@ECHO OFF @REM Autor:RF @REM Datum:31.01.2025 @REM KB5025885 REM TODO REM reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x40 /f REM 2x Reboot REM REM powershell -command "[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'" REM REM reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x100 /f REM 2x Reboot REM REM mountvol Q: /s && copy "Q:\EFI\Microsoft\Boot\bootmgfw.efi" "%TEMP%\bootmgfw.efi" && mountvol Q: /d REM Signatur von %TEMP%\bootmgfw.efi prüfen REM REM reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x80 /f REM 2x Reboot REM REM powershell -command "[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbx).bytes) -match 'Microsoft Windows Production PCA 2011'" REM REM reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f REM 2x Reboot @ECHO. @ECHO %~nx0 %* REM **************************************************************************** REM Test Administator Berechtigung "%windir%\System32\net.exe" session >nul 2>nul "%windir%\System32\net.exe" session >nul 2>nul REM ECHO ErrorLevel: %errorlevel% IF ERRORLEVEL 1 ( ECHO. ECHO Error: %~nx0 ECHO Administator Berechtigung erforderlich ECHO. Pause Exit /b ) REM **************************************************************************** SETLOCAL SET $CWD=%CD% SET $CERT_OLD=Microsoft Windows Production PCA 2011 SET $CERT_NEW=Windows UEFI CA 2023 SET $OUT=%TEMP%\~%~n0.txt CD /D "%~dp0" REM CD /D "%~1" REM **************************************************************************** ECHO Check new Certificate installed in UEFI db (%$CERT_NEW%) ECHO. > "%$OUT%" powershell.exe -command "[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match '%$CERT_NEW%'" > NUL "%windir%\System32\find.exe" /I "True" "%$OUT%" REM ECHO %ERRORLEVEL% IF "0"=="%ERRORLEVEL%" GOTO :DB_OK REM **************************************************************************** ECHO. ECHO ERROR: new Certificate is not installed in UEFI db. ECHO. SET /P $ANSWER="Do you want to install new Certificate in UEFI db? [Y/N] " IF /I NOT "Y"=="%$ANSWER%" GOTO :ENDE REM **************************************************************************** ECHO. ECHO Add Reg Key ECHO. "%windir%\System32\REG.EXE" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot" /v AvailableUpdates /t REG_DWORD /d 0x40 /f ECHO. ECHO Please reboot twice and run this script again ECHO. GOTO :ENDE REM **************************************************************************** :DB_OK ECHO new Certificate is installed in UEFI db (%$CERT_NEW%). ECHO. REM **************************************************************************** ECHO Check Signature of BootLoader (%$CERT_NEW%) ECHO. "%windir%\System32\mountvol.exe" Q: /S > NUL COPY /Y "Q:\EFI\Microsoft\Boot\bootmgfw.efi" "%TEMP%\bootmgfw.efi" "%windir%\System32\mountvol.exe" Q: /D > NUL "%windir%\System32\find.exe" /I "%$CERT_NEW%" "%TEMP%\bootmgfw.efi" REM ECHO %ERRORLEVEL% IF "0"=="%ERRORLEVEL%" GOTO :BOOT_OK > NUL "%windir%\System32\find.exe" /I "%$CERT_OLD%" "%TEMP%\bootmgfw.efi" IF "0"=="%ERRORLEVEL%" ECHO BootLoader is signed with old Certificate "%$CERT_OLD%" REM **************************************************************************** ECHO. ECHO ERROR: BootLoader is not signed with new Certificate. ECHO. SET /P $ANSWER="Do you want to update the BootLoader? [Y/N] " IF /I NOT "Y"=="%$ANSWER%" GOTO :ENDE REM **************************************************************************** ECHO. ECHO Add Reg Key ECHO. "%windir%\System32\REG.EXE" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot" /v AvailableUpdates /t REG_DWORD /d 0x100 /f ECHO. ECHO Please reboot twice and run this script again ECHO. GOTO :ENDE REM **************************************************************************** :BOOT_OK ECHO BootLoader is signed with new Certificate (%$CERT_NEW%). ECHO. REM **************************************************************************** ECHO Check old Certificate blocked in UEFI dbx (%$CERT_OLD%) ECHO. > "%$OUT%" powershell.exe -command "[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbx).bytes) -match '%$CERT_OLD%'" > NUL "%windir%\System32\find.exe" /I "True" "%$OUT%" REM ECHO %ERRORLEVEL% IF "0"=="%ERRORLEVEL%" GOTO :DBX_OK REM **************************************************************************** ECHO. ECHO ERROR: old Certificate is not blocked in UEFI dbx. ECHO. SET /P $ANSWER="Do you want to blocked old Certificate in UEFI dbx? [Y/N] " IF /I NOT "Y"=="%$ANSWER%" GOTO :ENDE REM **************************************************************************** ECHO. ECHO Add Reg Key ECHO. "%windir%\System32\REG.EXE" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot" /v AvailableUpdates /t REG_DWORD /d 0x80 /f ECHO. ECHO Please reboot twice and run this script again ECHO. GOTO :ENDE REM **************************************************************************** :DBX_OK ECHO old Certificate is blocked in UEFI dbx. ECHO. REM **************************************************************************** REM TODO REM "%windir%\System32\REG.EXE" ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot" /v AvailableUpdates /t REG_DWORD /d 0x200 /f REM **************************************************************************** :ENDE ECHO bye PAUSE CD /D "%$CWD%" ENDLOCAL GOTO :EOF