Solved Update Secure Boot Keys (BIOS Update)

gunrunnerjohn · Aug 30, 2025

antspants said:
I can’t read what you were originally responding to on account of my ignore settings.

You should stop ignoring me.

antspants · Aug 30, 2025

gunrunnerjohn said:
You should stop ignoring me.

My wife says that… every 5 min

KevTech · Aug 30, 2025

gunrunnerjohn said:
Just have to read 20 pages of stuff to get to it

If you read my post carefully I pointed out the section to go to so you avoid having to read non-related stuff.

Winuser · Aug 30, 2025

Sheikh said:
No, they are the same. After updating your bios, you can verify new secure boot keys installation with this command in powershell(admin):

Powershell:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’

If it says "true" then you can make sure everything's working fine with the latest updates.

This is an FYI for others that want to run your script and try to use copy and paste. I used copy and paste to run your command in PowerShell and it wouldn't run. I forgot that when using copy and paste the( ' ) gets left out. Once I entered the two ' the script ran and I got a true on my old PowerSpec G156 desktop. I'll check my other computers later. Copy and paste does work in PowerShell ISE.

antspants · Aug 30, 2025

Sheikh said:
No, they are the same. After updating your bios, you can verify new secure boot keys installation with this command in powershell(admin):

Powershell:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’

If it says "true" then you can make sure everything's working fine with the latest updates.

Powershell:

PS C:\Users\essen> [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’
True

Sheikh · Aug 31, 2025

Winuser said:
This is an FYI for others that want to run your script and try to use copy and paste. I used copy and paste to run your command in PowerShell and it wouldn't run. I forgot that when using copy and paste the( ' ) gets left out. Once I entered the two ' the script ran and I got a true on my old PowerSpec G156 desktop. I'll check my other computers later. Copy and paste does work in PowerShell ISE.

It’s better to run this script instead of copy and paste because it restarts twice and creates some temp files which are necessary to be deleted when it finished the job

Winuser · Aug 31, 2025

Sheikh said:
It’s better to run this script instead of copy and paste because it restarts twice and creates some temp files which are necessary to be deleted when it finished the job

I tried it both ways and got the same results. When I hit the enter key it comes up as being True. There is no restart. Where do I look for the Temp files?

Sheikh · Aug 31, 2025

Winuser said:
I tried it both ways and got the same results. When I hit the enter key it comes up as being True. There is no restart. Where do I look for the Temp files?

Batch:

DEL "%TEMP%\CurrentSBKU.txt" /S /F /Q
DEL "%TEMP%\OutputSBKU.txt" /S /F /Q

Winuser · Aug 31, 2025

@Sheikh, I'm now on my newer PowerSpec B746 desktop and ran your script and this computer also came up true so I guess both of my desktops are good to go.

Sheikh · Aug 31, 2025

Winuser said:
@Sheikh, I'm now on my newer PowerSpec B746 desktop and ran your script and this computer also came up true so I guess both of my desktops are good to go.

Yeah, buddy! Enjoy ’em.

gunrunnerjohn · Aug 31, 2025

One thing I don't see is how to invalidate the old 2011 certificate. I just want to make sure that Windows is using the 2023 certificate before I do that!

rezpower · Sep 3, 2025

I just have one little question : Do you think that Microsoft will not do anything and millions of PCs will stop working or this issue will be addressed in one the updates before the due date ?

antspants · Sep 3, 2025

rezpower said:
or this issue will be addressed in one the updates before the due date ?

Yes.

hsehestedt · Sep 3, 2025

Brilliant! Good job, @Sheikh. If I may, I have 2 suggestions:

1) Rather than simply show the user the BitLocker key, you could simply suspend BitLocker for 2 boots in your batch file. That way, it will cause no request for the key.

To do so, run this powershell command early in your batch file (before making the changes):

Suspend-BitLocker -MountPoint "C:" -RebootCount 2

EDIT: Ignore the below comment. I just tested it and powershell doesn't give a hoot about those being Smart Quotes. Maybe that's just a batch file thing.

2) In post number 2 of this thread, the powershell command you show uses single quote marks that are "smart quotes". If I am not mistaken, the powershell command won't like that. Those should be straight quotes rather than Smart quotes. This usually happens in programs such as Word that automatically substitute straight quotes with smart quotes. It's the first thing I turn off when I install Microsoft 365 anywhere .

Sheikh · Sep 4, 2025

hsehestedt said:
To do so, run this powershell command early in your batch file (before making the changes):

Alright I will add this command to make sure bitlocker is suspended during the update. Thank you.

Is there anyway to open bitlocker backup page so users can backup their bitlocker key easier? I think many users can’t find backup option.

I’m afraid of loosing those keys after an update.

hsehestedt · Sep 4, 2025

Sheikh said:
Alright I will add this command to make sure bitlocker is suspended during the update. Thank you.

Is there anyway to open bitlocker backup page so users can backup their bitlocker key easier? I think many users can’t find backup option.

I’m afraid of loosing those keys after an update.

Sorry, I may be simply being a little bit slow here. It is 6:30 AM here and my last dose of caffeine was almost 24 hours ago. Are you asking if you can retrieve the Bitlocker recovery key using command line?

If that is not what you are asking, please clarify for me. But assuming that I understood correctly, yes, you can retrieve the key like this:

manage-bde -protectors -get C:

Here is what that looks like (with important bits redacted):

I hope that helps!

garlin · Sep 4, 2025

Code:

powershell (Get-BitLockerVolume -MountPoint C).KeyProtector.recoverypassword > C:\RecoveryKey.txt

mccmw · Sep 21, 2025

There are a few threads on this topic showing up. I have the Windows UEFI 2023 certificate updated. What about other expiring certificates...specifically KEK and PCA? How do you update those?

garlin · Sep 21, 2025

Every 2011 certificate should get a 2023 equivalent. The names don't exactly match.

Microsoft Corporation KEK CA 2011	Microsoft Corporation KEK 2K CA 2023
Microsoft Corporation UEFI CA 2011	Microsoft UEFI CA 2023
Microsoft Windows Production PCA 2011	Windows UEFI CA 2023

Your motherboard's vendor should be providing KEK 2023 as part of their BIOS updates.

JamesSmith · Oct 22, 2025

thecaretaker said:
I recently updated my Gigabyte Z690 Gaming X BIOS to F31. All working fine. Would I be right in understanding that the updated Secure Boot Keys in the description of the BIOS update means I don't need to update the keys manually before the old ones expire in 2026. Or is that something different?

View attachment 143872

I updated to this BIOS and was wondering what to do next. I have 2 links.

Updating Microsoft Secure Boot keys | Windows IT Pro blog

A new Microsoft Windows UEFI CA 2023 will replace the existing Windows Production 2011 CA.

techcommunity.microsoft.com

then this link

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

I haven't run the instructions in link 1 or link 2. I did check to see if I had the 2023 certificates and it said false. I am a bit confused on what to do.

Do I run Sheikh's script? or do I follow instructions in link 1?

I am incredibly confused I only just started reading up on this a week ago.

Thanks,
James.

Solved Update Secure Boot Keys (BIOS Update)

Well-known member

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computer

Well-known member

My Computers

Like a rolling drone.

My Computers

Software Developer

My Computers

Well-known member

My Computers

Software Developer

My Computers

Well-known member

My Computers

Software Developer

My Computers

Well-known member

My Computers

Well-known member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computers

Software Developer

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

Attachments

My Computers

Similar threads