Technology
Steve Davis
Steve Davis
·Posted in Technology

Secure Boot Certificates Partially Updated – The Fix

Resource

I am writing this in case anyone else runs into the same issues that I did with my Lenovo computer.

I have a ThinkStation P360 Tower, a Yoga laptop and a X1 Carbon. The new 2023 MS Secure Boot certificates for my Yoga and X1 automatically updated last month through the Windows Update process with no intervention by me. However I was not so lucky with my P360.

Yesterday, I was prompted to reboot my computer for an update, which I did. It turns out the update was to insert the new Secure Boot certificates into the BIOS.

I pulled these message from the event viewer:

  • Secure Boot Db update applied successfully

  • Secure Boot DB update to install Microsoft Option ROM UEFI CA 2023 certificate applied successfully

  • Secure Boot DB update to install Microsoft UEFI CA 2023 certificate applied successfully

  • The system firmware returned an error Access is denied. when attempting to update a Secure Boot variable KEK 2023. This device signature information is included here.
    DeviceAttributes: FirmwareVersion:S0EKT62A;OEMManufacturerName:LENOVO;OEMModelSKU:LENOVO_MT_30FM_BU_Think_FM_ThinkStation P360 Tower;OSArchitecture:amd64;
    BucketId: f48972178def83543d451212f4260b650543ab2f1eb099bf4165c6c8fbc07953
    BucketConfidenceLevel: Under Observation - More Data Needed.
    For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931

It also appeared that it was partially successful based on these PowerShell queries:

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI kek).bytes) -match ‘Microsoft Corporation KEK 2K CA 2023’)
False

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’)
True

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbDefault).bytes) -match ‘Windows UEFI CA 2023’)
True

... and in the Device Security area of the Windows Security area.

Registry:
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

I then installed all of the recent Windows updates. Next I checked ThinkVantage and there was a new BIOS update there (released May 8):

1.99 (S0EKT63A)

[New functions or enhancements]
- Enhance BIOS setup support.
- Add new RootCA for Lenovo Cloud
- Add SRWINx64 support to "Restore Factory Keys" remotely.
- Add WMI support to Restore "Restore Factory Keys" remotely.
- Enhancement to address security vulnerability LEN-213045, LEN-213178.

Based on the enhancement list, it appeared that if this firmware update happened before the secure boot certificate update process kicked off, it would likely have succeeded.

However, that was not the case. After the BIOS update, I tried to kick it off again using this PowerShell command:

Set-ItemProperty -Path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot’ -Name ‘AvailableUpdates’ -Value 0x5944

The result was the same with the Access Denied message.

Finally I went to the BIOS and selected “Restore the Factory Keys” in the Secure Boot menu and about 5 minutes after the computer restarted, Windows showed that the secure boot certificates were up to date.

I was at first hesitant to restore the factory keys in the BIOS because I have read messages from others where Secure Boot would no longer work for them after doing that. It worked for me, though.

11
9 replies