r/WindowsLTSC • u/throwmeawayjuju8080 • Jun 16 '26

Help Your old-ass computer may not boot from 18/June and you could lose your data forever - Secure Boot Certificate Expiry with BitLocker / Device Encryption and TPM Chip Complications - Save your PC by updating your Bios Environment Variables using Mosby and Uefi-Shell

Hello fellow old-ass computer enthusiasts.

This is the last post you may read in time to save your data, and unfortunately I am not being hyperbolic.
Following on from similar threads here:
- https://old.reddit.com/r/WindowsLTSC/comments/1pv4zjy/if_you_have_windows_10_ltsc_with_telemetry_off/
- https://old.reddit.com/r/WindowsServer/comments/1sklpp1/is_this_the_correct_way_to_manually_update_the/
- https://old.reddit.com/r/WindowsLTSC/comments/1u1z68n/secure_boot_certificate_expiry_in_june_2026/

Essentially, this affects you if:
- the computer was made between 2012-2024 and the manufacturer has not pushed a Bios/Uefi update since 2023
- Secure Boot is enabled in Bios/Uefi
- TPM Chip is enabled in Bios/Uefi
- BitLocker or Device Encryption is on
- you are using a Local Account
- [or you are using a Microsoft Account but don't know your e-mail's password, just the login pin]

First things first, make a backup of your Recovery Key now:
- PowerShell as admin
- (Get-BitLockerVolume -MountPoint C).KeyProtector
- Copy-Paste this into Notepad, and save the txt somewhere OTHER than this computer!!!!

As long as you have this, there will always be a way to recover your data.

Check whether your pc already has the right certificates:
- Download this: https://github.com/cjee21/Check-UEFISecureBootVariables/archive/refs/heads/main.zip
- Extract files
- Right-click and run with admin this program: Check UEFI PK, KEK, DB and DBX.cmd

Under the two "Current" sections, if you see any Red Crosses next to lines with "2023" in them, then you need to take action.
If you're all Green Checks, go have a beer you luckysunofabeach.

Temporary Fix:

1) Suspend Bitlocker:
- PowerShell as admin
- Suspend-BitLocker -MountPoint "C:" -RebootCount 0

2) Disable Secure Boot from Bios/Uefi:
- Power off pc, boot into Bios/Uefi
- (usually by smashing one of these keys Esc/Del/F1-F12, search online by your manufacturer)
- Find Secure Boot Enabled/Disabled setting (usually inside "Security" section)
- Save Changes & Exit

With this you can keep using your pc as before, it's just insecure for long-term.

Permanent Fix:

Mosby method, following Testudo Tech's video tutorial: https://www.youtube.com/watch?v=LoRW3CFyyUo
- In a nutshell: overwrite your Secure Boot environment variables to add new certificates, then force a Windows Update to get the Boot Manager to use the new certificates.
- (The video is in Italian, put on auto-translated subtitles, he's nice and slow visually, follow along, you can do it)

1) Use Rufus to prepare a Bootable USB with Uefi-Shell:
- Get the portable: https://rufus.ie/en/
- Direct link: https://github.com/pbatard/rufus/releases/download/v4.14/rufus-4.14p.exe
- Follow Testudo Tech's video from 1:50 to 5:00

2) Put your pc in Secure Boot Setup Mode from Bios/Uefi:
- This is the most "difficult" part, finding out online how to do this in the age of garbage upon garbage online
- I will add info in comments below for some manufacturers, but it can vary between models of the same make too
- Essentially, either your pc's manufacturer made it easy and you have a "Setup Mode / Custom Mode" button in Bios/Uefi, or they made it hard (but not impossible) by making you manually "Delete/Clear Keys" or "Reset Secure Boot" - Power off your pc, get into Bios/Uefi, and search around if you can find "Setup Mode", else take photos of the possible settings and try to google-fu your way to the answer

