Drive Health Test

Drive health can be determined by investigating the following SMART Attributes, looking at the RAW_VALUE columns.

If it is a traditional mechanical hard drive (HDD):

  5 Reallocated_Sector_Ct
 10 Spin_Retry_Count 
 11 Calibration_Retry_Count 
196 Reallocated_Event_Count 
197 Current_Pending_Sector 
198 Offline_Uncorrectable 
199 UDMA_CRC_Error_Count

223 Load_Retry_Count 

If it is a Solid-State Drive (SSD):

  5 Reallocated_Sector_Ct 
177 Wear_Leveling_Count 
179 Used_Rsvd_Blk_Cnt_Tot 
181 Program_Fail_Cnt_Total 
182 Erase_Fail_Count_Total 
183 Runtime_Bad_Block 
187 Uncorrectable_Error_Cnt 
190 Airflow_Temperature_Cel 
195 ECC_Error_Rate 
199 UDMA_CRC_Error_Count 
235 POR_Recovery_Count 
241 Total_LBAs_Written 

If the drive shows perfect health (i.e. zero for all of the above values, except for the total number of blocks written (241 Total_LBAs_Written)) then it is likely to be a drive in good working order. If the drive has problems, run the manufacturer's diagnostic test to see if it has reached the manufacturer's failure threshold, which could be lower than the drives overall "SMART failure" threshold.   

Threshold Example

The table below illustrates the possible differences between a drive that could pass SMART but fail the manufacturer's test (50 reallocated sectors in the example) or it may pass the manufacturer's test but have definite problems and will likely fail (20 reallocated sectors in the example).

Number of Reallocated Sectors	Drive Health
0	Perfect.
1	The drive has experienced a problem, but the user is unlikely to be impacted.
20	Drive is failing. It is likely to be slow and the user may be impacted.
50 (for example)	Drive may now fail the manufacturer's test.
100 (for example)	Drive now fails its own SMART failure threshold and the BIOS will display a SMART warning, if supported.

 

Enable TPM

Certainly! To enable TPM 2.0 on your PC, follow these steps:

1.        Using the Windows Security app:

○      Press Windows Key + I to open Settings.

○      Go to Update & Security > Windows Security > Device Security.

○      If you don't see a "Security processor" section, your PC may have a disabled TPM. Refer to your PC manufacturer's support information or check how to enable TPM.

○      If you can enable TPM, verify that it's TPM 2.0 by checking the "Security processor details" under Security processor.

2.        Using the Microsoft Management Console (tpm.msc):

○      Press Windows Key + R or select Start > Run.

○      Type tpm.msc and press OK.

○      If you see a message saying a "Compatible TPM cannot be found," your PC may have a disabled TPM. Refer to your PC manufacturer's support information or check how to enable TPM.

○      If you can enable TPM, verify that it's TPM 2.0 by checking the "Specification Version" under TPM Manufacturer Information.

3.        Accessing UEFI BIOS (PC firmware):

○      Restart your PC.

○      During boot, press the key (usually displayed on the splash screen) to enter firmware settings (UEFI).

○      Look for settings related to TPM. It might be labeled as "TPM Device," "TPM Security," or "PTT."

○      Enable TPM and save your settings.

Remember, these settings vary based on your device, so consult your PC documentation or motherboard manual for specific instructions. Once enabled, TPM enhances security features like Windows Hello and BitLocker.

Source:

1.        Enable TPM 2.0 on your PC - Microsoft Support

2.        How to Check If Your Computer Has a Trusted Platform Module (TPM) Chip

3.        How to Enable TPM 2.0 Windows 11: A Step-by-Step Guide for Users

4.        [Notebook/AIO] How can I determine if my computer supports TPM, the TPM ...

5.        How to enable the Trusted Platform Module (TPM) on your PC if it's ...

6.        How to Enable the TPM (Trusted Platform Module) | Dell US

How the old FAT16 file system used in early MS-DOS and Windows PCs became increasingly inefficient as hard drives grew larger.

Key points

·         FAT16 had a limit on the number of disk clusters it could track because it used 16-bit entries in its file allocation table. As hard drive sizes increased, FAT16 had to use progressively larger cluster sizes to manage them.

·         A cluster is the smallest amount of disk space a file can occupy. Even a tiny file uses an entire cluster.

·         On larger FAT16 volumes:

o    A 512 MB partition could use 16 KB clusters.

o    A 1 GB or 2 GB partition could use 32 KB clusters.

o    Later versions could support 4 GB volumes using 64 KB clusters.

·         This created substantial waste space ("cluster slack"). For example, thousands of very small text files could consume hundreds of megabytes because each file occupied a full 32 KB cluster regardless of its actual size.

