Failures in output

[PetrMa]

Hello,

I have some VMware VM servers with windows OS and on some servers I´ve got a failures in result, for example:
what are the 3 failures in a result?
2026-06-09 (v1.6.5) [AMD64] : FAIL: 3 failures, 440 successes detected

On another server I have the same values in all fields but there is a result with 0 failures.
Is there any way how to get a details of failures please?

HW : VMware, Inc. VMware20,1 - Intel Corporation 440BX Desktop Reference Platform
FW : VMware, Inc. - VMW201.00V.25122066.B64.2512191820 - 19 pro 2025
OS : Windows 11 - 24H2 (Build 26100.33158)

Detected AMD64/X64 UEFI architecture. Ensure that this is correct for valid DBX results.

Secure Boot status: Enabled

Current UEFI PK
√ Windows OEM Devices PK

Default UEFI PK
√ Windows OEM Devices PK

Current UEFI KEK
√ Microsoft Corporation KEK CA 2011 (revoked: false)
√ Microsoft Corporation KEK 2K CA 2023 (revoked: false)

Default UEFI KEK
√ Microsoft Corporation KEK CA 2011 (revoked: false)
√ Microsoft Corporation KEK 2K CA 2023 (revoked: false)

Current UEFI DB
√ Microsoft Windows Production PCA 2011 (revoked: true)
√ Microsoft Corporation UEFI CA 2011 (revoked: false)
√ Windows UEFI CA 2023 (revoked: false)
√ Microsoft UEFI CA 2023 (revoked: false)
√ Microsoft Option ROM UEFI CA 2023 (revoked: false)
√ 137E571F0B818A0F5C323DA27F4AECCF95980C96 (revoked: false)
√ VMware Secure Boot Signing (revoked: false)

Default UEFI DB
√ Microsoft Windows Production PCA 2011 (revoked: true)
√ Microsoft Corporation UEFI CA 2011 (revoked: false)
√ Windows UEFI CA 2023 (revoked: false)
√ Microsoft UEFI CA 2023 (revoked: false)
X Microsoft Option ROM UEFI CA 2023 (revoked: false)
√ 137E571F0B818A0F5C323DA27F4AECCF95980C96 (revoked: false)
√ VMware Secure Boot Signing (revoked: false)

Current UEFI DBX
√ Microsoft Windows Production PCA 2011
2026-06-09 (v1.6.5) [AMD64] : FAIL: 3 failures, 440 successes detected
Windows BootMgr SVN : 9.0
Windows CDBoot SVN : 3.0
Windows WDSMgFw SVN : 3.0
Statistics : 530 SHA256 hashes, 1 X.509 certs, 4 SVNs

Size statistics (Bytes)
PK : 1575
KEK : 3066
db : 9654
dbx : 27203
SetupMode : 1
SecureBoot : 1
dbt : 0 or unable to determine
Total size : 41500
PKDefault : 1575
KEKDefault : 3066
dbDefault : 8151
dbxDefault : 22060
dbtDefault : 0 or unable to determine
Total default size : 34852

[cjee21]

As explained in the pinned issue, failures mean some expected hashes were not found in the DBX variable. It is the result of searching for hashes that are published in the latest release of microsoft/secureboot_objects repository. In other words, as of 9 June (which is not the latest, Microsoft hasn't published the July update publicly), they are 443 vulnerable bootloaders revoked by hash for x64. Only 440 of those hashes are found in that system's DBX variable, 3 were not. So the DBX of that system is not up-to-date.

[PetrMa]

Hi @cjee21

thank you for your explanation and I understand, but why when I have two identical VM servers with the same settings etc. does one show 3 errors and one 0.

Is it possible to find out specific details from some log somewhere what the script doesn't like? I updated today, so DBX should be the same on both, including the result.

[cjee21]

You can use Show Secure Boot update events script to see if any events are logged by Windows. Show UEFI PK, KEK, DB and DBX script can be used to view all the hashes in DBX for manual inspection.

[Fascinated-Viewer]

As explained in the pinned issue, failures mean some expected hashes were not found in the DBX variable. It is the result of searching for hashes that are published in the latest release of microsoft/secureboot_objects repository. In other words, as of 9 June (which is not the latest, Microsoft hasn't published the July update publicly), they are 443 vulnerable bootloaders revoked by hash for x64. Only 440 of those hashes are found in that system's DBX variable, 3 were not. So the DBX of that system is not up-to-date.

How worried should I be if mine says 154 fails.

Also my SVN was saying "not required" but then I followed a Microsoft guide to try and update the default UEFI DB as well as the Default KEK which didn't seem to work but now my SVN says:

Windows BootMgr SVN : 9.0
Windows CDBoot SVN : 3.0
Windows WDSMgFw SVN : 3.0

I am also not able to boot from a USB or any other USB drive. However I can make another partition on the windows drive and use that as a drive to boot from. (Boot from USB is enabled btw) This issue happened after re updating the certificates and deleting random partitions form my USB drive.

To given some context before all this certificates expired non-sense situation happened. I have had lots and lots of secure boot issues with my system such as secure boot disabling itself and entering setup mode after a Bios update and generally lots of strange behaviour such as USBC not working any more but then working again after a fresh windows install (but the other USB A ports worked fine). Keyboard turning off and on again when login in to windows

If you could advise that would be great thanks @cjee21

[cjee21]

How worried should I be if mine says 154 fails.

Then 154 vulnerable bootloaders will still be allowed to boot on your system if they are not revoked by any other means (older Windows Boot Managers can be revoked by revoking the 2011 cert and updating SVN). There is also a known issue with recent Windows versions not applying revocations for CVE-2020-10713; CVE-2020-14308; CVE-2020-14309; CVE-2020-14310; CVE-2020-14311; CVE-2020-15705; CVE-2020-15706; CVE-2020-15707 to the DBX with no response from Microsoft yet.

not able to boot from a USB or any other USB drive

If the SVN is now 9.0 then any USB drive that uses Windows Boot Manager such as Windows installation media will need to be very new with the latest version of Windows Boot Manager to be allowed to boot or else there will just be a security message from the Boot Manager. That's why there is an important note in the readme here at the revocation section. If you have other USB boot issues then I do not know what is going on since you mentioned deleting random partitions and lots of strange behaviour before.

[Fascinated-Viewer]

If the SVN is now 9.0 then any USB drive that uses Windows Boot Manager such as Windows installation media will need to be very new with the latest version of Windows Boot Manager to be allowed to boot or else there will just be a security message from the Boot Manager. That's why there is an important note in the readme here at the revocation section. If you have other USB boot issues then I do not know what is going on since you mentioned deleting random partitions and lots of strange behaviour before.

I've managed to resolve the issues with being unable to use a bootable USB. After I did the manual updates to the firmware using the windows boot manager (bootmgfw) all booted from the USB) the system made a separate partition on the USB automatically and looked like an OS image when It should of only contained the bootmgfw.

I did update the Certificates used by secure boot as well after this (thinking it will help resolve the problems I have been having)

Yesterday I soft locked my system which was very fun (Driver verifier and I couldn't use the USB either), so I just removed the new SSD and installed the manufactures default SSD, then downloaded the Lenovo recovery USB OS then reinstalled the new SSD (after removing the old one as this OS wipes anything connected) ran the software and seems to have fixed any UEFI firmware issues and resolved any changes I manually made.

Lenovo OS seems to use Win 22H2 for some reason so I had to install the new 25H2 but installing this on a new partition on the same USB caused all partitions to be deleted (USB only) not sure why but I tried again with a new partition and wiping the USB.

System seems to be working as it should for now, I guess I just gotta wait for Microsoft to fix their certificate BS. Lenovo seems to be not that bothered in updating the default secure boot certificates unless your an org. :/

Thanks for your advice btw ill prob be a little more careful in future and try not brick my system Lmao