Secure Boot Violation on Galaxy Book 3 Pro 360

So, this is the real solution, thanks to Dell and Lenovo forums! Not thanks to Samsung, they have 0 support. No thanks to their AI, it just gave me complete ********. Not thanks to Microsoft, their solution working ONLY if you are forcing UEFI certificated before they expiration date. (****** ********* can't imagine scenario when your secure boot is already disabled exactly because certificates are already expired. And trying to update them using secure boot API). Even Claude was unable to help, he tried to push MS solution which is failing.

Sequence of steps is very important.
1. Disable secure boot. (Obvious, you can't boot otherwise.)
2. You need to delete UEFI partition, at all. If you want to save your data, you can either, mount it, clean it, then recreate it with bcdboot. (Check any guide "how to recreate UEFI partition Windows 11". But be very careful, triple checking partitions and drive letters you about to delte. AND BACKUP EVERYTHING BEFORE!) Or you can just download latest Windows 11 USB image. (Where still no touchpad drivers, and no WiFi drivers, so have WindowsPE driver pack downloaded on USB before installation. So much for Samsung bullshit "we are working close with Microsoft") And then, running new install - delete all partition manually, do not use automatic "I will delete all, trust me". Only this this will bring new certificates to UEFI partition.

3. Reboot, you can allow Windows to finish install, but since UEFI partition is already there probably will work anyway. Just to be sure I waited till Windows update everything before next step. 
4. Go to BIOS (F2) and enable secure boot. Reboot.

5.It will not work; you will get Secure Boot Violation error anyway.

6. Go to BIOS again. Only then, in security you will can change type of secure boot from standard to custom. And then, delete any certificate from submenus (KEK, whatever) you will be allowed to delete. And then use "reset secure boot certificates to factory", switch back to standard - and reboot again. 
This way BIOS get certificates from UEFI partition and Windows will boot into secure mode. 

7. Get some whiskey (better Jameson, because of triple distillation), or just coffee. And think about complete mental degradation of some big companies, and IT overall. It's really a good time to switch to Linux. 

P.S.

I understand that nobody from Samsung will ever read this. But as Louis Rossmann, I want to tell you lots of forbidden here words! 😡 
Samsung always wanted to be "we are better than Apple!". And devices itself - they are good. Like my laptop was better what Apple can offer at those times. But support, comparing to Apple - just non exist. You removed all support emails. In chats you have monkeys. Your AI is hallucinating, telling me about non-existing BIOS updates, which "I can't download directly". You "move all emails queries to web forms" and those webforms are giving error 404. I, as a customer, physically have 0 ways to create a ticket with you. I have 0 ways to somehow even reach level 2 support. I would not start about physical repairs, you have only 3rd party. So, yes, NEVER AGAIN I will buy Samsung laptop or phone.

 

I was going to suggest the Samsung download centre but recently I posted the updates on their are not current.

Was your linked the a Windows update

I don't have experience on galaxy laptops specifically, but I may have an idea on what could be going on.

Sorta recently windows changed the certificate used for secure boot. Windows update should have put the new certificate into the bios of every pc. There might be a chance if your updates are broken, that this never happened, so the bios doesn't know to trust the new key official windows is using.

I don't have much backing to this but that was my thought

This is something way more sinister going on, than I suspected. 😞 I booted from Linux USB and deleted all partitions. Secure boot off. Then installed Windows anew. Then installed only Device Care and tried to update. Of course, written on Visual Basic Device Care found noting.

Majority of drivers and - firmware??? Came from Windows Update.

 

But then - Device Care found couple of drivers and firmware update! Even for touchpad, Yaaaaaau!
Nope! 😞 Yes, directly downloaded file is what it is, but it also not working! Even while DC update, I saw this window:

But it reboots Windows and doing nothing! Laptop just rebooting, BIOS version stays the same, secure boot not working the same. WDF? Eeeprom become read-only? :0 Something else? I'm out of ideas. Also, can't find where bios update log is located, to check what it was. Will try XDA, maybe guys will help. I can live without secure boot, but this is super strange. 

 

So, this was hilarious. I tried to contact Samsung support in UK again and tell them what I think about Samsung products. Then I ask them if they have any level 2 support just to send me foken plain bios update file! O yes! They has one They switched me on some "Brian", but at least it was AI Claude level. It gave me like 5 new ways to try to reset dumb Samsung update and some useful links where I can try to search this FW update manually. Nothing is working so far but YES: Samsung, you clearly can replace all your useless agents with AI, it will work better than your current monkeys.

One lesson learnt - never buy Samsung products again. Even hated by everyone Microsoft Surface has support 10 levels higher than Samsung. 

But have a question to all owners of Galaxy Books 3. Did you guys by any chances have something like: 

ITEM_20240619_22402_WIN_P09ALQ.exe

Should be in Downloads folder. Digits could be different, only P09 or P10 important.