·         The irony was that buying a larger hard drive could make storage efficiency worse, meaning users lost more of the capacity they had paid for. The article notes that a 1 GB drive in the mid-1990s was extremely expensive, making this particularly frustrating.

The workaround

Users often partitioned their drives into several smaller volumes. Since FAT16's cluster-size limitation applied per partition, smaller partitions could use smaller clusters and waste less space. A 1 GB drive split into four 256 MB partitions could use 8 KB clusters instead of 32 KB clusters.

How it was fixed

·         Microsoft introduced FAT32 with Windows 95 OSR2 in 1996, greatly improving efficiency and allowing much smaller clusters for larger volumes.

·         FAT32 became mainstream with Windows 98.

·         Eventually, NTFS became the standard Windows file system. NTFS still has some cluster slack, but it is far more efficient and can even store some small files directly in the Master File Table (MFT) without allocating separate clusters.

Bottom line: FAT16's design forced cluster sizes to grow as disk sizes increased, causing significant storage waste. Users often had to partition drives to avoid losing capacity until FAT32 and later NTFS solved most of the problems.

MICROSOFT SHARES OFFICIAL WINDOWS 11 GAMING HARDWARE REQUIREMENTS AND RECOMMENDATIONS GUIDE

Microsoft shares official Windows 11 gaming hardware requirements and recommendations guide

Introduction

Microsoft has shared a detailed guide about its hardware recommendations and requirements for a gaming PC on Windows 11 in 2026.

In this guide, we have listed minimum and recommended CPU and GPU specs for Gaming Pc’s

First up, we start with the processor and graphics cards. The company explains in brief how these components help, like for example, the CPU is responsible for handling game physics, logic, draw calls, among others, while the GPU is primarily there for processing all the graphics. It can also immensely help with GPU-based physics like PhysX as we showed recently.

Here are the official CPU and GPU minimum and recommended specs for gaming on Windows 11 in 2026:

Entry-level gaming (1080p, medium settings)

·         CPU: At least a modern quad-core like AMD Ryzen 5 5600 or Intel Core i5-12400

·         GPU: NVIDIA GTX 1660 Super or AMD Radeon RX 6600

Mid-range gaming (1440p, high settings)

·         CPU: 6-core or better, such as AMD Ryzen 5 7600 or Intel Core i5-13600K

·         GPU: NVIDIA RTX 3060 Ti / 4060 Ti or AMD Radeon RX 6700 XT

High-end/4K gaming

·         CPU: 8-core or better, like AMD Ryzen 7 7800X3D or Intel Core i7-13700K

·         GPU: NVIDIA RTX 4080 or AMD Radeon RX 7900 XTX

Monitor Recommendations

Speaking of monitors, here is Microsoft's guidance on how to purchase the ideal monitor for your gaming needs depending on factors like refresh rate, response times, and panel type. It explains:

Refresh rate (Hz): How many times the screen updates per second.

·         144 Hz is a solid baseline for smooth play.

·         165 Hz–240 Hz benefits competitive shooters or fast-action games.

Response time (ms): The time a pixel takes to change color.

·         1 ms–3 ms is ideal for gaming, reducing ghosting and motion blur during fast action.

Panel types:

·         IPS: Excellent color accuracy and wide viewing angles—great all-round choice.

·         VA: Deeper contrast and richer blacks, though slightly slower response than IPS.

·         OLED: Superb contrast and near-instant response,

Conclusion

Microsoft's guide contains more helpful recommendations and tips. You can check it out here on the company's official site.

To see whether your PC has the updated certificates

To see whether your PC has the updated certificates

 

To see whether your PC has the updated certificates, open a PowerShell window using administrator credentials and then run the following command:"

 

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')

 

If the response is True, you're up to date. If the response is False, you need a firmware update. 

 

"Another crucial Windows expiration date is right around the corner for more than a billion PCs. Here's what you need to do now. Last year's end-of-support deadline for Windows 10 was a big test for consumers and IT pros alike. The good news is everyone passed! The bad news is there's another crucial expiration date right around the corner. Every Windows PC designed and built since 2011 supports a feature called Secure Boot. This feature, which is on by default on new PCs sold with Windows 10 and Windows 11, acts as a gatekeeper that allows only trusted software to run at startup. If someone tries to tamper with the operating system or boot from an alternate device, Secure Boot blocks that attempt. All currently supported versions of Windows support Secure Boot, as do an increasing number of Linux distributions, including Ubuntu, Fedora, Linux Mint, OpenSUSE, and a host of others.

