How to manually install Security Keys on my my Windows 11 PC?

Authorized TimeStamps and OsRecovery Signatures are not user‑installable items on a Windows 11 home PC. They are part of the Secure Boot certificate and key ecosystem that OEMs, firmware vendors, and Microsoft manage through UEFI Secure Boot variables (PK, KEK, db, dbx) and firmware/Windows updates, not something that can be manually added like normal certificates.

For a home device that is showing Secure Boot–related errors (such as Event 1801) and instability, the supported remediation path is to repair or reset the Secure Boot configuration rather than trying to manually install specific keys:

1. Reset Secure Boot keys to factory defaults in firmware (UEFI/BIOS)
   • Enter the device’s UEFI/BIOS setup.
   • Locate the Secure Boot section.
   • Use the option to Reset Secure Boot keys to factory defaults (do not use “Clear”; the goal is to restore the OEM’s default PK/KEK/db/dbx set).
   • Save changes and reboot.
     This restores the OEM‑provided Platform Key (PK), Microsoft KEK, db, and dbx that Windows relies on.
2. If the system will not boot or remains unstable, use the documented recovery procedure
   The supported recovery sequence for Secure Boot/boot‑manager issues is:
   • Turn off Secure Boot in UEFI/BIOS.
   • Reset Secure Boot keys to factory defaults (if available).
   • Boot Windows and repair the EFI system partition from an elevated Command Prompt:

          mountvol S: /s
          del S:\*.* /f /s /q
          bcdboot %systemroot% /s S:
     

   • Reboot and confirm Windows starts normally.
   • If this fails, reinstall Windows from recovery media, then re‑enable Secure Boot.
   • Finally, re‑enable Secure Boot in UEFI/BIOS.
3. Ensure the standard Microsoft Secure Boot objects are present
   On correctly configured systems, the following are present in the UEFI Secure Boot variables and are sufficient for Windows to boot and for Secure Boot to function:
   • Platform Key (PK) from the OEM.
   • Microsoft Corporation KEK 2K CA 2023 in KEK.
   • Windows UEFI CA 2023 in db (required for the Windows boot loader to be trusted).
   • A valid dbx (forbidden signatures) from Microsoft.
     These are provided by the OEM firmware and Microsoft updates; they are not manually installed by end users.
4. If Event 1801 persists after resetting keys
   • Confirm that Secure Boot is enabled and that keys were reset (not cleared).
   • Apply all pending Windows Updates, including any Secure Boot certificate updates.
   • If random reboots continue, investigate other hardware or driver causes; Secure Boot key absence alone is not typically the direct cause of random reboots once the default key set is restored.

There is no supported mechanism on Windows 11 Home for manually adding “Authorized TimeStamps” or “OsRecovery Signatures” as separate keys. The supported and safe approach is to restore the OEM/Microsoft Secure Boot key set and repair the EFI boot files as described.

References:

• Windows Secure Boot Key Creation and Management Guidance
• How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932
• Initialize result object in preparation for checking Secure Boot state