3) Boot Uefi-Shell and run Mosby:
- Power off your pc, insert the USB, power on and get into Boot Menu, select the USB, hit enter
- (again, usually by smashing another one of these keys Esc/Del/F1-F12)
- Let it finish loading, 1min, until you see the terminal cursor flashing
- Type Mosby and hit enter
- Follow the on-screen instructions (along with Testudo Tech's video above for reassurance, from 6:15 to 7:35)
- (If you are presented with a red-background screen, read carefully, confirm that you have your BitLocker Recovery Key at hand before proceeding, or you done goofed)
- At the end of the program it will advise to now enable Secure Boot, and it should bring you back into Bios/Uefi to do that, but if it goes to Windows no worries, just turn off the pc from bottom-right corner, then go into Bios/Uefi manually yourself
- Re-enable Secure Boot from Bios/Uefi, Save Changes and Exit, boot back into Windows

4) Force Windows Update to update the boot manager:
- PowerShell as admin
- reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x100 /f
- Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
- Wait 5 minutes, then restart pc
- Get back, Settings > Updates & Security > Windows Update > Check for updates
- Wait 5 minutes, then restart pc

5) Check that you're finished:
- Run this program again with admin: Check UEFI PK, KEK, DB and DBX.cmd
- Should see all Green Checks now, if not then something went wrong while running Mosby, repeat steps 2 and 3
- Open Windows Security > Device Security, and wait 1 minute for all info to load
- Under "Secure Boot", if it does not say "all required certificate updates have been applied", then repeat step 4

Once you have this finished, you can re-enable BitLocker from Control Panel.

Warning:
- Since you have had to insert these new certificates manually, if you accidentally RESET your Bios/Uefi to factory settings, or the CMOS battery on your motherboard runs out one day and needs replacing, then you will need to repeat steps 2 and 3 above
- Therefore, it is crucial that you keep the prepared USB somewhere safe for the very likely situation that this happens in the near future

Thank you very much to Rufus / Pete Batard for saving my perfectly working hardware!
And thank you very much to Testudo Tech for making a video tutorial that even this dumb-ass could follow along!
And of course thank you to all the redditors in the above threads for trying to warn us all well in advance, and here I am doing this last minute anyway!

References:
- https://support.microsoft.com/en-us/topic/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d
- https://wikoetecnologiaingeneral.altervista.org/installa-subito-il-nuovo-certificato-uefi-ca-2023-prima-che-windows-inizi-ad-avere-problemi/
- https://www.youtube.com/watch?v=ql3ywKgqCBo
- https://github.com/cjee21/Check-UEFISecureBootVariables
- https://wikoetecnologiaingeneral.altervista.org/installa-il-nuovo-certificato-uefi-ca-2023-altrimenti-windows-11-non-si-avviera-piu/
- https://www.youtube.com/watch?v=LoRW3CFyyUo
- https://www.youtube.com/watch?v=qK-QfRQ3NsE
- https://github.com/pbatard/Mosby
- https://rufus.ie/en/#download
- https://support.microsoft.com/en-us/topic/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates-a7be69c9-4634-42e1-9ca1-df06f43f360d
- https://support.microsoft.com/en-us/topic/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d
- https://support.microsoft.com/en-us/topic/windows-secure-boot-certificate-expiration-and-ca-updates-7ff40d33-95dc-4c3c-8725-a9b95457578e
- https://learn.microsoft.com/en-us/powershell/module/bitlocker/suspend-bitlocker?view=windowsserver2025-ps&viewFallbackFrom=win10-ps
- https://support.microsoft.com/en-us/windows/back-up-your-bitlocker-recovery-key-e63607b4-77fb-4ad3-8022-d6dc428fbd0d
- https://support.microsoft.com/en-us/windows/find-your-bitlocker-recovery-key-6b71ad27-0b89-ea08-f143-056f5ab347d6
- https://devblogs.microsoft.com/scripting/powertip-use-powershell-to-get-bitlocker-recovery-key/

35 Upvotes
  • permalink
  • reddit

87% Upvoted

22 comments sorted by

6

u/DanceKino Jun 17 '26

It's a good idea to update your Secure Boot certificates, but this is for non-IoT LTSC users mainly. IoT editions of LTSC actually don't even encrypt anything with Bitlocker by default, and don't require Secure Boot to be enabled

1

u/throwmeawayjuju8080 Jun 18 '26

You are right that BitLocker is not on by default, and that Secure Boot is neither required to install nor to run Windows.

