Solved Secure boot update HowTo

Bastet · Dec 18, 2025

Ghot said:
This is a common occurrence.
Do everything in the 1st post again.

Is anything meant to run after Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update" or does the restart open powershell to run it?

Ghot · Dec 18, 2025

Bastet said:
Is anything meant to run after Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update" or does the restart open powershell to run it?

There is four commands in the first post.
They ALL need to be run as outlined.
Including any restarts mentioned.

The following command is just to check things and need not be run.
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match "Windows UEFI CA 2023"

When finished, you can use either of these two methods to check if you succeeded...

How to check if your Secure Boot certs are updated. (three methods)

Method One Download cjee21's files, attached to the bottom of this post. 1. Save the file to your desktop. 2. Extract the contents to your desktop. 3. Open: Check-UEFISecureBootVariables-main 4. Right click: Check UEFI PK, KEK, DB and DBX.cmd ...and choose: Run as administrator. Your...

www.elevenforum.com

XxXxX · Dec 18, 2025

Bastet said:
Followed instructions but Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing shows in progress & not updating.
CMD shows True.
I previously tried via the MS instructions & they showed the same.
I don't think this old laptop can update.

on some systems it may show 'InProgress' for several days even after several restarts
i have had one oldish 21" Asus all in one take 3 days to move from 'InProgress' to 'Updated'

but 'InProgress' means that the 2023 cert is in the database.
best of luck Steve ..

Bastet · Dec 18, 2025

XxXxX said:
on some systems it may show 'InProgress' for several days even after several restarts
i have had one oldish 21" Asus all in one take 3 days to move from 'InProgress' to 'Updated'

but 'InProgress' means that the 2023 cert is in the database.
best of luck Steve ..

It was showing the same for months after updating previously using MS instructions.

I checked then & the certificates were installed correctly.

Bastet · Dec 18, 2025

Ghot said:
There is four commands in the first post.
They ALL need to be run as outlined.
Including any restarts mentioned.

The following command is just to check things and need not be run.
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match "Windows UEFI CA 2023"

When finished, you can use either of these two methods to check if you succeeded...

How to check if your Secure Boot certs are updated. (three methods)

Method One Download cjee21's files, attached to the bottom of this post. 1. Save the file to your desktop. 2. Extract the contents to your desktop. 3. Open: Check-UEFISecureBootVariables-main 4. Right click: Check UEFI PK, KEK, DB and DBX.cmd ...and choose: Run as administrator. Your...

www.elevenforum.com

I'm running the cmds until part B where it says it should be run when it shows updating.

The secure boot check seems to require Terminal w/Admin which the right click menu doesn't offer.
Tbh I think I'll give up & disable secure bot.

Ghot · Dec 18, 2025

Bastet said:
I'm running the cmds until part B where it says it should be run when it shows updating.

Just run part A then part B... twice if necessary.
If you read through this topic you will see that I had to do the same thing.

It's up to you of course.

Bastet · Dec 18, 2025

Ghot said:
Just run part A then part B... twice if necessary.
If you read through this topic you will see that I had to do the same thing.

It's up to you of course.

Thanks. It still says In Progress so I'll leave it & see what happens.

starchase · Dec 18, 2025

Bastet said:
Thanks. It still says In Progress so I'll leave it & see what happens.

Yeah, me too!

Ghot · Dec 18, 2025

Bastet said:
Thanks. It still says In Progress so I'll leave it & see what happens.

starchase said:
Yeah, me too!

As I mentioned, it's entirely your choice.

starchase · Dec 18, 2025

Looks like I fibbed. I couldn't wait so I asked Copilot about inserting the Windows UEFI CA 2023 which I had in the UEFI DB into the Boot Manager and I followed the instructions. There was one mistake it made but it worked. Here is my current state of Certs.

Here are the instructions I followed. (With edits!)

Code:

SAFE PROCEDURE FOR SWITCHING TO THE 2023 SIGNED BOOT MANAGER


Preparation and Prerequisites:
1.  Secure Book must be on and the UEFI DB includes the Windows UEFI CA 2023 cert
2.  Open Powershell as Administrator
3.  You'll mount the EFI System Partition to a temporary drive letter


Backup the Current EFI Boot Manager
1.  Mount the EFI Partition:

mountvol S: /s

2.  Create a backup folder

command:
mkdir S:\EFI\Microsoft\Boot\Backup_2011

3.  Copy current boot manager

command:
copy S:\EFI\Microsoft\Boot\bootmgfw.efi S:\EFI\Microsoft\Boot\Backup_2011\bootmgfw_2011.efi

