Updating Microsoft Secure Boot keys

Topic

New Reply

[Alex5723]

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/updating-microsoft-secure-boot-keys/ba-p/4055324

Microsoft, in collaboration with our ecosystem partners, is preparing to roll out replacement certificates that’ll set new Unified Extensible Firmware Interface (UEFI) Certificate Authorities (CAs) trust anchors in Secure Boot for the future. Look out for Secure Boot database updates rolling out in phases to add trust for the new database (DB) and Key Exchange Key (KEK) certificates. This new DB update is available as an optional servicing update for all Secure Boot enabled devices from February 13, 2024…

Formal DB update steps

Apply the February 2024 (or later) security update.

Open a PowerShell console and ensure that PowerShell is running as an administrator before running the following commands:
Set the registry key to Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot” -Name “AvailableUpdates” -Value 0x40

Run the following scheduled task as Start-ScheduledTask -TaskName “\Microsoft\Windows\PI\Secure-Boot-Update”

Reboot the machine twice after running these commands to confirm that the machine is booting with the updated DB.

To verify that the Secure Boot DB update was successful, open a PowerShell console and ensure that PowerShell is running as an administrator before running the following command: [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’..

* I wonder what can go wrong.

• This topic was modified 1 year, 3 months ago by Alex5723.

2 users thanked author for this post.

RetiredGeek, Fred

Reply | Quote

Replies

Alex5723 wrote:

* I wonder what can go wrong.

Holy Universe,
this is all they give while MODIFYING/TAMPERING the Secured Boot and UEFI ?
Is this a new Tryout and everyone is a GUINEAPIG

Indeed @.Alex5723 “what can/will go wrong” ??

Nice, Microsoft mentions their “EcoSystem-partners”, those terms sell best nowadays, though it’s nothing more than cleaning-up and repairing holes, they Hope.

* _ ... _ *

1 user thanked author for this post.

Alex5723

Reply | Quote

@ Alex5723 I took the liberty to give Microsoft some opinion that they asked for, in a different environment, thus not Askwoody’s

Quote:
This is very bad, tampering with SecuredBoot and UEFI in this way, while most National States Security flaws/break-ins/data-thefts are orientated in this Bootenvironment related structures.
I think it’s a shame you do not give more and better info ABOUT YOUR vulnerabilities.
.
February 15, 2024.

* _ ... _ *

1 user thanked author for this post.

Alex5723

Reply | Quote

Be glad they aren’t rolling it out on Windows update.

I wouldn’t call it “tampering” though.  They are trying to ensure that malcious actors don’t tamper with it.

Susan Bradley Patch Lady/Prudent patcher

1 user thanked author for this post.

Alex5723

Reply | Quote

This has resurfaced and the MS advisory was update on 9/19/24.

Unfortunately, when applying their suggested reg fix for setting AvailableUpdates” to 0x40, after a reboot, the key gets set back to 0.

The computers I’ve tested this on, all same result and have the latest CU’s.

I cant find anything on why it keeps switching the key back to 0.

Reply | Quote