KEK Management

The KEK (Key-exchange Key or Key Enrollment Key) manages the Signature database (db) and Revoked Signature database (dbx).

Key-exchange Key (KEK) refers to Microsoft® Secure Boot Key-Enrollment Key (KEK).

Delete KEK

Allows you to delete the KEK from your system. Once the KEK is deleted, the db and the dbx cannot be updated in the operating system.

Load Default KEK

Select Yes to load the system default KEK or select No to load a downloaded KEK from a USB storage device.

Append Default KEK

Select Yes to append the system default KEK or select No to append a downloaded additional KEK from a USB storage device for the db and dbx management.

The KEK file must be formatted as a UEFI variable structure with time-based authenticated variable.

DB Management

The db (Authorized Signature database) lists the signers or images of UEFI applications, operating system loaders, and UEFI drivers that you can load on the single computer.

Delete the db

Allows you to delete the db file from your system. Doing so may cause boot failures.

Load Default db

Select Yes to load the system default db or select No to load a downloaded db from a USB storage device.

Append Default db

Select Yes to append the system default db or select No to append a downloaded additional db from a USB storage device to load certain customized UEFI executable files.

• The db file must be formatted as a UEFI variable structure with time-based authenticated variable.

•UEFI executable files include UEFI boot devices, drivers and applications.

3 Chapter

3-54

Chapter 3: BIOS setup