Check-UEFISecureBootVariables

PowerShell scripts to check the UEFI KEK, DB and DBX Secure Boot variables.

Important

The DBX checking in this script is made for x64 systems. If you are using an x86, arm or arm64 system, it is necessary to replace the *.bin files with ones for your system architecture and edit their filenames in the PowerShell script (Check UEFI KEK, DB and DBX.ps1) accordingly. The *.bin files for various architectures can be obtained from uefi.org/revocationlistfile.

Checking the KEK, DB and DBX variables

Right-click Check UEFI KEK, DB and DBX.cmd and Run as administrator.

Example output:

Note

This script only checks for known Microsoft certificates in the KEK and DB and will not show any other certificates even if they are present. To view all certificates that are present, see Viewing all the UEFI Secure Boot variables below.

Re-applying the Secure Boot DBX updates

If the Secure Boot variables were accidentally reset to default in the UEFI/BIOS settings for example, it is possible to make Windows re-apply the DBX updates that Windows had previously applied. Double-click Apply DBX update (restart required).reg and add the changes to the registry then restart Windows and wait for awhile. The DBX updates should be applied after that.

Deploying Windows UEFI CA 2023 certificate to Secure Boot Allowed Signature Database (DB)

Windows February 13, 2024 cumulative update includes the ability to apply the Windows UEFI CA 2023 certificate to UEFI Secure Boot Allowed Signature Database (DB). To do so, double-click Apply DB update (restart required).reg and add the changes to the registry then restart Windows and wait for awhile. The DB updates should be applied after that. For more information, refer to KB5036210 and Evolving the Secure Boot Ecosystem.

Viewing Secure Boot DB and DBX variable update events

Double-click Show Secure Boot update events.cmd to display all the Secure Boot DB and DBX variable update events. Refer to KB5016061 for details on interpreting the events.

Viewing all the UEFI Secure Boot variables

To display all the UEFI Secure Boot variables in readable format, right-click Show UEFI PK, KEK, DB and DBX.cmd and Run as administrator. All certificates in the PK, KEK and DB variables as well as all hashes in the DBX variable will be displayed.

References

• Windows Secure Boot Key Creation and Management Guidance
• Get-SecureBootUEFI
• Microsoft guidance for applying Secure Boot DBX update (KB4575994)
• KB5016061: Secure Boot DB and DBX variable update events
• KB5036210: Deploying Windows UEFI CA 2023 certificate to Secure Boot Allowed Signature Database (DB)
• Check-Dbx.ps1
• Get-UEFIDatabaseSignatures.ps1
• Only the latest DBX update is needed (1)
• Only the latest DBX update is needed (2)
• UEFI Revocation List File
• Evolving the Secure Boot Ecosystem
• Update the dbx database to add back the same dbx entries as the cumulative update applied