4.  Optional: backup BCD and fallback loader

command:
copy S:\EFI\Microsoft\Boot\BCD S:\EFI\Microsoft\Boot\Backup_2011\BCD.bak
copy S:\EFI\Boot\bootx64.efi S:\EFI\Microsoft\Boot\Backup_2011\bootx64_2011.efi



Replace with the 2023-signed boot manager

1.  Verify source file exists
    Check path: C:\Windows\Boot\EFI\bootmgfw_EX.efi (or C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi depending on your system) my system was the latter, C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi.

command:
dir C:\Windows\Boot\EFI\bootmgfw_EX.efi
dir C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi

2.  Copy 2023-signed boot manager to EFI (use correct path above!)

command:
copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi S:\EFI\Microsoft\Boot\bootmgfw.efi

3.  Optional: update fallback loader to 2023 (I didn't follow this optional step)

command:
copy C:\Windows\Boot\EFI\bootmgfw_EX.efi S:\EFI\Boot\bootx64.efi



4.  Unmount EFI partition

command:
mountvol S: /d

That's it!

Verify and confirm compliance

- Reboot: Restart the system to load the new boot manager.
- Run your checker script:
- Expected:
Disk 0: Boot Manager [Windows UEFI CA 2023] is ALLOWED.
Registry: WindowsUEFICA2023Capable = 2
"[Windows UEFI CA 2023] is in UEFI DB, and Windows is starting from CA 2023 Boot Manager."

garlin · Dec 18, 2025

Instead of asking AI, how about a live human?

Code:

mountvol s: /s
bcdboot C:\Windows /f UEFI /s S: /bootex /d
mountvol s: /d

fg2001gf11F · Dec 18, 2025

I hope I'm finally updated on this Dell XPS 8930.

starchase · Dec 19, 2025

garlin said:
Instead of asking AI, how about a live human?

Code:

mountvol s: /s bcdboot C:\Windows /f UEFI /s S: /bootex /d mountvol s: /d

I thought it might be interesting to see the difference in what the 2 entities came up with. I kind of suspected that a human might have distilled the process into a small number of lines. Looks like I was right! :think:

nikki605 · Dec 19, 2025

Doing everything in the first post, Parts A & B worked for me. I'll be trying an older machine in a couple days using the same steps.

larysid · Dec 19, 2025

XxXxX said:
i have put this together as i had problems updating 2 desktops and 3 laptops.
which have now all had their Secure Boot Certs updated to the new 2023 secure boot cert
also the other post about this were getting very long and confusing.
this is in two parts. part A and part B.
edit by me. please note, your system must be online for part A to update

Part A.
open a PowerShell as Admin
then copy and paste these two commands in this order.
thanks to @Brink tutorial.

1.

then press enter

2.

press enter and now restart your computer TWICE

##### to check that the 2023 cert is now available #####
to check that the 2023 cert is available after the 2 restarts
open a PowerShell as Admin copy and paste this command

the result of the command should show as 'True'

and then open the Windows registry to this key
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

in the right window you will see ..
UEFICA2023Status which will show 'updating'
WindowsUEFICA2023Capable 0x00000001

close the registry and you can now begin part B.

######

Part B.
open a CMD Prompt as Admin
then copy and paste this command
thanks to @Scott

1. at the CMD Prompt as Admin

press enter and now close the CMD Prompt terminal

then open a PowerShell as Admin

2. within the PowerShell

press enter and restart you computer.

Final Check once the system has restarted
open the registry and find this key (again)
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

in the right Window you will see ..
UEFICA2023Status which will now show 'Updated'
WindowsUEFICA2023Capable 0x00000002

your system is now updated to the new 2023 certs
if this post is in the wrong part of the Forum please move it to the correct one.

edit by me. missed this out .. your system needs to be online for the update to work
best of luck Steve ..

Hello! I'd like something to ask about this Secure boot issue..
Since upgrading from win 11 24h2 to win11 25h2, the known error secure boot ca/keys needs to be updated, was replaced at every restart/shutdown by

Secure Boot certificates have been updated but are not yet applied to the device firmware. Review the published guidance to complete the update and ensure full protection. This device signature information is included here.
DeviceAttributes: BaseBoardManufacturer:ASUSTeK COMPUTER INC.;FirmwareManufacturer:American Megatrends Inc.;FirmwareVersion:5031;OEMModelNumber:System Product Name;OEMModelBaseBoard:ROG STRIX X570-F GAMING;OEMModelSystemFamily:To be filled by O.E.M.;OEMManufacturerName:System manufacturer;OEMModelSKU:SKU;OSArchitecture:amd64;
BucketId: 36af41ac3e6ad12f297d98409236fdbdde1fcc8ce511063e81fbbb17bb41370f
BucketConfidenceLevel:
UpdateType:
For more information, please see Windows Secure Boot certificate expiration and CA updates - Microsoft Support

