Windows does not reinstall the Windows UEFI CA 2023 Secure Boot certificates after the system\u2019s Secure Boot certificate databases have been reverted to the older 2011 certificate set.<\/p>\r\n
The system was previously updated to boot using the Windows UEFI CA 2023 certificates. However, the firmware Secure Boot certificate databases were later restored or reverted to the 2011 certificate set.<\/p>\r\n
As a result, the system may still contain 2023-signed Windows boot files, but the firmware no longer trusts the Windows UEFI CA 2023 certificate required to boot those files with Secure Boot enabled.<\/p>\r\n
When attempting to run the Secure Boot certificate update again:<\/p>\r\n
Shortly afterward, The Windows UEFI CA 2023 certificates are not restored.<\/p>\r\n<\/li>\r\n<\/ul>\r\n Temporarily restore Windows boot files signed by the 2011 certificate set, enable Secure Boot, and then run the Windows Secure Boot update process again.<\/p>\r\n At minimum, restore the 2011-signed versions of the following files:<\/p>\r\n One way to do this from Windows is to use TBOSDT.<\/p>\r\n Start TBOSDT as an Administrator.<\/p>\r\n Change to aggressive locking:<\/p>\r\n List the hard drives to find the drive containing the EFI System Partition:<\/p>\r\n Continue checking drives as needed. Locate the partition with a type similar to:<\/p>\r\n Note the partition ID shown in parentheses. This ID is needed to mount the EFI System Partition.<\/p>\r\n For example, if the EFI System Partition is on hard drive Make backup copies of the existing boot files in case they need to be restored later:<\/p>\r\n Copy the 2011-signed Windows boot file from Windows to the EFI System Partition:<\/p>\r\n Unmount the EFI System Partition:<\/p>\r\n Reboot the system and enter the BIOS\/UEFI setup:<\/p>\r\n Enable Secure Boot in the BIOS\/UEFI setup.<\/p>\r\n After restoring the 2011-signed boot files and enabling Secure Boot, boot Windows.<\/p>\r\n From an elevated Command Prompt, run:<\/p>\r\n Reboot the system.<\/p>\r\n After Windows starts again, run the Secure Boot update task a second time:<\/p>\r\n When the update completes successfully, the following registry value should show:<\/p>\r\n Registry location:<\/p>\r\n You may also verify that the Windows UEFI CA 2023 certificate has been restored to the firmware Secure Boot database by running the following command from an elevated PowerShell prompt:<\/p>\r\n Look for an entry for:<\/p>\r\n Do not attempt to complete the Windows UEFI CA 2023 update while the system can only boot with Secure Boot disabled. The system must be able to boot successfully with Secure Boot enabled, using boot files trusted by the current firmware Secure Boot database, before Windows can reliably apply the Secure Boot certificate update.<\/p>\r\n After the Windows UEFI CA 2023 certificates are restored and the update status shows Problem Windows does not reinstall the Windows UEFI CA 2023 Secure Boot certificates after the system\u2019s Secure Boot certificate databases have been reverted to the older 2011 certificate set. Cause The system was previously updated to boot using the Windows UEFI CA 2023 certificates. However, the firmware Secure Boot certificate databases were later restored or […]<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"lsvr_kba_cat":[1817,1780],"lsvr_kba_tag":[],"class_list":["post-7361","lsvr_kba","type-lsvr_kba","status-publish","hentry","lsvr_kba_cat-vista-win7-8-x-10","lsvr_kba_cat-windows"],"_links":{"self":[{"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/lsvr_kba\/7361","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/lsvr_kba"}],"about":[{"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/types\/lsvr_kba"}],"author":[{"embeddable":true,"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/comments?post=7361"}],"version-history":[{"count":3,"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/lsvr_kba\/7361\/revisions"}],"predecessor-version":[{"id":7364,"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/lsvr_kba\/7361\/revisions\/7364"}],"wp:attachment":[{"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/media?parent=7361"}],"wp:term":[{"taxonomy":"lsvr_kba_cat","embeddable":true,"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/lsvr_kba_cat?post=7361"},{"taxonomy":"lsvr_kba_tag","embeddable":true,"href":"https:\/\/www.terabyteunlimited.com\/kb\/wp-json\/wp\/v2\/lsvr_kba_tag?post=7361"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}AvailableUpdates<\/code> is reset to 0<\/code>.<\/p>\r\n<\/li>\r\n\tUEFICA2023Status<\/code> is briefly set to InProgress<\/code>.<\/p>\r\n<\/li>\r\n\tUEFICA2023Status<\/code> returns to NotStarted<\/code>.<\/p>\r\n<\/li>\r\n\tSolution<\/h2>\r\n
\EFI\Boot\bootx64.efi\r\n\EFI\Microsoft\Boot\bootmgfw.efi\r\n<\/code><\/pre>\r\nRestoring the 2011-Signed Boot Files with TBOSDT<\/h2>\r\n
set option locking 2\r\n<\/code><\/pre>\r\nlist hd 0\r\nlist hd 1\r\n<\/code><\/pre>\r\nEFI System (FAT-32)\r\n<\/code><\/pre>\r\n0<\/code> and has partition ID 01<\/code>, mount it with:<\/p>\r\nmount 0: 0 0x01\r\n<\/code><\/pre>\r\ncopy 0:\efi\boot\bootx64.efi 0:\efi\boot\bootx64_org.efi\r\ncopy 0:\efi\microsoft\boot\bootmgfw.efi 0:\efi\microsoft\boot\bootmgfw_org.efi\r\n<\/code><\/pre>\r\ncopy \/y c:\windows\boot\efi\bootmgfw.efi 0:\efi\boot\bootx64.efi\r\ncopy \/y c:\windows\boot\efi\bootmgfw.efi 0:\efi\microsoft\boot\bootmgfw.efi\r\n<\/code><\/pre>\r\numount 0:\r\n<\/code><\/pre>\r\nreboot \/b\r\n<\/code><\/pre>\r\nRun the Windows Secure Boot Update<\/h2>\r\n
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot \/v AvailableUpdates \/t REG_DWORD \/d 0x5944 \/f\r\nschtasks \/Run \/TN \"\Microsoft\Windows\PI\Secure-Boot-Update\"\r\n<\/code><\/pre>\r\nschtasks \/Run \/TN \"\Microsoft\Windows\PI\Secure-Boot-Update\"\r\n<\/code><\/pre>\r\nVerification<\/h2>\r\n
UEFICA2023Status = Updated\r\n<\/code><\/pre>\r\nHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing\r\n<\/code><\/pre>\r\nGet-SecureBootUEFI -Name db -Decoded\r\n<\/code><\/pre>\r\nWindows UEFI CA 2023\r\n<\/code><\/pre>\r\nNotes<\/h2>\r\n
Updated<\/code>, Windows can again install and use the 2023-signed Windows boot files.<\/p>","protected":false},"excerpt":{"rendered":"