Enable the revocation. The UEFI Forbidden List (DBX) is used to block untrusted UEFI modules from loading. In this step, updating the DBX will add the “Windows Production CA 2011” certificate to the DBX. This will cause all boot managers signed by this certificate to no longer be trusted.

[Secure Boot] This SSU update replaces the 2011 signed bootmgfw.efi with the 2023 signed bootmgfw.efi if the 2023 PCA is in the DB. Note: This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation.

Note This update is re-released on October 13, 2015, with a smaller boot loader file bootmgfw.efi. Symptoms When this issue occurs, applications that depend on TPM won't function until you reset the TPM lockout. Note You can enter a 48-digit BitLocker recovery key to continue using the computer after TPM is locked out. Cause

It replaces the 2011 signed bootmgfw.efi with the 2023 signed bootmgfw.efi. Be advised of the consequences of resetting the DB or toggling Secure Boot, as this can cause a "Secure Boot violation" issue.

Fixes a "TFTP download failed" error message. You receive this error message when you perform a PXE boot on a client computer that connects to a Windows Deployment ...

Fixes an issue in Windows 7 and in Windows Server 2008 R2 in which the startup process stops at a black screen if the UEFI mode is enabled.

Assume that you start a Pre-Boot Execution Environment (PXE) Extensible Firmware Interface (EFI)-based client computer, and then you connect it to a Windows Deployment Service (WDS) server that is running Windows Server 2008 R2.

The PowerShell script described in this article can be used to update Windows bootable media so that the media can be used on systems that trust the “Windows UEFI CA 2023” certificate.

You try to install a 64-bit version of Windows 7 Service Pack 1 (SP1) or of Windows Server 2008 R2 Service Pack 1 (SP1) on an Extensible Firmware Interface (EFI)-based computer.

When monthly updates are applied to a device in a high-confidence bucket, Windows will automatically apply the certificates to the UEFI Secure Boot variables in firmware.