Ok! So am I updated and have just to wait the next upcoming windows updates in 2026 so as to fix this issue?
I have not applied this fix, as I am already updated! But why is this error message appearing in my event viewer? I'd prefer Microsoft to fix it via its upcoming updates...Am I wrong?

garlin · Dec 19, 2025

larysid said:
Ok! So am I updated and have just to wait the next upcoming windows updates in 2026 so as to fix this issue?
I have not applied this fix, as I am already updated! But why is this error message appearing in my event viewer? I'd prefer Microsoft to fix it via its upcoming updates...Am I wrong?

MS is in the middle of a planned migration from now until mid-2026.

Earlier this year, they provided the tools for IT admins to voluntarily update their Secure Boot certs. Normal home users were not expected to do anything at this time. Recently, Windows pushed a Monthly Update where Event Viewer may report a TPI WMI "error" in the logs.

While it's categorized as an "error", it actually functions as a warning. In this migration phase, MS wants to increase awareness of the upcoming migration for IT admins and expert users. If you don't do anything, Windows will begin adding the CA 2023 certs for you next year. Later in the 2026, the migration will conclude by Windows revoking the CA 2011 certs.

If you own a relatively newer PC purchased in the last 3-4 years, you're probably supported and don't need to do anything. Check your PC's support site, and install any BIOS updates you're missing.

If you have an older PC, or it's not manufactured by a brand name company, then it may be helpful to try the update steps to see if they work or not.

larysid · Dec 19, 2025

garlin said:
MS is in the middle of a planned migration from now until mid-2026.

Earlier this year, they provided the tools for IT admins to voluntarily update their Secure Boot certs. Normal home users were not expected to do anything at this time. Recently, Windows pushed a Monthly Update where Event Viewer may report a TPI WMI "error" in the logs.

While it's categorized as an "error", it actually functions as a warning. In this migration phase, MS wants to increase awareness of the upcoming migration for IT admins and expert users. If you don't do anything, Windows will begin adding the CA 2023 certs for you next year. Later in the 2026, the migration will conclude by Windows revoking the CA 2011 certs.

If you own a relatively newer PC purchased in the last 3-4 years, you're probably supported and don't need to do anything. Check your PC's support site, and install any BIOS updates you're missing.

If you have an older PC, or it's not manufactured by a brand name company, then it may be helpful to try the update steps to see if they work or not.

Hello again! Thank you very much for the explanation provided above!! Yes of course I agree. My desktop PC is 4 years old and my laptop is brand new bought 3 months ago! We all have the same message that they keys have been updated so MS is responsible to fix it via its upcoming updates... And as I wrote above, I have already a task in my task scheduler regarding secure boot update, but in the service folder in registry, the update status is shown as NOT STARTED (as other users above who ran this forum script).. All in all I believe that MS will fix it because it is insane my PCs not to reboot because they expect us to do these steps manually...

garlin · Dec 19, 2025

Not Started may indicate it's waiting for the next Windows restart to make some changes.

francisco94 · Dec 20, 2025

In part A, the command always returns "true". After restarting twice, the registry showed "NotStarted". However, after repeating step A and restarting twice, it briefly showed "inProgress", but without doing anything, not even restarting, it reverted to the "NotStarted" state.

In my case, it's a desktop PC with an Asus Z790-A WiFi motherboard. How can I get part A to work?

Thanks.

fg2001gf11F · Dec 20, 2025

francisco94 said:
In part A, the command always returns "true". After restarting twice, the registry showed "NotStarted". However, after repeating step A and restarting twice, it briefly showed "inProgress", but without doing anything, not even restarting, it reverted to the "NotStarted" state.

In my case, it's a desktop PC with an Asus Z790-A WiFi motherboard. How can I get part A to work?

Thanks.

I had to manually add the CA 2023 to my BIOS to finally get this Updated state. See Posts #138 and #140 in the link below.

How to check if your Secure Boot certs are updated. (three methods)

Yes! Everything looks fine. All current values do have Green checkmarks. UEFI PK, KEK, DB and DBX. You're done. Congratulations. (y) (Script writer forgot to issue a new-line statement in the Current UEFI KEK section. If you make the CMD-box bigger than the spacing is not correct. (Less...

www.elevenforum.com

Solved Secure boot update HowTo

Well-known member

My Computer

Well-known member

My Computers

Just a Computer User

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Active member

My Computer

Well-known member

My Computer

Active member

My Computer

Well-known member

My Computer

Active member

My Computer

Well-known member

My Computer

Similar threads