Guide: Manual Secure Boot 2023/2024 Certificate Update for Legacy Systems Like HP EliteBook 8570W (Pure PowerShell)

[akluch]

The Problem: Many older legacy systems (such as Ivy Bridge-generation laptops like the HP EliteBook 8570w) are completely blocked from receiving the modern Windows Secure Boot 2023/2024 certificate updates. Because these older devices have strict NVRAM variable storage limits, Microsoft programmatically flags them with an internal Known Issue block (KI_8 / Temporarily Paused) in the Event Logs, leaving the system silently unpatched or stuck in infinite update retry loops. Manual attempts often hit a brick wall with authentication or access errors due to payload targeting mismatches.

What is special about this recipe: Instead of throwing your hands up or risking a system brick, this recipe bypasses the OS-level blocks by safely splitting the signed payloads and manually appending them to their exact cryptographically matched NVRAM variables (db vs dbx), managing the tight variable space perfectly.

• Broad Adaptability: While this recipe explicitly covers the HP EliteBook 8570w, the same fundamental principles can be adjusted to unblock other legacy hardware facing similar NVRAM or staging limitations.

• 100% Native PowerShell: Done entirely within standard Windows PowerShell.

• Zero Bloat: No third-party tools, no sketchy flashing utilities, and no dangerous BIOS modding required.

• Validated Cleanup: Includes a built-in verification step and a clean sweep script to unmount the EFI partition and wipe temporary footprints when finished.

Below is the complete, field-tested step-by-step recipe to get your machine fully patched, verified, and reporting a clean bill of health in the Event Viewer:

 

RECIPE

Test Environment:
* Hardware - HP EliteBook 8570w
* Firmware - 68IAV Ver. F.71
* Operating System: Windows 11

 

Requirements / prerequisites:
* Latest BIOS version (Ver. F.71 for HP EliteBook 8570w)
* Boot mode: UEFI Native (without CSM)
* Secure Boot supported and enabled
* Disable BitLocker
* Make sure there's a '%WINDIR%\System32\SecureBootUpdates' directory
* Create directory - C:\Temp - temp one, for simplicity
* Copy everything from %WINDIR%\System32\SecureBootUpdates to C:\Temp
* Start 'Windows PowerShell' as Administrator (IMPORTANT: use this version only!!!) 

 

Step 1. Install SplitDbxContent in PowerShell:
- Install-Script -Name SplitDbxContent -Force

 

Step 2. Identify your exact HP KEK update file:
- Run this command in PowerShell: Get-SecureBootUEFI -Name PK -Decoded
- Look for 'SerialNumber' value
- Go to https://github.com/microsoft/secureboot_objects/blob/main/PostSignedObjects/KEK/kek_update_map.json and find KEK file by 'SerialNumber' value above. File specified in "KEKUpdate" (ex. HP/KEKUpdate_HP_PK3.bin)
- Find that file on the left and download it to C:\Temp 

 

Step 3. Update KEK by running the following commands in PowerShell: 
- PowerShell.exe -ExecutionPolicy Bypass -Command "cd C:\temp; & '$HOME\Documents\PowerShell\Scripts\SplitDbxContent.ps1' C:\temp\<bin_file_from_step_2>"  
- Set-SecureBootUefi -AppendWrite -Name KEK -ContentFilePath C:\temp\content.bin -SignedFilePath C:\temp\signature.p7 -Time 2010-03-06T19:17:21Z
- On success you should see something like:
  Name Bytes             Attributes
  ---- -----             ----------
  ...   {...} NON VOLATILE...

 

Step 4. Update DB by running the following commands in PowerShell:
- PowerShell.exe -ExecutionPolicy Bypass -Command "cd C:\temp; & '$HOME\Documents\PowerShell\Scripts\SplitDbxContent.ps1' C:\temp\DBUpdate3P2023.bin"     
- Set-SecureBootUefi -AppendWrite -Name db -ContentFilePath C:\temp\content.bin -SignedFilePath C:\temp\signature.p7 -Time 2010-03-06T19:17:21Z
- On success you should see something like:
  Name Bytes             Attributes
  ---- -----             ----------
  ...   {...} NON VOLATILE...
- PowerShell.exe -ExecutionPolicy Bypass -Command "cd C:\temp; & '$HOME\Documents\PowerShell\Scripts\SplitDbxContent.ps1' $env:windir\System32\SecureBootUpdates\DBUpdate2024.bin"     
- Set-SecureBootUefi -AppendWrite -Name db -ContentFilePath C:\temp\content.bin -SignedFilePath C:\temp\signature.p7 -Time 2010-03-06T19:17:21Z    
- On success you should see something like:
  Name Bytes             Attributes
  ---- -----             ----------
  ...   {...} NON VOLATILE...
  *(Note: If DBUpdate2024.bin fails due to NVRAM space or certificate limits, check for a legacy version or proceed directly to the OROM step below).*
- PowerShell.exe -ExecutionPolicy Bypass -Command "cd C:\Temp; & '$HOME\Documents\PowerShell\Scripts\SplitDbxContent.ps1' $env:windir\System32\SecureBootUpdates\DBUpdateOROM2023.bin"
- Set-SecureBootUEFI -AppendWrite -Name db -ContentFilePath C:\Temp\content.bin -SignedFilePath C:\Temp\signature.p7 -Time 2010-03-06T19:17:21Z
- On success you should see something like:
  Name Bytes             Attributes
  ---- -----             ----------
  ...   {...} NON VOLATILE...

