Solved Secure boot update HowTo

TrebleTA said:

See so all looked ok, but would I need to do this after every windows 11 clean install?

Click to expand...

After mid 2026, you'll never need to "do all this".

More importantly, you shouldn't have to "do clean installs", you should use 3rd party backup software.




Last time I did a clean install of Win 11 was in Oct 2021.
If Windows breaks I just restore from a backup. No clean installs necessary.



I keep the original Oct 2021 backup, and then I keep approx. three months of backups, just in case.

TrebleTA said:

See so all looked ok, but would I need to do this after every windows 11 clean install?


also what about the two Microsoft ones
Or is that fine.

Click to expand...

Here's what Mine looks like.... don't worry about the two that say "True". Microsoft will do those for you, in a few months.






The above screenshot is from Method Three, here...





NOTE: Back in 2022 or 2023, MS did something similar to this. A few of us ripped our hair out figuring out how to do the "revocations".
Then MS just did the same thing in a monthly update, half a year later.

So you won't really have to go crazy, worrying about this stuff... probably.

would I need to do this after every windows 11 clean install?

Click to expand...

no

Should I worry about these red "X" in front of these files?
There was no BIOS update on this machine.

fg2001gf11F said:

Should I worry about these red "X" in front of these files?
There was no BIOS update on this machine.

View attachment 159183

Click to expand...

Mines the exact same and I have the latest bios for my motherboard

ROG MAXIMUS XIII HERO Version 2302 2025/01/06

1. Updated Minimum CRB patch for Intel IPU 2024.3.
2. Updated ME to 15.0.50.2633
3. Improved system stability.

fg2001gf11F said:

Should I worry about these red "X" in front of these files?
There was no BIOS update on this machine.

View attachment 159183

Click to expand...

please do Part B of the HowTo
1st command is an Admin CMD prompt
2nd command in an Admin PowerShell

Part B.
open a CMD Prompt as Admin
then copy and paste this command
thanks to @Scott

1. at the CMD Prompt as Admin

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

Click to expand...

press enter and now close the CMD Prompt terminal

then open a PowerShell as Admin

2. within the PowerShell

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Click to expand...

press enter and restart you computer.

Final Check once the system has restarted
open the registry and find this key (again)
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

in the right Window you will see ..
UEFICA2023Status which will now show 'Updated'
WindowsUEFICA2023Capable 0x00000002


your system is now updated to the new 2023 certs
if this post is in the wrong part of the Forum please move it to the correct one.

edit by me. missed this out .. your system needs to be online for the update to work
best of luck Steve ..

Click to expand...

after completing Part B then please check the registry.
then check the output you have displayed again.
best of luck Steve ..

XxXxX said:

please do Part B of the HowTo


after completing Part B then please check the registry.



then check the output you have displayed again.
best of luck Steve ..

Click to expand...

I already did all that. But there is no change on the red "X"s.
I assume CA2011 is still the default, while CA2023 is not.

fg2001gf11F said:

I already did all that. But there is no change on the red "X"s.
I assume CA2011 is still the default, while CA2023 is not.

View attachment 159186
View attachment 159187

Click to expand...

according to the registry output windows is using and booting from the 2023 cert
as far as the HowTo goes you are done and dusted

anything else that needs updating will be done shortly by Microsoft.
best of luck Steve ..

XxXxX said:

according to the registry output windows is using and booting from the 2023 cert
as far as the HowTo goes you are done and dusted

anything else that needs updating will be done shortly by Microsoft.
best of luck Steve ..

Click to expand...

OK thanks, I was just curious about the meaning of those rex "X"s in front of the CA2023 files. Pretty confusing.

Hi XxXxX Ive Tried all what is suggested here but no luck ​

Thank You

Part A.
open a PowerShell as Admin
then copy and paste these two commands in this order.
thanks to @Brink tutorial.

1.
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" -Name "AvailableUpdates" -Value 0x40

then press enter

2.
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

press enter and now restart your computer TWICE

##### to check that the 2023 cert is now available #####
to check that the 2023 cert is available after the 2 restarts
open a PowerShell as Admin copy and paste this command

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match "Windows UEFI CA 2023"

the result of the command should show as 'True' (Mine said FALSE)

and then open the Windows registry to this key
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

in the right window you will see ..
UEFICA2023Status which will show 'updating'
WindowsUEFICA2023Capable 0x00000001

(Mine Shows Nothing in the Registry) Servicing is Blank

close the registry and you can now begin part B.

######

Part B.
open a CMD Prompt as Admin
then copy and paste this command
thanks to @Scott

1. at the CMD Prompt as Admin

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

press enter and now close the CMD Prompt terminal

then open a PowerShell as Admin

2. within the PowerShell

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

press enter and restart you computer.