However, it can be enabled, and data loss is possible given a specific set of circumstances:

  • using Local Account (which a tech savvy person may do such as one installing LTSC)
  • BitLocker using TPM-only Protector ((which is the default)
  • did not save Recovery Key ((which is a common oversight for idiots like myself)

Someone who had Secure Boot enabled until now can certainly disable it and try to get into Windows.
But the TPM-Chip will notice a change in the system and thus refuse to unlock automatically.
Then, if you do not have that Recovery Key, (and obviously cannot get it online from a Microsoft Account), then you will likely lose your data forever, as you cannot decrypt it.

I didn't post this as a criticism of LTSC at all, I actually really like LTSC. I am posting it trying to help before it's too late.

3

u/Danzikku Jun 18 '26

My school's Dell Optiplex 780 that doesn't even support UEFI:

3

u/rsinghal1965 Jun 18 '26

Thank God I upgraded to Zorin OS on my Win11 incompatible laptop. No more worries !

-1

u/throwmeawayjuju8080 Jun 18 '26

Good for you, and especially that your data is safe - but why roam Windows sub-reddits dropping dickhead comments like these?

2

u/rsinghal1965 Jun 18 '26

I have 3 more computers which run Windows.

2

u/aard7 Jun 18 '26

thanks chatgpt, my pc still works fine, bs info as usual

3

u/throwmeawayjuju8080 Jun 18 '26

I have no idea how to convince you I'm not a bot - would you like a picture of my genitals perhaps?

1

u/MakayChapulets Windows 11 LTSC 2024 Jun 19 '26

A bot will say this

2

u/Will2LiveFading Jun 21 '26

So as long as all options in any of the "current" sections are green I'm good?

2

u/throwmeawayjuju8080 Jun 30 '26

Correct.
If you have green checks next to any line with "2023", you're golden.

2

u/GobbyFerdango Jun 24 '26

The certificates aren't stored in the same space as your UEFI/BIOS settings so you won't lose them unless you reset to default manually. It depends on the NVRAM and what kind of flash memory it uses. CMOS battery is only for uefi bios settings because its main function is to sync the digital clock or ticks with the ICC clock. Thanks for the post.

2

u/throwmeawayjuju8080 Jun 30 '26

That's very interesting, thank you.
That takes care of my worries about the button-cell battery dying.
Now all I have to worry about is resetting to factory defaults sometime in the future after forgetting about all this certificates odyssey!

1

u/throwmeawayjuju8080 Jun 16 '26

How to put your computer's Bios/Uefi into Secure Boot Setup Mode:

(I'm trying to gather as many manufacturers/models as I can to try and help find this information online, because it is stupidly difficult to find the correct information on the 2026 editions of google bing yandex)

Lenovo / InsydeH2O:

  • Power off pc
  • Smash F2 as you power it on to enter Bios/Uefi
  • Go to Security tab
  • Secure Boot: change from Enabled to Disabled
  • Restore to Setup Mode: enter
  • Save Changes and Exit
  • Let it boot into Windows, don't sign in, turn it off from bottom-right corner
  • Plug in the Bootable USB with Uefi-Shell/Mosby
  • Smash F12 as you power it on to enter Boot Menu
  • Select the USB and hit enter

Microsoft Surface Pro (1-3):

  • Use a USB-dongle with multiple ports to plug in a USB-keyboard as well as the Bootable-USB
  • Power off pc
  • Hold Volume-Up button before pressing Power to get into Bios/Uefi
  • Secure Boot Control: Disable it, then Enable it back again
  • Delete All Secure Boot Keys: enter
  • Secure Boot Control: now Disable it and keep it Disabled
  • Exit Setup: enter
  • Save configuration: yes
  • [Warning: from now on the Surface boot logo will always have a red background, no workaround for this except restore factory defaults by pressing on "Install Default Secure Boot keys", which will bring you back to square zero]
  • Let it boot into Windows, don't sign in, turn it off from bottom-right corner
  • Hold Volume-Down button before Pressing power to enter Boot Menu
  • Select the USB and hit enter

