scaramonga
Active Member
- Messages
- 176
- Reaction score
- 46
Right click on your system I found easier, all great here!
Please guide me on Secure Boot what to do?
- Thread starter ttx9
- Start date
- Messages
- 4,049
- Reaction score
- 1,701
2023 machine can boot 2011 and 2023 media until it has blocked the 2011 certificate intentionally (last stage of adoption, can be sped up with an option in the tool).
2011 machine can boot only 2011 media.
The installation itself is not the issue: one install.wim covers all three. Enable the Secure Boot certificate update and each installed OS enrolls the 2023 certificate into its own firmware on first boot.
Only the boot media is one-or-the-other, so two ways:
- ISO: it has its own boot sector. Update the Windows boot manager, then pick 2011 or 2023 boot sector in the Create ISO dialog without remaking the whole image. Applies only when booting the actual ISO
(DVD, VM, Ventoy).
- USB written from files: choose to stay at 2011, the most compatible one unless the machine already blocked it, and for that machine you want only 2023 anyway.
Your Secure Boot state can fall into 1 of 4 different scenarios:
1. Secure Boot is disabled. Any boot file, from any Windows or Linux release (or any EFI-based tool) is eligible to boot.
2. Secure Boot is enabled + CA 2011 is present and trusted. Only CA 2011-signed boot files are trusted. Since CA 2023 isn't enrolled, it's not trusted when Secure Boot is on.
3. Secure Boot is enabled + CA 2011 is present and trusted + CA 2023 is present and trusted. Both signed versions of the signed boot file are trusted, you can switch back and forth between them.
4. Secure Boot is enabled + CA 2011 is present but banned + CA 2023 is present and trusted. Only CA 2023-signed boot files are trusted.
As you can tell, there is no combination that works for everyone. It depends on if the PC's you're working are mostly updated to CA 2023, or haven't been (or cannot be) updated. The universal workaround is always: temporarily disable Secure Boot during the install if you need to, and enable it after you applied any pending updates.
1. Secure Boot is disabled. Any boot file, from any Windows or Linux release (or any EFI-based tool) is eligible to boot.
2. Secure Boot is enabled + CA 2011 is present and trusted. Only CA 2011-signed boot files are trusted. Since CA 2023 isn't enrolled, it's not trusted when Secure Boot is on.
3. Secure Boot is enabled + CA 2011 is present and trusted + CA 2023 is present and trusted. Both signed versions of the signed boot file are trusted, you can switch back and forth between them.
4. Secure Boot is enabled + CA 2011 is present but banned + CA 2023 is present and trusted. Only CA 2023-signed boot files are trusted.
As you can tell, there is no combination that works for everyone. It depends on if the PC's you're working are mostly updated to CA 2023, or haven't been (or cannot be) updated. The universal workaround is always: temporarily disable Secure Boot during the install if you need to, and enable it after you applied any pending updates.
Yeah I want #3 but not as a temporary stage, but permanent, max compatibility. If that is only temporary staging process then I will try to keep #2.
I think I understand the options now, so I let it update boot manager, and then pick the one to use when making an ISO (probably 2011).
If I was to let it revoke/ban the 2011 cert, microsoft would make it so much easier if they wasnt doing that, then I can imagine things like my macrium reflect recovery failing to boot. I dont really want to have to keep going in the bios to toggle secure boot for different boot devices.
Also its good ntlite reports on the host status, I guess I need to put ntlite on every device to see what certs they have installed?
I think I understand the options now, so I let it update boot manager, and then pick the one to use when making an ISO (probably 2011).
If I was to let it revoke/ban the 2011 cert, microsoft would make it so much easier if they wasnt doing that, then I can imagine things like my macrium reflect recovery failing to boot. I dont really want to have to keep going in the bios to toggle secure boot for different boot devices.
Also its good ntlite reports on the host status, I guess I need to put ntlite on every device to see what certs they have installed?
Ok I did potentially break windows but I think I have verified 'bootmgfw.efi' is 2023 signed.
So my local desktop looks like it is booting 2023, and has 2011 not revoked. However I am not entirely convinced as I restored an older EFI backup.
So my local desktop looks like it is booting 2023, and has 2011 not revoked. However I am not entirely convinced as I restored an older EFI backup.
Last edited:
Welcome to the new Secure Boot hassle. In the future, WU will push new versions of the Windows boot manager in the CU (to fix known exploits) and cycle the SVN number in the UEFI's DBX variable to prevent older versions from being used.
The Secure Boot update task will take care of the Windows host for you. It will not remind you, nor update your Macrium or other boot media since it will likely have an older (ie. CA 2011) signed boot file, or have one with a banned SVN. Which means you have to periodically recreate the Macrium or Hasleo boot media after a newer boot manager + SVN is pushed.
There's a PS check script for that.
https://www.elevenforum.com/t/garlins-powershell-scripts-for-updating-secure-boot-ca-2023.43423/
Just read the very first post. You can also visit the GitHub:
https://github.com/garlin-cant-code/SecureBoot-CA-2023-Updates
I have done with as advised in the end.
Only my laptop needed a new certificate in the UEFI, so I accelerated the process to get that deployed, ntlite image now has 2023 bootloader, and its also 2023 on the iso, but as suggested, if I find I need to do in a crunch, I just make new ISO on 2011, and the deploy is set in the image.
Only my laptop needed a new certificate in the UEFI, so I accelerated the process to get that deployed, ntlite image now has 2023 bootloader, and its also 2023 on the iso, but as suggested, if I find I need to do in a crunch, I just make new ISO on 2011, and the deploy is set in the image.
This process will become irrelevant some time after October 2026. The first boot manager fix that ships after October can only be signed by CA 2023, as the CA 2021 has expired.
When that happens any non-updated UEFI cannot take a future 27H? image, or an updated W10/11 image because you won't have a choice on which boot file to copy. For unsupported systems, they will be forced to update or leave Secure Boot permanently disabled.
When that happens any non-updated UEFI cannot take a future 27H? image, or an updated W10/11 image because you won't have a choice on which boot file to copy. For unsupported systems, they will be forced to update or leave Secure Boot permanently disabled.