Final Check once the system has restarted
open the registry and find this key (again)
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

in the right Window you will see ..
UEFICA2023Status which will now show 'Updated'
WindowsUEFICA2023Capable 0x00000002

(Still Nothing in the Registry) Servicing is Blank

your system is now updated to the new 2023 certs
if this post is in the wrong part of the Forum please move it to the correct one.

@Wolfzz


Have you done this...

How to do the SVN Update...​

Open Terminal (Admin), and run the following two commands, one at a time.

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"





cjee21's download has eight tools and a README, showing how to use them.



One of those tools is: Apply 2023 KEK, DB and bootmgfw update.cmd

They must be run from inside the folder they come in. Just right click any of them and choose: Run as administrator



Inside the extracted folder... Check-UEFISecureBootVariables-main ...it will look like this.






The README can be opened with Notepad.

Ghot said:

@Wolfzz


Have you done this...

How to do the SVN Update...​

Open Terminal (Admin), and run the following two commands, one at a time.

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"





cjee21's download has eight tools and a README, showing how to use them.

How to check if your Secure Boot certs are updated. (three methods)

Method One Download cjee21's files, attached to the bottom of this post. 1. Save the file to your desktop. 2. Extract the contents to your desktop. 3. Open: Check-UEFISecureBootVariables-main 4. Right click: Check UEFI PK, KEK, DB and DBX.cmd ...and choose: Run as administrator. Your...

www.elevenforum.com

One of those tools is: Apply 2023 KEK, DB and bootmgfw update.cmd

They must be run from inside the folder they come in. Just right click any of them and choose: Run as administrator



Inside the extracted folder... Check-UEFISecureBootVariables-main ...it will look like this.


View attachment 159210



The README can be opened with Notepad.

Click to expand...

I get this error in Command Prompt

Wolfzz said:

I get this error in Command Prompt

Click to expand...

Try it in Terminal (Admin) ... Powershell

Thanks to @Bree I've noticed most commands can be run in Terminal (Admin) Powershell.







Commands like sfc /scannow or Dism /Online /Cleanup-Image /AnalyzeComponentStore ...work well in Terminal (Admin) Powershell.

We always used to run these type commands in an elevated Command Prompt.
But, it seems like MS is trying to combine Command Prompt and Powershell commands in Terminal (Admin) Powershell.


The ONLY time I use an elevated Command Prompt these days, is when the instructions specifically say to do so.



And no... I didn't discover this. @Bree seemed to notice it first. And I noticed him noticing it.
After Windows Updates, a lot of folks run SFC and one or more DISM commands.

I noticed when Bree did it, he was using Terminal (Admin) Powershell. So I started doing that too.
I especially like the fact that the beginning of the commands is in YELLOW.
Which makes it easier to pick out the actual commands, when there's a whole bunch of them in a screenshot.



For example, this is from my post in the Dec 9th Windows Update topic...

No Luck Ghot exact same issue. I ran them both through powershell without a error rebooted

Apply 2023 KEK, DB and bootmgfw update.cmd as admin rebooted

Still Red x on them

This is my only worry that maybe the issue. UEFI DBX says None



Cheers

Wolfzz said:

Still Red x on them

Click to expand...

In cjee21's README, he mentions that it can sometimes take 12 hours for MS's update servers to do their thing. :/

I seemed to notice the changes fairly fast, but I was running the commands during the day.
At Microsoft it's now... 1:50am.

Their servers are probably asleep, dreaming about "subscription" Windows versions.



Initially, I followed @XxXxX 's directions, and it took a while.
I ran parts A and B twice and then it finally updated.
But that may have been waiting on the MS servers, and NOT my running those commands twice?

And... when all is said and done, WE shouldn't have to do any of this.
The motherboard manufacturers and Microsoft, should have done this silently, without our help.

Thanks Ghot & XxXxX I will give it another go tomorrow and let you know how I go.

Sorry for the slow reply, just wanted to say thanks all for the help.

Sorry for the late reply guys but still no go unfortunately maybe its because I reverted back to Windows 10 over the xmas break for other reasons.
Thanks for your help.

Wolfzz said:

Sorry for the late reply guys but still no go unfortunately maybe its because I reverted back to Windows 10 over the xmas break for other reasons.
Thanks for your help.

View attachment 159716

Click to expand...

the HowTo should also work with Windows 10 if you wish to update to the 2023 cert.
best of luck Steve ..

XxXxX said:

the HowTo should also work with Windows 10 if you wish to update to the 2023 cert.
best of luck Steve ..

Click to expand...

Yes that's what I thought but Ive tried 3 or 4 times with the info shown in the How Too and for some reason it just doesn't work. Looks like I will just have to live with it until I do another fresh install back to Windows 11 at sometime. Thanks Again