Solved Secure boot update HowTo

Razman said:

hello all, tried to update boot certs. but it fails, found out that secure boot was disabled in bios, enablede it and run the update again
but it still fails. my question is if secure boot is disabled, will my computer be able to boot after june??

Click to expand...

Davy49 said:

Hello All,
First of all I'm not trying to cause any kind of strife between any of the user's within this great platform. I've always appreciated the assistance that's been provided to me when I needed it, and whenever possible I enjoy providing assistance to others.

Click to expand...

gdvbel said:

With secure boot disabled, there is no control of the Windows boot sector against the certificates in secure boot So even if a malicious program inserted inself into uefi, your Windows system will not be aware of that, and continue booting as always after June 2026.
Without the new CA 2023 certificates, neither your secure boot uefi nor your Windows boot will get the necessary Windows security updates after June 2026.
Your uefi will remain using CA 2011 certificates.

If you do your financial transactions on this computer, you will need to be sure, and have the CA 2023 certificates.

Click to expand...

Razman said:

thank for reply, will try and fix it before june

Click to expand...

gdvbel said:

You cannot update the new certificates if you are on a legacy bios. It has to boot in uefi.

Click to expand...

XxXxX said:

@garlin advice needed please
just as a heads up and something for you to check please ..

within the Group Policy Editor
Computer Configuration > Administrative Templates > Windows Components

there is a 'Secure Boot' folder with these settings ..
1. Enable Secure Boot Certificate Deployment
2. Automatic Certificate Deployment via Update
3. Certificate Deployment via Controlled Feature Rollout

i have mine all set to 'Enabled'

would these settings/features be of any use to the average user.
best of luck Steve ..

Click to expand...

XxXxX said:

@garlin advice needed please
just as a heads up and something for you to check please ..

within the Group Policy Editor
Computer Configuration > Administrative Templates > Windows Components

there is a 'Secure Boot' folder with these settings ..
1. Enable Secure Boot Certificate Deployment
2. Automatic Certificate Deployment via Update
3. Certificate Deployment via Controlled Feature Rollout

i have mine all set to 'Enabled'

would these settings/features be of any use to the average user.
best of luck Steve ..

Click to expand...

john1955 said:

Mine are all set to not configured
Has the information in this article been covered in this thread?
I'm still reading it now . . .

Group Policy Objects (GPO) method of Secure Boot for Windows devices with IT-managed updates - Microsoft Support

support.microsoft.com

The one above is referenced from this page

Windows Secure Boot certificate expiration and CA updates - Microsoft Support

support.microsoft.com

Is there a consensus that it's important for individuals to deal with this now or just wait till it's something we have to address. And is it absolutly certain that this will in fact happen in 2026 and not be pushed to a later date?

Click to expand...

XxXxX said:

well Microsoft are NOT saying DONT enable any of them
so i have them all enabled just to ensure any available updates are updated.

Best of luck Steve ..

Click to expand...

For devices where test results are available that indicate that the device can process the certificate updates successfully, the updates will be initiated automatically as part of the servicing updates. This policy is enabled by default. For enterprises that desire managing automatic update, use this policy to explicitly enable or disable the feature.

Click to expand...

XxXxX said:

i have put this together as i had problems updating 2 desktops and 3 laptops.
which have now all had their Secure Boot Certs updated to the new 2023 secure boot cert
also the other post about this were getting very long and confusing.
this is in two parts. part A and part B.
edit by me. please note, your system must be online for part A to update

Part A.
open a PowerShell as Admin
then copy and paste these two commands in this order.
thanks to @Brink tutorial.

1.


then press enter

2.


press enter and now restart your computer TWICE

##### to check that the 2023 cert is now available #####
to check that the 2023 cert is available after the 2 restarts
open a PowerShell as Admin copy and paste this command

the result of the command should show as 'True'

and then open the Windows registry to this key
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

in the right window you will see ..
UEFICA2023Status which will show 'updating'
WindowsUEFICA2023Capable 0x00000001

close the registry and you can now begin part B.

######

Part B.
open a CMD Prompt as Admin
then copy and paste this command
thanks to @Scott

1. at the CMD Prompt as Admin


press enter and now close the CMD Prompt terminal

then open a PowerShell as Admin

2. within the PowerShell


press enter and restart you computer.

Final Check once the system has restarted
open the registry and find this key (again)
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

in the right Window you will see ..
UEFICA2023Status which will now show 'Updated'
WindowsUEFICA2023Capable 0x00000002


your system is now updated to the new 2023 certs
if this post is in the wrong part of the Forum please move it to the correct one.

edit by me. missed this out .. your system needs to be online for the update to work
best of luck Steve ..

Click to expand...

john1955 said:

I did all the above .
When I first checked WindowsUEFICA2023Capable was 0x00000000 and then changed to WindowsUEFICA2023Capable 0x00000001 as expected but when I entered
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update" it showed "The operation completed successfully"
but it did not change the DWORD to 0x00000002 as it should have.



View attachment 162122

Click to expand...

HeavyHemi said:

This maybe completely unrelated but I figured setting all three these as configured would be harmless as a test...so off I went setting all three to configured. Then rebooted. I was in the process of checking for any error messages in event viewer when I got a nvlddmkm 153, or GPU driver error. I have to tell you, seeing random characters speckled across the screen got my heart rate up. I've not had one of those errors in literally years. Ran a couple of games and stress tests with GPU pulling up to ~450 watts and solid as a rock. I don't believe in such coincidences, but I don't see how they could possibly be related.

Click to expand...

fg2001gf11F said:

This is one of the 3, when enabled is blocking the Automatic Deployment. The description below is confusing.

View attachment 162120

Click to expand...

XxXxX said:

you can run Part B again as the settings auto update every 12 hours
running Part B .. First command in an Admin CMD prompt >> Second command in Admin PowerShell
will attempt to do the update manually there and then instead of waiting every 12 hours.

sometimes it can take several attempts of Part B and restarts for the system to update
some have found leaving the system over night and then checking again results in the system being updated.

best of luck Steve ..

Click to expand...