 

If you bought a PC in the last 15 years, it almost certainly contains Microsoft-issued KEK and UEFI CA certificates from 2011, which are slated to expire in June 2026. To update those certificates, you need access to the root of trust -- the Platform Key, which is managed by the hardware OEM.

 

If your PC was designed and built by a major OEM (Lenovo, HP, Dell, ASUS, Surface), and you are running a supported Windows version, you should receive the necessary update automatically.

 

According to Microsoft, "For most individuals and businesses that allow Microsoft to manage PC updates, the new certificates will be installed automatically through the regular monthly Windows update process, with no additional action required."

 

Those updates will arrive on almost all PCs running Windows 11 and on PCs running Windows 10 with an Extended Security Updates subscription. You might need a separate firmware update from the PC maker to allow the updated certificates to install.

 

Microsoft says it will be delivering messages about the certificate update status in the Windows Security app.

 

For specialized computers, such as servers and IoT devices, you might need to download and install an update from the device maker.

 

What happens if I don't update those certificates?

According to Microsoft, "When the 2011 CAs expire, Windows devices that do not have new 2023 certificates can no longer receive security fixes for pre-boot components, compromising Windows boot security.... Without updates, the Secure Boot-enabled Windows devices risk not receiving security updates or trusting new boot loaders, which will compromise both serviceability and security."

 

https://support.microsoft.com/en-us/topic/windows-secure-boot-certificate-expiration-and-ca-updates-7ff40d33-95dc-4c3c-8725-a9b95457578e

Windows Secure Boot certificate expiration and CA updates1.docx

Windows Secure Boot certificate expiration and CA updates

The impact of Secure Boot certificate expiration

 

Microsoft is updating the Secure Boot certificates originally issued in 2011 to ensure Windows devices continue to verify trusted boot software. These older certificates begin expiring in June 2026. Devices that haven’t received the newer 2023 certificates will continue to start and operate normally, and standard Windows updates will continue to install. However, these devices will no longer be able to receive new security protections for the early boot process, including updates to Windows Boot Manager, Secure Boot databases, revocation lists, or mitigations for newly discovered boot level vulnerabilities.

Over time, this limits the device’s protection against emerging threats and may affect scenarios that rely on Secure Boot trust, such as BitLocker hardening or third-party bootloaders. Most Windows devices will receive the updated certificates automatically, and many OEMs provide firmware updates when needed. Keeping your device current with these updates helps ensures it can continue receiving the full set of security protections that Secure Boot is designed to provide.

Windows Secure Boot certificate expiration and CA updates

---

Windows Secure Boot certificate expiration and CA updates

What is Secure Boot?

Secure Boot is a security feature in Unified Extensible Firmware Interface (UEFI) based firmware that helps ensure that only trusted software runs during a device's boot (start) sequence. It works by verifying the digital signature of pre-boot software against a set of trusted digital certificates (also known as certificate authority or CA) stored in the device's firmware. As an industry standard, UEFI Secure Boot defines how platform firmware manages the certificates, authenticates firmware, and how the operating system (OS) interfaces with this process. For more details on UEFI and Secure Boot, please see Secure boot.

Secure Boot was first introduced in Windows 8 to protect against the emerging pre-boot malware (also known as a bootkit) threat at that time. As part of platform initialization, Secure Boot authenticates firmware modules before execution. These modules include UEFI firmware drivers (such as Option ROMs), boot loaders, and applications. As the final step of the Secure Boot process, the firmware verifies if Secure Boot trusts the boot loader. Then, the firmware passes control to the boot loader, which in turn verifies, loads into memory, and starts the Windows OS.

Secure Boot defines trusted code through a firmware policy set during manufacturing. Changes to this policy, such as adding or revoking certificates, are controlled by a hierarchy of keys. This hierarchy starts with the Platform Key (PK), typically owned by the hardware manufacturer, followed by the Key Enrollment Key (KEK) (also known as Key Exchange Key), which may include a Microsoft KEK and other OEM KEKs. The Allowed Signature Database (DB) and the Disallowed Signature Database (DBX) determine which code can run in the UEFI environment before the OS starts. The DB includes certificates managed by Microsoft and the OEM, while the DBX is updated by Microsoft with the latest revocations. Any entity with a KEK can update the DB and DBX.

 

Windows Secure Boot UEFI Certificates Expiring June 2026

Windows Secure Boot UEFI Certificates Expiring June 2026

Introduction

For IT administrators responsible for managing Windows devices, a crucial certificate update milestone is coming in June 2026 that could result in degraded security for systems that are not updated. Specifically, the Microsoft certificates that manage UEFI Secure Boot trust will expire, potentially allowing untrusted or malicious software to load on affected machines during system boot.

