Event details
202 Comments
Is there an Official Rollback option incase of any booting issues after updating?
Answered at 43:00
In order to do the secure boot certificates updates, do I need to follow the vendor's steps on updating secure boot certificate? For example, dell has a website that states pre-requisites that it need tpm 2.0 and windows server 2022 or later then able to update the secure boot certificate. Is it necessary to follow or I can proceed to update the secure boot certificate via registry keys or the playbook that you provided?
Answered at 34:00
In response to the answer, this is the website url: https://www.dell.com/support/kbdoc/en-us/000402373/poweredge-server-bios-update-guidelines-for-microsoft-secure-boot-certificates
Is there a tool that can help us to check whether the server is ready for secure boot certificate update also perform the update for us?
Will the clients still boot after June if no steps are taken?
YES.
How do we confirm that a Windows device is actively booting using the Windows Boot Manager signed by the 2023 Secure Boot CA , rather than just having the 2023 certificates present or staged in firmware?
So just to confirm is it "Basic - required" or do we need "full - optional diagnostic data"?
"Basic - required" is enough.
We have an issue where vmware vm servers upgraded via ipu from 2012 to 2024 are failing with a tpm error when running the windows-secure-boot-update scheduled task so they don't get the event id 1808, newer 2022 servers don't have that issue and have the same configuration. None of the servers have tpm enabled in vcenter. Can you confirm that secureboot is enabled by running
Confirm-SecureBootUEFI = True, even though the event id 1808 doesnt show.
Can you share the exact errors you are seeing?
All Secure Boot related events are logged with an event source of TPM-WMI, regardless whether they have a TPM enabled or not.
Can it be that the newer VMs have been created from a VM template that already included the certificates?
The new panel in Windows Security is supposedly released in April LCU, but I don't have the new UI. My secure boot status shows green but i dont have the new certs. Did the update get pulled from the April LCU?
mumraaMicrosoft
have you published published a mandatory DBX enforcement date that is explicitly tied to the 2011 certificate expiry yet? Or can you indicate roughly when this is likely?
Somewhat answered at 38:00
Can you explain more about error event 1795 and 1797? all the necessary prerequisites are met including recommended firmware version and secure boot state enabled
- 1795 usually points at a firmware issue, more details are in the event text
- You should only see 1797 when you manually revoke 2011 cert in DBX but you are still booted from 2011 boot manager. If there are no other error events, this should resolve by rebooting after the 2023 boot manager has been installed.
What are the possible impact after Jun/26 for those devices that were unable to get Certs or updates at all?
The machines will still boot, LCUs will still apply, but any updates to the boot loader or secure boot configuration will no longer be applied.
