Secure boot update via Windows update

Hitherto I've made no changes to Secure Boot certificates, belonging firmly to the DO NOTHING group. But this morning received a 'Restart' notification because of a KEK update. The @garlin Check-UEFI script now shows:

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows PCA 2010

EFI Files
---------
Disk 1: Windows Boot Manager [Production PCA 2011] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 1
[Windows UEFI CA 2023] in UEFI DB.

Disk 1: SkuSiPolicy.p7b (for VBS) is WRONG VERSION.

No log entries that I could see apart from Windows Update ->Update History ->Other updates.

This is on a Dell XPS8940 - which hasn't had a BIOS update with new certificates. Windows 11 26200.8037

bob

Considering the device is Windows 11 supported, not surprising. Dell signed off on the KEK, the rest will follow in due course.

xrms3 said:

Hitherto I've made no changes to Secure Boot certificates, belonging firmly to the DO NOTHING group. But this morning received a 'Restart' notification because of a KEK update.

Click to expand...

The script may suggest "DO NOTHING", meaning your BIOS is fully supported for Secure Boot updates.

While the Secure Boot certs can be applied to a live system, it requires a reboot for changes to take effect. This is an expected event, much like Windows needing to restart after a monthly update.

The only pending action is to update the SkuSiPolicy.p7b file. Run these commands as Admin: