Solved Update Secure Boot Keys (BIOS Update)

drminer · Oct 22, 2025

JamesSmith said:
I updated to this BIOS and was wondering what to do next. I have 2 links.

Updating Microsoft Secure Boot keys | Windows IT Pro blog

A new Microsoft Windows UEFI CA 2023 will replace the existing Windows Production 2011 CA.

techcommunity.microsoft.com

then this link

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

I haven't run the instructions in link 1 or link 2. I did check to see if I had the 2023 certificates and it said false. I am a bit confused on what to do.

Do I run Sheikh's script? or do I follow instructions in link 1?

I am incredibly confused I only just started reading up on this a week ago.

Thanks,
James.

There are many steps to fully locking down Secure Boot, and some of the steps may make your computer unbootable if done wrong. Here is a summary of the steps:
0. Update to the latest build of Windows 11.
1. Update DB.
2. Install updated bootloader in the EFI partition.
3. Update DBX.
4. Update KEK.
5. Install SVN in firmware.
6. Update all external boot drives with new bootloaders.
7. Revoke 2011 PCA Production certificate in DBX. (This is optional at this point and is the most dangerous step.)
8. Install the latest SKUSiPolicy.P7b file into the EFI partition. (Also, optional. Also, somewhat risky.)

Microsoft has recently released a registry setting that will do Steps 1-4 at one go. But quite often the KEK update fails. The KEK update will only work if your computer is still supported; the manufacturer has to supply an updated file to Microsoft. If your computer is no longer supported, then you have to use a tool called Mosby to create a bootable drive. It wipes out all the Secure Boot keys, including the PK, and replaces them.

Finally, several people on ElevenForum have published Powershell scripts that will check the Secure Boot status of your machine to see if the updates took. It is wise to check after each step.

Word of warning, based on experience: If you reset any Secure Boot keys in the UEFI, then cancel out of any changes, the changes to the Secure Boot keys will still take place. I rendered one computer unbootable this way. Fortunately, Mosby came to the rescue!

JamesSmith · Oct 22, 2025

drminer said:
There are many steps to fully locking down Secure Boot, and some of the steps may make your computer unbootable if done wrong. Here is a summary of the steps:
0. Update to the latest build of Windows 11.
1. Update DB.
2. Install updated bootloader in the EFI partition.
3. Update DBX.
4. Update KEK.
5. Install SVN in firmware.
6. Update all external boot drives with new bootloaders.
7. Revoke 2011 PCA Production certificate in DBX. (This is optional at this point and is the most dangerous step.)
8. Install the latest SKUSiPolicy.P7b file into the EFI partition. (Also, optional. Also, somewhat risky.)

Microsoft has recently released a registry setting that will do Steps 1-4 at one go. But quite often the KEK update fails. The KEK update will only work if your computer is still supported; the manufacturer has to supply an updated file to Microsoft. If your computer is no longer supported, then you have to use a tool called Mosby to create a bootable drive. It wipes out all the Secure Boot keys, including the PK, and replaces them.

Finally, several people on ElevenForum have published Powershell scripts that will check the Secure Boot status of your machine to see if the updates took. It is wise to check after each step.

Word of warning, based on experience: If you reset any Secure Boot keys in the UEFI, then cancel out of any changes, the changes to the Secure Boot keys will still take place. I rendered one computer unbootable this way. Fortunately, Mosby came to the rescue!

That is a lot of information and steps for a person who has moderate knowledge of Windows and computer systems.
I don't think I will be able to complete this process.

I know a lot of people who purchased new PC's this year and none of them know about this secure boot key issue.

Thanks for the steps and list.

Buddywh · Oct 23, 2025

JamesSmith said:
That is a lot of information and steps for a person who has moderate knowledge of Windows and computer systems.
I don't think I will be able to complete this process.

I know a lot of people who purchased new PC's this year and none of them know about this secure boot key issue.

Thanks for the steps and list.

There are two much simpler steps if you want to make it easy:

Run these commands below:

Admin CMD Pormpt:
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

Admin Powershell:
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Then re-start the system; twice to be sure.

