alexspurbeck
Good news — I got it working! Here are the steps that fixed it:
Prerequisites (in BIOS)
- Enter BIOS (press Delete on startup)
- Set Secure Boot to Standard/Windows UEFI mode (not Custom)
- Use Restore Factory Keys to reset to default Microsoft certificates (you may need to first set the mode to custom, restore factory keys, then back to standard)
- Save and boot into Windows
- Verify Secure Boot is active by running
Confirm-SecureBootUEFI in an elevated PowerShell (right click on powershell -> run as admin) — it should return True
Apply the certificate update (elevated PowerShell)
Reset the trigger key, then re-set it:
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" -Name "AvailableUpdates" -Value 0
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" -Name "AvailableUpdates" -Value 0x40
Then fully shut down (don’t just restart), wait 10 seconds, power back on, and once at the desktop, restart once more from within Windows.
Verify it worked
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
If this returns True, you’re done!
Notes:
- The full shutdown (not restart) is important — it forces a proper UEFI handoff that a normal restart skips
- The key trick was resetting the registry value to 0 first before setting it to 0×40; skipping that reset is likely why earlier attempts failed for me
- No custom keys or advanced BIOS configuration needed