Secure Boot

Windows Secure Boot is a UEFI firmware security feature that ensures a computer boot only with trusted, digitally signed operating system loaders and drivers, preventing malicious code (such as rootkits or compromised bootloaders) from loading during startup. Introduced with Windows 8, it verifies the cryptographic signatures of boot components against a database of authorized keys, blocking unauthorized or tampered software to protect system integrity from the earliest stages of boot.

Chain of Trust

The UEFI Platform Key (PK) is the ultimate root of trust in Secure Boot. It is a single public key owned by the device manufacturer and stored in firmware. The PK certificate signs the Key Exchange Key (KEK) and grants authority to modify the other Secure Boot databases, such as the allowed database (DB) and the disallowed database (DBX). The DB and DBX contain certificates and signatures for authorized and unauthorized software, respectively.

Microsoft Secure Boot Certificate Expiration

Two crucial Microsoft Secure Boot certificates are set to expire in June 2026. They are:

• Microsoft Corporation KEK CA 2011 (stored in KEK)
• Microsoft UEFI CA 2011 (stored in DB)

In addition, another critical Microsoft Secure Boot certificate expires in October 2026.

• Microsoft Windows Production PCA 2011 (stored in DB)

When these certificates expire, devices may fail to recognize trusted bootloaders, and future Secure Boot policies may not be applied. Updating the certificates ensures continued protection against malicious rootkits and ensures Windows firmware compliance

View Certificate Information

Ideally, administrators could use PowerShell to view these UEFI Secure Boot certificates. Sadly, the output of the Get-SecureBootUEFI PowerShell command is not particularly helpful and does not display any pertinent certificate details.

Get-SecureBootUEFI -Name KEK

 

PowerShell Script

To address this limitation, I’ve created a PowerShell script that allows administrators to view all UEFI certificates, including PK, KEK, and DB certificates, and optionally save them as base64-encoded files. The script is available on GitHub and in the PowerShell gallery.

Install-Script -Name Get-UEFICertificate -Scope CurrentUser

View UEFI Certificates

After downloading the Get-UEFICertificate PowerShell script, run the following command to view the KEK database.

Get-UEFICertificate -Type KEK

In this example, the only KEK certificate is the expiring Microsoft Corporation KEK CA 2011 certificate. Running the command and specifying the DB type shows only the expiring Microsoft Windows Product PCA 2011 certificate.

Note: UEFI also includes hashes of specific executables in the DB and DBX databases. By default, this script focuses on UEFI certificates and omits hash calculations for brevity. Use the -IncludeHashes switch to view this information. 

Updating Microsoft UEFI Certificates

With the October 2025 updates, Microsoft introduced new registry keys to enable and monitor the update status of these UEFI Secure Boot certificates.

Status

To begin, administrators can check the status of the update process by reading the value of the UEFICA2023Status registry key.

Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing\ -Name UEFICA2023Status | Select-Object UEFICA2023Status

Update

To initiate the update process, set the value of AvailableUpdates to 0x5944.

Set-ItemProperty -Path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot’ -Name ‘AvailableUpdates’ -Value 0x5944

Next, start the Secure-Boot-Update scheduled task.

Start-ScheduledTask -TaskName ‘\Microsoft\Windows\PI\Secure-Boot-Update’

Once complete, the UEFICA2023Status indicates InProgress.

After a reboot, start the Secure-Boot-Update scheduled task once more. The UEFICA2023Status should indicate that it has been updated (may require one more reboot!).

Updated Certificates

After the update process completes, run the Get-UEFICertificate PowerShell script to confirm that new certificates have been added to UEFI Secure Boot.

Summary

With multiple Microsoft Secure Boot CA certificates expiring in 2026, organizations need to ensure devices are updated to maintain a valid UEFI trust chain. This guide shows how to view existing firmware certificates, apply Microsoft’s Secure Boot CA 2023 updates, and confirm that new KEK and DB certificates have been installed. Completing this process now will ensure devices remain protected from tampered or malicious boot components as the 2026 expiration dates approach.

Additional Information

Windows Secure Boot certificate expiration and CA updates

Registry key updates for Secure Boot: Windows devices with IT-managed updates

Get-UEFICertificate PowerShell Script on GitHub

Get-UEFICertificate PowerShell Script in the PowerShell Gallery

 

Intel 13th Gen CPUs can be tested for degradation

Intel 13th Gen CPU Instability and Degradation Test Checklist

Use this checklist to identify common instability symptoms reported on affected Raptor Lake desktop CPUs, especially K-series models. A failed test or repeated error can indicate a problem, but no single result confirms processor degradation on its own.

