Secure Boot 2023 Certificate Update Status

[rickmurphy]

My Z440 Workstation is in UEFI mode and secure boot is on. The BIOs is M60 v02.61 03/23/2023. The OS is Windows 10 with recent Windows updates.

The following command returned "False" : [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

The following commands continue to return "InProgress" after 24 hours: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Device security displays the message "Secure boot certificate updates are temporarily paused while Microsoft and partners work towards a supported resolution. Contact your device manufacturer."

Please advise on HP's progress as a partner working toward a supported resolution. Please provide instructions on how to proceed with enabling the 2023 secure boot certificates on this Z440.

[NonSequitur777 · Accepted solution]

@rickmurphy,

Your system appears to be affected by the temporary Microsoft/OEM hold on the Secure Boot 2023 certificate rollout rather than by a configuration problem on your workstation.

The Windows Security message, quote: "Secure boot certificate updates are temporarily paused while Microsoft and partners work toward a supported resolution."

-is generated by Microsoft when a device falls into a group for which the certificate update has been intentionally paused while firmware compatibility issues are being addressed. Microsoft states that the update will resume automatically once a supported solution is available.

I would recommend the following:

1. Firstly, update the workstation BIOS from M60 v02.61 to the current v02.62 (SP151054), as Microsoft recommends installing the latest OEM firmware before attempting the Secure Boot certificate update. Firmware updates may include the changes needed to support the new Secure Boot trust configuration.
2. Install all available Windows updates.
3. Reboot the workstation several times after the BIOS update.
4. Re-run your PowerShell command to verify whether Windows UEFI CA 2023 is present.

If the Device Security page still reports that the certificate update is temporarily paused after updating to BIOS v02.62, then there is likely nothing further you can do at this time. The rollout is controlled jointly by Microsoft and the OEM, and Microsoft indicates that affected devices will receive the update automatically once the compatibility issue has been resolved.

Kind Regards,

NonSequitur777

[rickmurphy]

Thanks much NonSequitur777. BIOS now updated to v02.62.  I will watch for Windows updates over the next few days and execute the secure boot commands again. I will check back with HP. Thanks for your expert help. 

[NonSequitur777]

@rickmurphy,

You are most welcome -glad to be of assistance!

Yes, the HP Z440 Workstation remains one of my most favorite legacy upgrade projects, for sure.

Btw, have you upgraded your Z440's TPM 1.2 to TPM 2.0 yet?

Kind Regards,

NonSequitur777