Back in late 2021/early 2022, I bought a pair of motherboards for side-by-side PC builds. One for me, one for my son to use at home. I also bought an NVIDIA 3070Ti GPU so he could game away. But that latter plan didn’t turn out because his PC case — an Antec A201 — was too small inside for that GPU. We stuck with our older 1070Ti models because they fit. Just recently, I’ve been working to get Secure Boot running on those PCs. I wasn’t able to get it up on Flo6 (my office desktop, now in a bigger case) until I swapped the 1070 GPU for that 3070 model. I still haven’t been able to get back to UEFI on the upstairs model (his former desktop). That’s why I’m buying newer GPU for RyzenOfc (desktop machine name). Let me explain…
Why Buying Newer GPU For RyzenOfc Could Help
The older 1070Ti has Pascal generation firmware, while the newer 4070 has Ada generation firmware. The 1070 firmware is 11 years old, or thereabouts, and lacks features and capabilities that newer firmware environments — including UEFI, TPM and Secure Boot — need. Copilot put a feature table that lays things out nicely for easy perusal and comparison.
Basically, I was unable to get past the graphics output protocol (GOP) phase during boot-up with the 1070 installed. The PC froze there every time. I could still get to Windows (straight to the lock screen, in fact) but I never could see the Asrock initial boot-up logo, nor could I use Del or F2 to get into UEFI.
Can’t Do Secure Boot Except via UEFI
That last little bit is a dealbreaker. If I can’t get into UEFI, I can’t turn secure boot on. Nor can I load the default Secure Boot keys, essential to resetting TPM to let the whole Secure Boot infrastructure get put in place. Bit of a problem, that…
So I ordered a used compact NVIDIA 4070 GPU to replace the 1070Ti. It’s due in next week. And I’m betting a reasonably substantial sum that when I pop the new GPU into the PCIe x16 slot the 1070 currently occupies, I’ll be able to get through Secure Boot installation.
We’ll see: I’ll report back then. Stay tuned, and check your own PCs for status. On older builds you, too, may need to start making some changes. In PowerShell, Confirm-SecureBootUEFI shows “True” if it’s on, “False” if it’s off. Likewise, Get-SecureBootUEFI -Name db will show you if you have the new UEFI CA 2023 certificate installed or not (the old 2011 certificates expire later this year, so it’s time to get ready).
Here in Windows-World the old saw from Roseanne Roseanna-danna often applies: “It’s always something!” And indeed, this time it could be something somewhat costly, as well. Sigh