Before You Start

Testing can place the processor under sustained heavy load. Save important work, back up critical data, close unnecessary applications, and monitor temperatures throughout each stress test. Stop a test if temperatures exceed the safe operating range for your processor or if the system becomes unstable.

✅ Update to the latest motherboard BIOS containing Intel's microcode fixes. Intel has stated that microcode updates address the voltage-related instability issue affecting certain 13th and 14th Gen desktop processors. [community.intel.com],

Reset the BIOS to stock settings and disable XMP for the initial test sequence. If the system is stable at stock settings, repeat the relevant tests with XMP enabled to determine whether the memory profile contributes to the instability.

✅ Download:

·         Intel® Processor Diagnostic Tool [intel.com],

·         HWiNFO64

·         Cinebench R23 or Cinebench 2024

·         Prime95

 

Before testing, record the CPU model, motherboard model, BIOS version, microcode version, memory configuration, cooling setup, Windows version, and whether XMP is enabled. Use the same configuration for every test so that the results can be compared consistently.

Step 1: Run Intel Processor Diagnostic Tool

Procedure

1.      Launch Intel® Processor Diagnostic Tool.

2.      Allow all tests to complete (typically 3-5 minutes).

3.      Save a screenshot of the results.

Pass Criteria

·         All tests show PASS.

Fail Criteria

·         Any FAIL result.

·         Save screenshots for potential warranty claims. Intel's warranty extension covers eligible processors for up to five years. [community.intel.com],

 

Step 2: Check Idle Behavior

Open HWiNFO sensors and let Windows sit idle for 10 minutes.

Record

·         CPU Package Temperature

·         Vcore/VID

·         Effective Clock

·         WHEA error count

Healthy System

·         Stable temperatures

·         No WHEA errors

·         No unexplained spikes to 100% CPU

Warning Signs

·         WHEA errors occurring at idle

·         Random system freezes

·         Clock-speed fluctuations accompanied by errors

 

Step 3: Single-Core Voltage Test

The Raptor Lake issue is often most visible during lightly threaded loads because boost frequencies and voltage can be highest there.

Procedure

1.      Open HWiNFO.

2.      Run Cinebench Single Core.

3.      Monitor:

o   Maximum Core VID

o   Vcore

o   Temperature

Record

·         Peak voltage

·         Peak temperature

·         Cinebench score

Warning Signs

·         Frequent voltage excursions above ~1.5 V.

·         Excessively high temperatures despite adequate cooling.

 

Step 4: Multi-Core Cinebench Test

Procedure

1.      Run Cinebench Multi-Core.

2.      Complete 3 consecutive runs.

Check For

·         Crashes

·         Application errors

·         Score variation between runs

Healthy System

·         Scores remain consistent (within a few percent).

Suspect System

·         Scores continually decrease.

·         Cinebench crashes or hangs.

 

Step 5: Prime95 Stability Test

Procedure

1.      Launch Prime95.

2.      Select Small FFTs.

3.      Run for at least 1 hour.

Monitor

·         CPU Package Temperature

·         Clock speeds

·         WHEA errors

Healthy System

·         No worker failures.

·         No BSODs.

·         No system freezes.

Degradation Indicators

·         Worker thread errors.

·         BSODs.

·         Reboots.

·         Application crashes.

 

Step 6: WHEA Error Check

After testing:

1.      Open Event Viewer.

2.      Navigate to:

1     Windows Logs 2      └── System

Search for:

1     WHEA-Logger

Healthy

·         Zero hardware errors.

Concern

·         Repeated WHEA 18 or cache hierarchy errors.

 

Step 7: Real-World Gaming Test

Run a demanding game for 1-2 hours.

Examples:

·         Unreal Engine 5 titles

·         Shader compilation-heavy games

Watch for:

·         Crash to desktop

·         Graphics-driver recovery

·         Stutters

·         System reboots

 

Step 8: Compare Performance

Compare your results against typical scores for your CPU model.

For example:

CPU	Approx. Cinebench R23 Multi
i5-13600K	~24,000
i7-13700K	~30,000
i9-13900K	~38,000-40,000

A significantly lower score (10%+ below expected) while temperatures are normal could indicate a problem.

 

Final Assessment

Likely Healthy

✅ IPDT Pass
✅ No WHEA errors
✅ Prime95 stable for 1+ hour
✅ Cinebench scores normal
✅ No crashes in games

Potentially Degraded

⚠️ IPDT failures
⚠️ Frequent WHEA errors
⚠️ Prime95 worker failures
⚠️ Random application crashes at stock settings
⚠️ Instability persists after BIOS update
⚠️ Requires increased voltage or reduced clocks to remain stable