 

Step 5. Update DBX by running the following commands in PowerShell:
- PowerShell.exe -ExecutionPolicy Bypass -Command "cd C:\Temp; & '$HOME\Documents\PowerShell\Scripts\SplitDbxContent.ps1' C:\Temp\dbxupdate.bin"
- Set-SecureBootUEFI -AppendWrite -Name dbx -ContentFilePath "C:\Temp\content.bin" -SignedFilePath "C:\Temp\signature.p7" -Time "2010-03-06T19:17:21Z" 
- On success you should see something like:
  Name Bytes             Attributes
  ---- -----             ----------
  ...   {...} NON VOLATILE...
- PowerShell.exe -ExecutionPolicy Bypass -Command "cd C:\Temp; & '$HOME\Documents\PowerShell\Scripts\SplitDbxContent.ps1' $env:windir\System32\SecureBootUpdates\DBXUpdateSVN.bin"
- Set-SecureBootUEFI -AppendWrite -Name dbx -ContentFilePath C:\Temp\content.bin -SignedFilePath C:\Temp\signature.p7 -Time 2010-03-06T19:17:21Z

 

Step 6. Verify updates by running the following commands in PowerShell (each command should return 'True'):
- ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')                  
- ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI kek).bytes) -match 'Microsoft Corporation KEK 2K CA 2023')    
- ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI pk).bytes) -match 'Microsoft RSA Third Party PCA 2023') 
- ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI pk).bytes) -match 'Hewlett-Packard') 

 

Step 7. Verify you have a boot loader copy properly signed with new certificates, by running the following command in PowerShell:
- [System.Security.Cryptography.X509Certificates.X509Certificate2]::CreateFromSignedFile("$env:windir\Boot\EFI_EX\bootmgfw_EX.efi").Issuer
- You should get back: 'CN=Windows UEFI CA 2023, O=Microsoft Corporation, C=US' 

 

Step 8. Update bootloader by running the following commands in PowerShell:
- mountvol S: /S
- reg save HKLM\BCD00000000 S:\EFI\Microsoft\Boot\BCD.bak /y
- Copy-Item "S:\EFI\Microsoft\Boot\bootmgfw.efi" "S:\EFI\Microsoft\Boot\bootmgfw.efi.bak" -Force
- Copy-Item "$env:windir\Boot\EFI_EX\bootmgfw_EX.efi" "S:\EFI\Microsoft\Boot\bootmgfw.efi" -Force
- mountvol S: /D

 

Step 9. Reboot your machine

 

Step 10. Update the Registry and certificate update task state by running the following commands in PowerShell:
- Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" -Name "AvailableUpdates" -Value 16384 -Type DWord
- Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" -Name "UEFICA2023Status" -Value "Updated" -Type String
- Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" -Name "UEFICA2023Error" -ErrorAction SilentlyContinue
- Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" -Name "UEFICA2023ErrorEvent" -ErrorAction SilentlyContinue
- Stop-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update" -ErrorAction SilentlyContinue
- Disable-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update" -ErrorAction SilentlyContinue
- Enable-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update" -ErrorAction SilentlyContinue

 

Step 11. Reboot your machine

 

Step 12. If all is successful you'll have the following Information log from TPM-WMI in Event Log:
"This device has updated Secure Boot CA/keys. This device signature information is included here.
DeviceAttributes: FirmwareManufacturer:Hewlett-Packard;FirmwareVersion:68IAV Ver. F.71;OEMModelBaseBoard:176B;OEMManufacturerName:Hewlett-Packard;OSArchitecture:amd64;
BucketId: 54e624d808a5b9fbd4f3c1d0a184eeee8a1d0d5cc7238ce8403ed6dd6053bf29
BucketConfidenceLevel: Temporarily Paused
UpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)
For more information, please see https://go.microsoft.com/fwlink/?linkid=2301018."

 

Step 13. Cleanup the files by running the following commands in PowerShell:
- mountvol S: /S
- del S:\EFI\Microsoft\Boot\BCD.bak
- del S:\EFI\Microsoft\Boot\bootmgfw.efi.bak
- mountvol S: /D
- rmdir C:\Temp -Recurse -Force

 

 

 

Note: The recipe is also attached to this message as a TXT file.

HP EliteBook 8570W SecureBoot Certificates Update Steps.txt