
Same result with the script from your post #144 above.

If D: is a non-booting drive, that may be why you see that.
I ran the script(s) from the Desktop of my booting drive. In my case, the C:\ drive

fg2001gf11F · Nov 24, 2025

Ghot said:
Worked for me as follows...

1. Download the script at the bottom of this post.
2. Extract the Check-SecureBootCerts.ps1 script and place it on your desktop.
3. Go to: C:\Users\your account name\Desktop and right click Desktop and choose: Open in Terminal
4. In the powershell windows that pops up, type the following...

.\Check-SecureBootCerts.ps1 and hit the ENTER key.

You should get a result similar to this...

View attachment 154193

Here is the script...

That is a different script,

Ghot said:
If D: is a non-booting drive, that may be why you see that.
I ran the script(s) from the Desktop of my booting drive. In my case, the C:\ drive

OK, I'll try that. But it has no issue with the other script.

Ghot · Nov 24, 2025

fg2001gf11F said:
That is a different script,

Possibly. I've been messing with a bunch of them.
The scripts I attached go with the pictures I attached.

I just made a topic about how to check your Secure boot certs, here...

How to check if your Secure Boot certs are updated. (three methods)

Method One Download cjee21's files, attached to the bottom of this post. 1. Save the file to your desktop. 2. Extract the contents to your desktop. 3. Open: Check-UEFISecureBootVariables-main 4. Right click: Check UEFI PK, KEK, DB and DBX.cmd ...and choose: Run as administrator. Your...

www.elevenforum.com

fg2001gf11F · Nov 24, 2025

Ghot said:
Possibly. I've been messing with a bunch of them.
The scripts I attached go with the pictures I attached.

I just made a topic about how to check your Secure boot certs, here...

How to check if your Secure Boot certs are updated. (three methods)

Method One Download cjee21's files, attached to the bottom of this post. 1. Save the file to your desktop. 2. Extract the contents to your desktop. 3. Open: Check-UEFISecureBootVariables-main 4. Right click: Check UEFI PK, KEK, DB and DBX.cmd ...and choose: Run as administrator. Your...

www.elevenforum.com

Same results running from the C:Users\Usernam\Desktop

Ghot · Nov 24, 2025

fg2001gf11F said:
Same results running from the C:Users\Usernam\Desktop

It may just mean that Disk 2 and Disk 3 are NOT bootable.
Are they External Disks? Or maybe they are not set as bootable in the BIOS?
Or maybe they are non-bootable partitions?

I don't know the answers to this.
Heck, it took me this long (since post 1, this topic), just to figure out how to RUN these scripts. ^^

fg2001gf11F · Nov 24, 2025

Ghot said:
It may just mean that Disk 2 and Disk 3 are NOT bootable.
Are they External Disks? Or maybe they are not set as bootable in the BIOS?
Or maybe they are non-bootable partitions?

I don't know the answers to this.
Heck, it took me this long (since post 1, this topic), just to figure out how to RUN these scripts. ^^

The systems boot fine on 3 different machines, one is on Disk 2, another on Disk 3 and another on Disk 0.
All 3 get the same Boot Manager [] is BANNED.

ChrisVie · Nov 24, 2025

808 said:
Did your command include the "$_" before before Type? I don't see it in your error message.

Here's what happens when I run it on my system without and with the "$_" (note, my System disk is DIsk 1 so that's why I'm using 1 vs 0).

(WITHOUT)
powershell -ExecutionPolicy Bypass -Command "(Get-Partition -DiskNumber 1 | Where-Object { .Type -eq 'System' })"
Where-Object : The term '.Type' is not recognized as the name of a cmdlet, function, script file, or operable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:32
+ (Get-Partition -DiskNumber 1 | Where-Object { .Type -eq 'System' })
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (.Type:String) [Where-Object], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException,Microsoft.PowerShell.Commands.WhereObjectCommand

(WITH)
powershell -ExecutionPolicy Bypass -Command "(Get-Partition -DiskNumber 1 | Where-Object { $_.Type -eq 'System' })"

DiskPath: \\?\scsi#disk&ven_nvme&prod_samsung_ssd_990#5&29ebe5f4&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

PartitionNumber DriveLetter Offset Size Type
--------------- ----------- ------ ---- ----
1 1048576 260 MB System

The formatting as code here in the forum has swallowed the “$” :), I entered it correctly. In the meantime, I have worked out that “$_.Type” works at the command prompt, but not directly in Powershell.

fg2001gf11F · Nov 24, 2025

fg2001gf11F said:
The systems boot fine on 3 different machines, one is on Disk 2, another on Disk 3 and another on Disk 0.
All 3 get the same Boot Manager [] is BANNED.

You can have a conversation with COPILOT for an explanation of what the message means "Boot Manager [] is BANNED"
It refers to older files being revoked and present in the EFI partition.
It confused me about how to know which ones.

808 · Nov 25, 2025

ChrisVie said:
The formatting as code here in the forum has swallowed the “$” :), I entered it correctly. In the meantime, I have worked out that “$_.Type” works at the command prompt, but not directly in Powershell.

Interesting. Can you try the following two commands in Powershell and see if they work or fail? They are doing the same thing as the other command in the script, just different ways.

