Secure Boot

[sec-tester1]

This is about secure boot and getting the KEK to install.  I have about 700 systems that are G9 and G10s.  They have the bios of version 1.12.00 and 1.18.00.  In the bios I have checked 3 of the settings in bios - Windows UEFI CA 2023, Microsoft Option ROM UEFI CA 2023, and Microsoft UEFI CA 2023 on a few test systems.  On one I had all 4 checked which included the Enable MS UEFI CA key.  I put the 5944 in the registry and when I use powershell commands it shows that the 3 certs are updated except for the KEK on all of them.  I thought maybe it was the bios so we updated the bios on 1 to 1.18.01 and it still has not updated the KEK.  Now I know the 1.12.00 and 1.18.0 have been removed.  Are they the issue?  I know in one of the systems I tested with that had 1.12.00 I was able to get everything updated but I was testing and doing removing of the check marks and rebooting and then finally at the end I ran the registry setting and it all updated.  So then I thought it was the order in the way I was doing things but that doesn't seem to matter either on these test systems.  What do I need to do to get the KEK to update on these systems?

[resistencia]

Hi @sec-tester1 

KEK should be installed via Windows Update,  Go to Windows Update, then Update History, then click “Other updates” and see if it's installed : Secure Boot Allowed Key Exchange Key (KEK) Update

What is this “Secure Boot Allowed Key Exchange Key (KEK) Update,” and do I actually need to install ...

[sec-tester1]

I thought the certificates were pushed through the monthly cumulatives not a special update and I thought the KEK had to do with your hardware/bios.

[resistencia]

Once the PC has an updated BIOS, Windows Update sends that update. If the BIOS is not compatible, you will not receive that update. Verify that the computer´s  can be updated and is not restricted by the administrator. You can also perform a forced update.

Windows Secure Boot Key Creation and Management Guidance | Microsoft Learn

[sec-tester1]

Let me ask this then.  Are these HP Bios versions compatible with secure boot U71 01.18.00 and V70 ver 01.12.00 because these systems have had this version of the bios for a while now and they are all up to date with patches.  We have a monthly patching cadence through Tanium.  So shouldn't they have received it.  I know the settings in bios were not turned on for 2023, would that prevent them from getting the update through patching?  I've seen this in other posts 

[resistencia]

I don't know which models this update applies to; you need to specify the full laptop model. It must have the Windows UEFI CA enabled in the BIOS—at a minimum, that setting must be active.

As for why you haven't received that update, you'll really need to look into it yourself with the system administrator.