This simply instructs Windows to run the automated process for updating all the keys and put in place the 2023 signed boot files. Windows would do this anyway at some point in the future, based on whatever schedule Microsoft has your systems on.

This all comes from, and courtesy of @Scott :

Registry key updates for Secure Boot: Windows devices with IT-managed updates - Microsoft Support

support.microsoft.com

Once finished, you can verify by running Check_Mosby_EFIBootFile.ps1 script. Personally, I'm waiting for Microsoft to revoke the 2011 CA keys (which they've said they will). But if you must I'd strongly suggest you not do so until you've verified your system is running with 2023 signed boot files using this script, or something similar that looks into the EFI partition and examines the actual boot files.

And make sure your system is fully updated, probably on 25h2.

Buddywh · Oct 23, 2025

JamesSmith said:
That is a lot of information and steps for a person who has moderate knowledge of Windows and computer systems.
I don't think I will be able to complete this process.
....

Oh yes... and I forgot this.

Either disable and decrypt any BitLocker'd drives before doing this OR create a USB key drive to recover keys after the updates are done. It may not be necessary, but it's better to be safe with this.

And tell your friends with modern systems to update BIOS to the latest, especially if the update is dated sometime in August of 2025 or later. These updates would quite likely have all the updated keys and then Microsoft will proceed to putting in place the 2023 signed boot files according to their schedule. If your system is relatively modern (last three years or so for sure, but even older quite often) you could likely do the same.

garlin · Dec 31, 2025

drminer said:
There are many steps to fully locking down Secure Boot, and some of the steps may make your computer unbootable if done wrong. Here is a summary of the steps:
0. Update to the latest build of Windows 11.
1. Update DB.
2. Install updated bootloader in the EFI partition.
3. Update DBX.
4. Update KEK.
5. Install SVN in firmware.
6. Update all external boot drives with new bootloaders.
7. Revoke 2011 PCA Production certificate in DBX. (This is optional at this point and is the most dangerous step.)
8. Install the latest SKUSiPolicy.P7b file into the EFI partition. (Also, optional. Also, somewhat risky.)

Microsoft has recently released a registry setting that will do Steps 1-4 at one go. But quite often the KEK update fails. The KEK update will only work if your computer is still supported; the manufacturer has to supply an updated file to Microsoft. If your computer is no longer supported, then you have to use a tool called Mosby to create a bootable drive. It wipes out all the Secure Boot keys, including the PK, and replaces them.

Finally, several people on ElevenForum have published Powershell scripts that will check the Secure Boot status of your machine to see if the updates took. It is wise to check after each step.

Word of warning, based on experience: If you reset any Secure Boot keys in the UEFI, then cancel out of any changes, the changes to the Secure Boot keys will still take place. I rendered one computer unbootable this way. Fortunately, Mosby came to the rescue!

I have released a PowerShell script which performs the last 8 update tasks. Instead of assigning a specific reg value for AvailableUpdates, and waiting an indeterminate delay for the "\Microsoft\Windows\PI\Secure-Boot-Update" task to complete, the script will normally finish in about 2-3 seconds.

You can run the PS check script afterwards to immediately confirm if the update process is completed (or more work is required).

For item 0, the script checks if Windows 10 or 11 has been updated to July 2025 CU. This is the last CU which rolled out any significant changes to the DBXUpdate or DBXUpdateSVN revisions. Whenever WU rolls out a new set of SecureBootUpdate files, the script can be revised to check the minimum Windows build number in order to stay current, and the update script can be re-run again.

garlin's PowerShell scripts for updating Secure Boot CA 2023

Search

Solved Update Secure Boot Keys (BIOS Update)

drminer

Well-known member

Updating Microsoft Secure Boot keys | Windows IT Pro blog

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

My Computer

System One

JamesSmith

Well-known member

My Computers

System One System Two

Buddywh

Well-known member

Registry key updates for Secure Boot: Windows devices with IT-managed updates - Microsoft Support

My Computers

System One System Two

Buddywh

Well-known member

My Computers

System One System Two

garlin

Well-known member

My Computer

System One

Similar threads

Latest Support Threads

Latest Tutorials