Solved Secure boot update HowTo

HeavyHemi · Dec 13, 2025

Buddywh said:
Or under-thinking it in the area that might matter more if I only realized it. It's a pretty darn complicated interaction of things that go to make this all work, with unclear explanations and as often as not innacuracies wherever I turn.

Right. Which is why I was trying make it perfectly clear exactly what I did for my system and my situation. I also said this was as a last resort when all the other methods would not work. I am not suggesting anyone follow my procedure on a different system or in different circumstances.

starchase · Dec 13, 2025

I apologize if I should know more than I do after reading these posts but I have a question. My ASUS desktop, which had been fully updated with the latest certs

Code:

the following Powershell script run 11/24/25
PS C:\temp>  powershell -nop -ep bypass -f Check_EFIBootFile.ps1
Secure Boot: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------

EFI Files
---------
    Disk 0: Boot Manager [Windows UEFI CA 2023] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] is in UEFI DB, and Windows is starting from CA 2023 Boot Manager.

Bootable Media
--------------
    USB D: "MACRIUMBOOT"
        Boot File [Windows UEFI CA 2023] is ALLOWED.

and today (following some boot issues in the recent past) the ASUS wouldn't boot. So I booted from a Macrium Rescue Disk that had the 2023 cert applied and ran the "Fix Boot Problems" applet which then allowed me to boot to Windows as it always has. So I ran "powershell -nop -ep bypass -f Check_EFIBootFile.ps1" and the result was the same as above except for the line:

Code:

EFI Files
---------
    Disk 0: Boot Manager [Production PCA 2011] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 1
        [Windows UEFI CA 2023] is in UEFI DB.

I hope/assume there is an easy fix to restore the EFI files to boot from the PCA 2011 cert, right?

Dirtyflash · Dec 13, 2025

starchase said:
I apologize if I should know more than I do after reading these posts but I have a question. My ASUS desktop, which had been fully updated with the latest certs

Code:

the following Powershell script run 11/24/25 PS C:\temp> powershell -nop -ep bypass -f Check_EFIBootFile.ps1 Secure Boot: ON BitLocker on (C:) OFF UEFI KEK Certs -------------- Microsoft Corporation KEK CA 2011 Microsoft Corporation KEK 2K CA 2023 UEFI DB Certs ------------- Microsoft Corporation UEFI CA 2011 Microsoft Windows Production PCA 2011 Microsoft Option ROM UEFI CA 2023 Microsoft UEFI CA 2023 Windows UEFI CA 2023 UEFI DBX Certs -------------- EFI Files --------- Disk 0: Boot Manager [Windows UEFI CA 2023] is ALLOWED. Registry: WindowsUEFICA2023Capable = 2 [Windows UEFI CA 2023] is in UEFI DB, and Windows is starting from CA 2023 Boot Manager. Bootable Media -------------- USB D: "MACRIUMBOOT" Boot File [Windows UEFI CA 2023] is ALLOWED.

and today (following some boot issues in the recent past) the ASUS wouldn't boot. So I booted from a Macrium Rescue Disk that had the 2023 cert applied and ran the "Fix Boot Problems" applet which then allowed me to boot to Windows as it always has. So I ran "powershell -nop -ep bypass -f Check_EFIBootFile.ps1" and the result was the same as above except for the line:

Code:

EFI Files --------- Disk 0: Boot Manager [Production PCA 2011] is ALLOWED. Registry: WindowsUEFICA2023Capable = 1 [Windows UEFI CA 2023] is in UEFI DB.

I hope/assume there is an easy fix to restore the EFI files to boot from the PCA 2011 cert, right?

Looks like your PCA 2011 key is restored and your device is booting from it. Windows UEFI CA 2023 is in the registry but not currently set to boot from it. That may explain why you were unable to boot. You don't have anything to worry about, you could redo step 1 in the first post and it may change it back to booting with Windows UEFI CA 2023.

starchase · Dec 13, 2025

Thanks. I am doing that now and will report after 2 restarts.

starchase · Dec 13, 2025

I still get:

Code:

EFI Files
---------
    Disk 0: Boot Manager [Production PCA 2011] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 1
        [Windows UEFI CA 2023] is in UEFI DB.

Perhaps this is an issue that I just have to wait 5 minutes or more for it all to shake out? Here are my registry items:

Dirtyflash · Dec 13, 2025

starchase said:
I still get:

Code:

EFI Files --------- Disk 0: Boot Manager [Production PCA 2011] is ALLOWED. Registry: WindowsUEFICA2023Capable = 1 [Windows UEFI CA 2023] is in UEFI DB.

Perhaps this is an issue that I just have to wait 5 minutes or more for it all to shake out? Here are my registry items:
View attachment 156869
View attachment 156870

It looks like it's in progress according to the registry. Just let it do its thing. Maybe do part 2 in the first post, can't do any harm and might push things along.

garlin · Dec 13, 2025

There's two sets of boot files under C:\Windows\Boot:

EFI\bootmgfw.efi (CA 2011)
EFI_EX\bootmgfw_EX.efi (CA 2023)

You can simply copy one of the two to the EFI volume. To revert back to CA 2011 boot file:

Code:

mountvol S: /s
copy C:\Windows\Boot\EFI\bootmgfw.efi S:\EFI\Microsoft\Boot\bootmgfw.efi
mountvol S: /d

The destination file always has the same filename, bootmgfw.efi. But the source file might have _EX in the folder and filename.

Dirtyflash · Dec 13, 2025

garlin said:
There's two sets of boot files under C:\Windows\Boot:

EFI\bootmgfw.efi (CA 2011)
EFI_EX\bootmgfw_EX.efi (CA 2023)

You can simply copy one of the two to the EFI volume. To revert back to CA 2011 boot file:

Code:

mountvol S: /s copy C:\Windows\Boot\EFI\bootmgfw.efi S:\EFI\Microsoft\Boot\bootmgfw.efi mountvol S: /d

The destination file always has the same filename, bootmgfw.efi. But the source file might have _EX in the folder and filename.

Hmm, looks like an easy way to switch back and forth, or whenever it becomes necessary. I'll keep it for future reference.

starchase · Dec 13, 2025

So . . . .to take the 2023 cert from the Windows/boot location and add it to the EFI file at EFI\Microsoft\Boot\bootmgfw.efi I would run:

Code:

mountvol S: /s
copy C:\Windows\Boot\EFI\bootmgfw_EX.efi S:\EFI\Microsoft\Boot\bootmgfw.efi
mountvol S: /d

Do I save this as a .bat file and just RUN it?

starchase · Dec 13, 2025

UPDATE: I just ran all the steps in post # 1 and now have everything back to normal.

Code:

PS C:\temp> powershell -nop -ep bypass -f Check_EFIBootFile.ps1
Secure Boot: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------

EFI Files
---------
    Disk 0: Boot Manager [Windows UEFI CA 2023] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] is in UEFI DB, and Windows is starting from CA 2023 Boot Manager.

Bootable Media
--------------
    USB D: "MACRIUMBOOT"
        Boot File [Windows UEFI CA 2023] is ALLOWED.

PS C:\temp>

Thanks for your input all.

dbartenstein · Dec 16, 2025

XxXxX said:
i have put this together as i had problems updating 2 desktops and 3 laptops.
which have now all had their Secure Boot Certs updated to the new 2023 secure boot cert
also the other post about this were getting very long and confusing.
this is in two parts. part A and part B.
edit by me. please note, your system must be online for part A to update

Part A.
open a PowerShell as Admin
then copy and paste these two commands in this order.
thanks to @Brink tutorial.

1.

then press enter

2.

press enter and now restart your computer TWICE

##### to check that the 2023 cert is now available #####
to check that the 2023 cert is available after the 2 restarts
open a PowerShell as Admin copy and paste this command

the result of the command should show as 'True'

and then open the Windows registry to this key
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

in the right window you will see ..
UEFICA2023Status which will show 'updating'
WindowsUEFICA2023Capable 0x00000001

close the registry and you can now begin part B.

######

Part B.
open a CMD Prompt as Admin
then copy and paste this command
thanks to @Scott

1. at the CMD Prompt as Admin

press enter and now close the CMD Prompt terminal

then open a PowerShell as Admin

2. within the PowerShell

press enter and restart you computer.

Final Check once the system has restarted
open the registry and find this key (again)
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

in the right Window you will see ..
UEFICA2023Status which will now show 'Updated'
WindowsUEFICA2023Capable 0x00000002

your system is now updated to the new 2023 certs
if this post is in the wrong part of the Forum please move it to the correct one.

edit by me. missed this out .. your system needs to be online for the update to work
best of luck Steve ..

Followed your steps to the letter, but I see this:

SIW2 · Dec 16, 2025

You might need to wait a while then reboot. That is what happened on my machine

You probably havent trawled through this thread see the following posts

Secure boot update HowTo

When you use File Explorer's context menu to run a PS script, it runs the script inside a PS window. But when the script is done, the default behavior is to close the window. This is fine if all the script does is to perform a task without you needing to see it. But this script outputs...

www.elevenforum.com

and

Secure boot update HowTo

When you use File Explorer's context menu to run a PS script, it runs the script inside a PS window. But when the script is done, the default behavior is to close the window. This is fine if all the script does is to perform a task without you needing to see it. But this script outputs...

www.elevenforum.com

dbartenstein · Dec 16, 2025

SIW2 said:
You might need to wait a while then reboot. That is what happened on my machine

You probably havent trawled through this thread see the following posts

Secure boot update HowTo

When you use File Explorer's context menu to run a PS script, it runs the script inside a PS window. But when the script is done, the default behavior is to close the window. This is fine if all the script does is to perform a task without you needing to see it. But this script outputs...

www.elevenforum.com

and

Secure boot update HowTo

When you use File Explorer's context menu to run a PS script, it runs the script inside a PS window. But when the script is done, the default behavior is to close the window. This is fine if all the script does is to perform a task without you needing to see it. But this script outputs...

www.elevenforum.com

I now notice that I am getting this error when I runt the "update" command.....

XxXxX · Dec 16, 2025

dbartenstein said:
Followed your steps to the letter, but I see this:

View attachment 157124

i have just updated an oldish 21" Asus all in one for someone and the
'InProgress' took 3 days and several restarts before it showed 'Updated'

also someone else had to disable their firewall before the update could be fully applied
so there seems to be several reasons why it takes some time for the update to happen.

best of luck Steve ..

starchase · Dec 18, 2025

XxXxX said:
i have just updated an oldish 21" Asus all in one for someone and the
'InProgress' took 3 days and several restarts before it showed 'Updated'

Wow! Good to know. With the latest version of GitHub's Mosby I was able to get my 2016 HP Spectre laptop "InProgress" status (above post #350) where a month ago I was constrained to the option of running w/ Secure Boot disabled since HP's own document stated that 2018 was the cutoff date for supporting machines with an updated Bios. So now I just have to be patient a couple of days longer. Thanks for your post.

EDIT: In a previous post # 1332 I referred to an HP document that was at this link Required BIOS updates by release year of platform but the document has been pulled by HP for some reason!!!!!!!! I should have saved the doc and used the new link so the document could be saved and out of HP's hands! The document stated: "Platforms released in 2017 and earlier do not receive a BIOS update related to this change, because HP no longer supports those platforms."

Bastet · Dec 18, 2025

I have an unsupported (cpu) laptop with TPM 2.0, the official page suggests not to update the certificates if you have this - should I leave it or update?
I doubt the manufacturer will be supplying any BIOS updates which seems to be the eventual last step.

garlin · Dec 18, 2025

Bastet said:
I have an unsupported (cpu) laptop with TPM 2.0, the official page suggests not to update the certificates if you have this - should I leave it or update?
I doubt the manufacturer will be supplying any BIOS updates which seems to be the eventual last step.

You have the option to run Mosby, since it self-signs the certs and isn't dependent on your vendor signing the KEK CA 2023.

XxXxX · Dec 18, 2025

garlin said:
You have the option to run Mosby, since it self-signs the certs and isn't dependent on your vendor signing the KEK CA 2023.

Microsoft will be revoking the 2011 cert sometime in 2026 so it maybe a good idea to update secure boot to the 2023 cert.
best of luck Steve ..

Bastet · Dec 18, 2025

Followed instructions but Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing shows in progress & not updating.
CMD shows True.
I previously tried via the MS instructions & they showed the same.
I don't think this old laptop can update.

Ghot · Dec 18, 2025

Bastet said:
Followed instructions but Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing shows in progress & not updating.

This is a common occurrence.
Do everything in the 1st post again.

Yes, I know it makes no sense. I'm not sure whether it's just that there is time needed for the certs to update,
or if those commands just need to be run twice.

I had to run them twice.

Solved Secure boot update HowTo

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Just a Computer User

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Just a Computer User

My Computers

Well-known member

My Computer

Well-known member

My Computers

Similar threads