Secure Boot

You would then be in a position to relatively easily correct that vulnerability when it's discovered, if it's discovered to be a problem in the field.

So how, if I have a fleet of devices, so I've used the Secure Boot tools that we provide to be able to do that.

How could we then interact with the devices in the field? What could we do to audit what we have? How do we audit our fleet? How do we then distribute updates to the fleet when we need to or should we need to in the case of

vulnerability? So we're talking about two, I guess, two discrete pieces of software.

Um, and you know, these are super important.

It talks about early DMA exposure, um, from incomplete IO, MMU, secure boot key problems, all of those issues that I've talked about on the show before, like they just keep adding up.

They just keep coming.

All these components that sit below your operating system have vulnerabilities.

Occasionally going after these areas, and I think that we will continue to see malware exploit this attack surface.

In fact, a more recent strain of malware that I found this week called Sheet Rat.

attacks the secure boot and bootloader pre-operating system layer in that malware.

Yeah, no sheet, huh? So I think as attackers look for better places to hide and persist, these are the areas in which they will do so when other avenues hopefully start to dry up in the OS layer.

Plus, Windows 11 24H2 is getting closer to its end of support.

Microsoft is making some important changes behind the scenes with Secure Boot, and we need to talk about why Windows 11 26H1 probably isn't the update that you think it is.

We'll also check out a tool that can turn one USB drive into an entire repair toolkit.

And later, from the office desk, we're talking about something that can save you a ton of troubleshooting time before a computer even reaches your workbench, a better repair intake process.

Just go ahead and add that Windows version check to that list.

It takes 10 seconds and it can prevent you from handing the customer back a computer that's about to fall out of support.

Next up, Microsoft is continuing a pretty important behind-the-scenes change involving Secure Boot.

Secure Boot certificates originally issued back in 2011 have started reaching their expiration period in 2026.

Um, s- but okay, so here's what, what's actually gonna change.

Memory integrity has always been enabled by default for clean Win 11 installs and so-called secured-core PCs, like, you know, that, that, that ship with Secure Boot, uh, enabled.

Uh, and that's been true ever since the Device Guard days.

And that's why, because it shipped enabled, gamers were frequently turning that off and seeing a performance boost.

He has done very extensive documentation about how just kind of the boot chain works from the time you turn your computer on to how UEFI takes over and what it can boot and where partitions need to live and all that stuff is kind of the place to start with that stuff and then i think he'll probably link off to maybe some other stuff from his documentation here and there when i'm looking at

the refine page he still does blue links for stuff you haven't read and purple links for stuff you have clicked and like the getting refined installing and uninstalling refined using refine configuring the boot manager using efi drivers and managing secure boot all purple links on my those are some of his blog posts that i've read

Yes.

Yes.