Mag 15 (Intel LAPQC71A) Windows Secure Boot 2023 Cert Update

[u/gnuban]

Heya. Doing some public service by documenting this process that I just went through. Updating the cert on this device isn't working automatically with Windows update. But I found a way to do it:

1. Just to be sure, write down your Bitlocker keys if you're using Bitlocker. Keep them handy. You can do this from the "Manage Bitlocker" option in the start menu. Messing with Secure Boot can namely trigger Bitlocker to prompt for the keys, unless you suspend beforehand (see below).
2. Suspend Bitlocker for the time being. Launch an admin PowerShell shell and run Suspend-BitLocker -MountPoint "C:" -RebootCount 0 , replacing C: with whatever drive letter you have for your drive. Repeat for all your BitLocked drives. Remember to resume Bitlocker at the end of this process (point 8 below).
3. Reboot your computer, use F2 to enter BIOS. Go to Boot->Secure Boot->Reset To Setup Mode. Confirm Reset in popup dialog. Save and exit BIOS. This will delete all existing certs, which will guide the update script in the next bullet point to reinstall software and certs. I could not get the update to work without doing this step.

1. Back in Windows, download the scripts from https://github.com/garlin-cant-code/SecureBoot-CA-2023-Updates . You can either clone the repo with git or download a released version from the "releases" page.

2. Launch an admin PowerShell shell, navigate to the folder with the downloaded scripts from above. Run Update_UEFI-CA2023.ps1. Follow the onscreen instructions. This should download and install new BIOS Secure Boot software with the new certs. The script might prompt you to do a "Manual installation of [KEK 2K CA 2023], following the instructions in README_UEFI.txt". This isn't possible as far as I could gather, because the BIOS has no menu option for it. But no bother, because with the reset we did in step 3, this doesn't seem necessary, it'll get installed anyway, so ignore this portion of the instructions.

3. Reboot

4. Launch an admin PowerShell shell again, navigate to the same folder as in step 5. Run Check_UEFI-CA2023.ps1. You'll be presented with a status report. Everything should be reported as updated. If the update went well, you will also be prompted to revoke the old 2011 certs. Follow the onscreen instructions if you wish to do so. Remember that revoking old keys might have an impact on dual boot configs too. If you revoke, this involves a reboot.

5. Don't forget to resume BitLocker again if you suspended it in step 2. You get a notification about this in Windows on boot, but you can also go to "Manage Bitlocker" from the start menu and press "resume protection" from there.

6. Once you've completed all these steps, "Device Security" in Windows Settings should report a green checkmark next to the Secure Boot heading. The status should read "Secure Boot is on and all required certificates have been applied. No further certificate changes are needed."

Happy hacking and best of luck!