(Get-Partition -DiskNumber 0 | Where-Object -FilterScript { $_.Type -eq 'System' })

(Get-Partition -DiskNumber 0 | Where-Object Type -EQ 'System')

Also, while in powershell, try entering $PSVersionTable

I want to see what version it says. Are you running the one that comes with windows or did you download the "newer" one.

ChrisVie · Nov 25, 2025

808 said:
Interesting. Can you try the following two commands in Powershell and see if they work or fail? They are doing the same thing as the other command in the script, just different ways.

(Get-Partition -DiskNumber 0 | Where-Object -FilterScript { $_.Type -eq 'System' })

(Get-Partition -DiskNumber 0 | Where-Object Type -EQ 'System')

Also, while in powershell, try entering $PSVersionTable

I want to see what version it says. Are you running the one that comes with windows or did you download the "newer" one.

Both work well.
My Powershell version is 5.1, it was already installed, no download. My device came pre-installed with Windows 11 24H2 26100.3775 and I upgraded it to 25H2 26200.7171.
In PS 5.1, type is an alias for get-content.

808 · Nov 25, 2025

ChrisVie said:
Both work well.
My Powershell version is 5.1, it was already installed, no download. My device came pre-installed with Windows 11 24H2 26100.3775 and I upgraded it to 25H2 26200.7171.
In PS 5.1, type is an alias for get-content.

View attachment 154217

Strange then that the original script didn't / doesn't work. I'm using the same version of powershell, albeit with 24H2 26100.7171 but that is supposed to be the same as 25H2 just with some features disabled.

In any case, if you want to try and update the script you have, open it with Notepad and look for the following line:

$GUID = (Get-Partition -DiskNumber $SystemDisk | Where-Object { $_.Type -eq 'System' }).Guid

and change it to

$GUID = (Get-Partition -DiskNumber $SystemDisk | Where-Object -FilterScript { $_.Type -eq 'System' }).Guid

since adding the explicit -Filterscript option seemed to work for you.

As you can see, the next line sets the variable $BootMgr_File using $GUID and the line after that sets the variable $PFXCert to the output of the function Get-PFXCert (defined earlier in the script) using the variable $BootMgr_File as its argument.

If all that works as it should, you should see the $PFXCert value between the [ ], as opposed to blank, and hopefully the function Validate-PFXCert will also return the proper value.

loomajoo · Nov 25, 2025

ChrisVie said:
Here are my results, some of which are quite alarming, such as “Do not ship, OEM1 Test DB” and “59/60 failures.” I'm wondering what I should do with this now. The computer is a brand new device that was delivered to me a week ago.

If you go to PKfail you can learn more about this Platform Key vulnerability, and its worryingly large prevalence world wide (its been around afew years now).

In short however, as I understand it, your system is compromised, and as someone else already said in this thread, none of the PCA/CA2011 mitigations here will help.

I'd contact the vendor of the new machine, and/or the OEM, and push (hard!) for either a replacement that doesnt have this problem, or a guarantee to get your BIOS fixed ASAP, and preferably before June 2026 when MS start rolling out their revocations.

ChrisVie · Nov 25, 2025

808 said:
Strange then that the original script didn't / doesn't work. I'm using the same version of powershell, albeit with 24H2 26100.7171 but that is supposed to be the same as 25H2 just with some features disabled.

In any case, if you want to try and update the script you have, open it with Notepad and look for the following line:

$GUID = (Get-Partition -DiskNumber $SystemDisk | Where-Object { $_.Type -eq 'System' }).Guid

and change it to

$GUID = (Get-Partition -DiskNumber $SystemDisk | Where-Object -FilterScript { $_.Type -eq 'System' }).Guid

since adding the explicit -Filterscript option seemed to work for you.

As you can see, the next line sets the variable $BootMgr_File using $GUID and the line after that sets the variable $PFXCert to the output of the function Get-PFXCert (defined earlier in the script) using the variable $BootMgr_File as its argument.

If all that works as it should, you should see the $PFXCert value between the [ ], as opposed to blank, and hopefully the function Validate-PFXCert will also return the proper value.

With the modified line, the script works, even if the result is not satisfactory.

The differences between our PS 5.1 versions could be due to the fact that Powershell 2.0 was never installed on my device; this may be different on yours.

ChrisVie · Nov 25, 2025

loomajoo said:
If you go to PKfail you can learn more about this Platform Key vulnerability, and its worryingly large prevalence world wide (its been around afew years now).

In short however, as I understand it, your system is compromised, and as someone else already said in this thread, none of the PCA/CA2011 mitigations here will help.

I'd contact the vendor of the new machine, and/or the OEM, and push (hard!) for either a replacement that doesnt have this problem, or a guarantee to get your BIOS fixed ASAP, and preferably before June 2026 when MS start rolling out their revocations.

In my opinion, requesting a replacement doesn't make much sense, as the new device would have the same problem; my BIOS is up to date. The solution is for the manufacturer or AMI to provide a BIOS update in a timely manner. As a first step, I contacted Geekom via the customer forum, which is also officially monitored by Geekom representatives, and am currently waiting for a response. I am fairly optimistic that they will get to grips with the problem, which affects other well-known manufacturers too.

Solved Secure boot update HowTo

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Similar threads

My Computers

My Computer

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer