[lostmsu]

Pull the drive out, insert it into his machine, replace, then insert it back.

[mjg59]

And now the signature doesn't match, so the system doesn't boot

[lostmsu]

Which signature?

[mjg59]

The signature that's validated by secure boot. If you don't have secure boot turned on then there's no point in verifying PCR 7, because all PCR 7 contains is the secure boot data.