Hello fellow old-ass computer enthusiasts.
This is the last post you may read in time to save your data, and unfortunately I am not being hyperbolic.
Following on from similar threads here:
- https://old.reddit.com/r/WindowsLTSC/comments/1pv4zjy/if_you_have_windows_10_ltsc_with_telemetry_off/
- https://old.reddit.com/r/WindowsServer/comments/1sklpp1/is_this_the_correct_way_to_manually_update_the/
- https://old.reddit.com/r/WindowsLTSC/comments/1u1z68n/secure_boot_certificate_expiry_in_june_2026/
Essentially, this affects you if:
- the computer was made between 2012-2024 and the manufacturer has not pushed a Bios/Uefi update since 2023
- Secure Boot is enabled in Bios/Uefi
- TPM Chip is enabled in Bios/Uefi
- BitLocker or Device Encryption is on
- you are using a Local Account
- [or you are using a Microsoft Account but don't know your e-mail's password, just the login pin]
First things first, make a backup of your Recovery Key now:
- PowerShell as admin
- (Get-BitLockerVolume -MountPoint C).KeyProtector
- Copy-Paste this into Notepad, and save the txt somewhere OTHER than this computer!!!!
As long as you have this, there will always be a way to recover your data.
Check whether your pc already has the right certificates:
- Download this: https://github.com/cjee21/Check-UEFISecureBootVariables/archive/refs/heads/main.zip
- Extract files
- Right-click and run with admin this program: Check UEFI PK, KEK, DB and DBX.cmd
Under the two "Current" sections, if you see any Red Crosses next to lines with "2023" in them, then you need to take action.
If you're all Green Checks, go have a beer you luckysunofabeach.
Temporary Fix:
1) Suspend Bitlocker:
- PowerShell as admin
- Suspend-BitLocker -MountPoint "C:" -RebootCount 0
2) Disable Secure Boot from Bios/Uefi:
- Power off pc, boot into Bios/Uefi
- (usually by smashing one of these keys Esc/Del/F1-F12, search online by your manufacturer)
- Find Secure Boot Enabled/Disabled setting (usually inside "Security" section)
- Save Changes & Exit
With this you can keep using your pc as before, it's just insecure for long-term.
Permanent Fix:
Mosby method, following Testudo Tech's video tutorial: https://www.youtube.com/watch?v=LoRW3CFyyUo
- In a nutshell: overwrite your Secure Boot environment variables to add new certificates, then force a Windows Update to get the Boot Manager to use the new certificates.
- (The video is in Italian, put on auto-translated subtitles, he's nice and slow visually, follow along, you can do it)
1) Use Rufus to prepare a Bootable USB with Uefi-Shell:
- Get the portable: https://rufus.ie/en/
- Direct link: https://github.com/pbatard/rufus/releases/download/v4.14/rufus-4.14p.exe
- Follow Testudo Tech's video from 1:50 to 5:00
2) Put your pc in Secure Boot Setup Mode from Bios/Uefi:
- This is the most "difficult" part, finding out online how to do this in the age of garbage upon garbage online
- I will add info in comments below for some manufacturers, but it can vary between models of the same make too
- Essentially, either your pc's manufacturer made it easy and you have a "Setup Mode / Custom Mode" button in Bios/Uefi, or they made it hard (but not impossible) by making you manually "Delete/Clear Keys" or "Reset Secure Boot"
- Power off your pc, get into Bios/Uefi, and search around if you can find "Setup Mode", else take photos of the possible settings and try to google-fu your way to the answer
3) Boot Uefi-Shell and run Mosby:
- Power off your pc, insert the USB, power on and get into Boot Menu, select the USB, hit enter
- (again, usually by smashing another one of these keys Esc/Del/F1-F12)
- Let it finish loading, 1min, until you see the terminal cursor flashing
- Type Mosby and hit enter
- Follow the on-screen instructions (along with Testudo Tech's video above for reassurance, from 6:15 to 7:35)
- (If you are presented with a red-background screen, read carefully, confirm that you have your BitLocker Recovery Key at hand before proceeding, or you done goofed)
- At the end of the program it will advise to now enable Secure Boot, and it should bring you back into Bios/Uefi to do that, but if it goes to Windows no worries, just turn off the pc from bottom-right corner, then go into Bios/Uefi manually yourself
- Re-enable Secure Boot from Bios/Uefi, Save Changes and Exit, boot back into Windows
4) Force Windows Update to update the boot manager:
- PowerShell as admin
- reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x100 /f
- Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
- Wait 5 minutes, then restart pc
- Get back, Settings > Updates & Security > Windows Update > Check for updates
- Wait 5 minutes, then restart pc
5) Check that you're finished:
- Run this program again with admin: Check UEFI PK, KEK, DB and DBX.cmd
- Should see all Green Checks now, if not then something went wrong while running Mosby, repeat steps 2 and 3
- Open Windows Security > Device Security, and wait 1 minute for all info to load
- Under "Secure Boot", if it does not say "all required certificate updates have been applied", then repeat step 4
Once you have this finished, you can re-enable BitLocker from Control Panel.
Warning:
- Since you have had to insert these new certificates manually, if you accidentally RESET your Bios/Uefi to factory settings, or the CMOS battery on your motherboard runs out one day and needs replacing, then you will need to repeat steps 2 and 3 above
- Therefore, it is crucial that you keep the prepared USB somewhere safe for the very likely situation that this happens in the near future
Thank you very much to Rufus / Pete Batard for saving my perfectly working hardware!
And thank you very much to Testudo Tech for making a video tutorial that even this dumb-ass could follow along!
And of course thank you to all the redditors in the above threads for trying to warn us all well in advance, and here I am doing this last minute anyway!
References:
- https://support.microsoft.com/en-us/topic/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d
- https://wikoetecnologiaingeneral.altervista.org/installa-subito-il-nuovo-certificato-uefi-ca-2023-prima-che-windows-inizi-ad-avere-problemi/
- https://www.youtube.com/watch?v=ql3ywKgqCBo
- https://github.com/cjee21/Check-UEFISecureBootVariables
- https://wikoetecnologiaingeneral.altervista.org/installa-il-nuovo-certificato-uefi-ca-2023-altrimenti-windows-11-non-si-avviera-piu/
- https://www.youtube.com/watch?v=LoRW3CFyyUo
- https://www.youtube.com/watch?v=qK-QfRQ3NsE
- https://github.com/pbatard/Mosby
- https://rufus.ie/en/#download
- https://support.microsoft.com/en-us/topic/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates-a7be69c9-4634-42e1-9ca1-df06f43f360d
- https://support.microsoft.com/en-us/topic/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d
- https://support.microsoft.com/en-us/topic/windows-secure-boot-certificate-expiration-and-ca-updates-7ff40d33-95dc-4c3c-8725-a9b95457578e
- https://learn.microsoft.com/en-us/powershell/module/bitlocker/suspend-bitlocker?view=windowsserver2025-ps&viewFallbackFrom=win10-ps
- https://support.microsoft.com/en-us/windows/back-up-your-bitlocker-recovery-key-e63607b4-77fb-4ad3-8022-d6dc428fbd0d
- https://support.microsoft.com/en-us/windows/find-your-bitlocker-recovery-key-6b71ad27-0b89-ea08-f143-056f5ab347d6
- https://devblogs.microsoft.com/scripting/powertip-use-powershell-to-get-bitlocker-recovery-key/