Do this and post the picture of the report here in your thread:

https://www.dell.com/community/en/conversations/xps-desktops/xps-8930-purchased-2018-2023-secure-boot-certificates/699cdb010daada5e7a6c379f?commentId=6a1a2ebe5e24e611a5a521fc

I'll take a look at it for you and advise.

Edit:

Yeah, you need to running the latest published BIOS-Firmware for your computer. And I think Windows-11 as we are not really doing all this work for computers locked-back-at Windows-10. Of course, computer must be UEFI-class.

No, there's no way to fit an external TPM -- if the system doesn't have the TPM (and if this is the 2012-vintage 7020, even if it does it's so far out of date it's essentially useless for Windows 11), that cannot be added.

Dell won't have updates including the 2023 secure boot certificates.  You may or may not be able to add them manually -- see

https://www.dell.com/support/kbdoc/en-us/000473343/windows-secure-boot-certificate-ca23-update-service-guidance

Hi

Can you please give the current operating system that is running, the current BIOS and the year of manufacture?

Please can you confirm the Make Model and OS, along with any configuration details like touch screen, backlit keyboard, SFF or tower etc etc.

hello dear

thanks for your reply.

would you please, which tool i should use to share needed report? and wish it could be accessible with screenreader.

and could i just coppy info not share as image?

system info:

[System Summary]

OS Name Microsoft Windows 10 Pro 
Version 10.0.19045 Build 19045 
System Manufacturer Dell Inc. 
System Model OptiPlex 7020 
System SKU 05A5 
Processor Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz, 3201 Mhz, 4 Core(s), 4 Logical Processor(s) 
BIOS Version/Date Dell Inc. A09, 5/18/2016 
SMBIOS Version 2.7 
Embedded Controller Version 255.255 
BIOS Mode UEFI 
BaseBoard Manufacturer Dell Inc. 
BaseBoard Product 08WKV3 
BaseBoard Version A01 
Secure Boot State On 
PCR7 Configuration Binding Not Possible 

  thanks

@anne_droid​ hello 

thanks for your reply

[System Summary]

OS Name Microsoft Windows 10 Pro 
Version 10.0.19045 Build 19045 
System Manufacturer Dell Inc. 
System Model OptiPlex 7020 
System SKU 05A5 
Processor Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz, 3201 Mhz, 4 Core(s), 4 Logical Processor(s) 
BIOS Version/Date Dell Inc. A09, 5/18/2016 
SMBIOS Version 2.7 
Embedded Controller Version 255.255 
BIOS Mode UEFI 
BaseBoard Manufacturer Dell Inc. 
BaseBoard Product 08WKV3 
BaseBoard Version A01 
Secure Boot State On 
PCR7 Configuration Binding Not Possible 

let me know if you need another info.

  thanks

Hi

Thank for the info, more pieces in the blank jigsaw I have for a brain.

There are newer BIOS versions....

Hi

Hopefully if you run some updates of the BIOS then maybe there will be MS updates that will install your certificates.

If in doubt please ask.

For a Dell OptiPlex 7020 Tower, you generally do not manually “install Microsoft Windows 10 2023 certs” in Windows itself; Dell says the right path is to keep the BIOS updated so the platform receives the new Secure Boot certificates in firmware/default Secure Boot databases, while Microsoft is also rolling updates out through Windows Update in phases.

What to do

1. Update Windows 10 fully through Windows Update. Microsoft’s rollout is staged, so supported systems may receive the Secure Boot certificate update automatically.

2. Update the OptiPlex 7020 Tower BIOS from Dell Support. Dell specifically recommends keeping BIOS current so the 2023 Secure Boot certificate is present in the default Secure Boot database.

3. After the BIOS update, check Secure Boot status in Windows and verify whether the newer trust configuration is present. Dell and Microsoft both indicate that firmware level matters for this transition.Important note

A “manual certificate install” is not the normal end-user method for this issue on a home or small-business PC; the supported approach is Windows Update plus Dell firmware/BIOS updates.

Dell-specific path

• Go to the Dell support page for the OptiPlex Tower 7020 and install the latest BIOS.         dell

• Read the BIOS release notes carefully for wording like “This BIOS contains the new 2023 Secure Boot Certificates.” Dell says that phrase may appear in driver details for affected updates.               

•  dell

• If the machine is BitLocker-protected, suspend BitLocker before the BIOS update, then re-enable it afterward. This is standard practice for firmware changes, though Dell’s Secure Boot articles emphasize keeping firmware current rather than manually editing certificates.  

• dell

@anne_droid​ hello dear

thanks for your reply.

now i should download latest bios update or update all of them from older to newer?

also, when using dell command update doesn't suggest to update bios, why?

another question, Once I try to scan hardware from support assist  hearing high sound of fans is it normal? 

is dell service tag unique one  or the same for many devices.

  thanks very much

Hi

The service tag is unique to your device.

I suggest an interim BIOS update if practicable.  Perhaps A15, then A18.

Unfortunately noisy fans are becoming a way of life, but if you feel it is excessive then ask a local repairer for an opinion.