This article describes the protection against the publicly disclosed Secure Boot security feature bypass that uses the BlackLotus UEFI bootkit tracked by CVE-2023-24932, how to enable the mitigations, and guidance on bootable media.

You can use installation media (a USB flash drive or DVD) to install a new copy of Windows, perform a clean installation, or reinstall Windows. To create installation media, go to the software download website, where you'll find step-by-step instructions.

Create a USB recovery drive. Boot Surface from a USB device. Forgot UEFI password for Surface. Learn about Unified Extensible Firmware Interface (UEFI) features and how to access them on Surface Pro 4, Surface Book, and Surface Studio.

Provides guidance for installing a DBX update to fix a vulnerability that exists in some Secure Boot modules if they trust the Microsoft third-party UEFI CA.

The Secure Boot Forbidden Signature Database (DBX) prevents UEFI modules from loading. This update adds modules to the DBX. A security feature bypass vulnerability exists in secure boot. An attacker who successfully exploited the vulnerability might bypass secure boot and load untrusted software.

Microsoft was made aware of a vulnerability with the Windows boot manager that allows an attacker to bypass Secure Boot. The issue in the boot manager was fixed and released as a security update.

Make sure you have a license to install Windows 10, and then follow these steps: On the Windows 10 download page, download the media creation tool by selecting Download now, then run the tool. In the tool, select Create installation media (USB flash drive, DVD, or ISO) for another PC > Next.

This article describes an issue that blocks the detection of the NK.bin file by the boot loader in Windows Embedded Compact 2013. An update is available to fix this issue.

UEFI offers new features including faster startup and improved security. It replaces BIOS (basic input/output system). More recent Surface devices use a new UEFI called Surface UEFI. For more info, including info about which specific devices use it, see How to use Surface UEFI.

Starting your Surface from a USB drive can be useful if you want to change firmware settings or Windows startup settings. Booting from a USB device doesn’t refresh or reset your Surface. Instead, it lets you start your Surface using Windows or another operating system that’s on your USB device.