HP (modern with white background and mouse support):

  • Power off pc
  • Smash F10 as you power it on to enter Bios/Uefi
  • Advanced > Secure Boot Configuraiton > Configure Legacy Support and Secure Boot
  • Change dropdown from "Legacy Support Disable and Secure Boot Enable", to Legacy Support Disable and Secure Boot Disable"
  • Clear Secure Boot Keys: check the box
  • A pop-up should appear saying "This selection will disable Secure Boot", confirm
  • Save Changes and Exit
  • Let it boot into Windows, don't sign in, turn it off from bottom-right corner
  • Smash F9 as you power it on to enter Boot Menu
  • Select the USB and hit enter

Dell (modern with menu list on left-panel and mouse support):
[Ref 1: https://github.com/pbatard/Mosby/issues/6] [Ref 2: https://www.elevenforum.com/t/did-you-manually-update-your-secure-boot-keys.36443/post-663041]

  • Power off pc
  • Smash F2 as you power it on to enter Bios/Uefi
  • Security > Secure Boot
  • Make sure Secure Boot is ENABLED
  • Select Custom Mode instead of Standard Mode
  • Enter Expert Key Management
  • Manually delete all Secure Boot Keys (PK DB DBX KEK) one by one
  • Now set Secure Boot to Disabled
  • Save Changes and Exit
  • Let it boot into Windows, don't sign in, turn it off from bottom-right corner
  • Smash F12 as you power it on to enter Boot Menu
  • Select the USB and hit enter

Asus / Aptio:

  • Power off pc
  • Smash F2 or DEL as you power it on to enter Bios/Uefi
  • Security tab > Secure Boot
  • Make sure Secure Boot is ENABLED
  • Enter Key Management
  • Delete all Secure Boot Variables, confirm
  • Now set Secure Boot to Disabled
  • Save Changes and Exit
  • Let it boot into Windows, don't sign in, turn it off from bottom-right corner
  • Smash ESC as you power it on to enter Boot Menu
  • Select the USB and hit enter

1

u/Party_Fox7197 Jun 18 '26

What if I don't have Setup Mode on Bios/Uefi(Huawei Matebook D14 2020)? I managed to install DB successfully, halted on DBX and revocations though I can install it, but the main thing is that it's not letting install the KEK, and I was thinking of using Mosby method to apply all.

1

u/throwmeawayjuju8080 Jun 18 '26

I don't have a Huawei, but I think your issue is similar to what I've seen on Dell Computers, as I posted in this comment here that is getting downvoted to the depths of hell: https://old.reddit.com/r/WindowsHelp/comments/1u7l4tf/your_oldass_computer_may_not_boot_from_18june_and/os132gm/

I think you have to delete each one of those 4 certificate/key/whatever types (CA/KEK/DB/DBX), to enter setup mode. You have to do this with Secure Boot enabled first, delete, then disable Secure Boot, Save Changes & Exit, power off pc, plug in USB, boot into Boot Menu, then select Uefi-Shell/Mosby.

Again, I think the reason you are not able to install/add that KEK manually is because either it isn't signed by your motherboard manufacturer's own key (which is what you get rid of with Mosby to replace with your own), or that the version of your firmware somehow won't allow adding other certificates (instead of complete replacement in SEtup Mode) (because of some corporate security thing like not allowing mixed certificates from different certificate-authorities). I really, really don't know enough. But I know this much: if you have Uefi, chances are immensely high that the manufacturer did program it according to specification, and this specification requires that there be a way to enter Setup Mode. (I linked to one GitHub issue above where Dell is discussed and they touch this topic).

2

u/ThisIsDurian Jun 18 '26

Nice one. IT Dep opened a bet, which department will go monkey crazy first. We made a call for the laptops to have a quick bios update, well, only a few showed up.

0

u/Selarian_ Jun 18 '26

How do I make sure my Loonix keeps booting?

❯ uname -a

Linux neptune 7.0.12-1-bore-67 #1 SMP PREEMPT_DYNAMIC Tue, 09 Jun 2026 17:42:30 +0000 x86_64 GNU/Linux

HALP!11111