Solved Finding the UEFI's DBX SVN number using PowerShell

garlin · Dec 4, 2025

The SVN isn't randomly changing after every month's release. To change it is BIG DEAL, and it means a serious security flaw has been discovered which requires invalidating all previous boot managers. It won't be a surprise to anyone who watches Windows news.

Buddywh said:
So what's the impact if SVN isn't the latest?

When the SVN isn't incremented, it allows an older boot manager to continue operating. Which means Windows boots from a file that has a known security hole that puts your system at risk.

Buddywh said:
Not that it really matters in my case since, curiously, mine does report I have Ver. 7.0 yet I didn't follow your process. How did that come to happen if Microsoft didn't push out the latest with Windows Update?

I updated keys with MOSBY, but I did that several weeks ago and before MOSBY was updated to get the latest DBX revocations, which I'd assume to be ver. 7.0 now.

Mosby supports SVN 7.0. A while back, Paul Batard opened a bug on the Secure Boot GitHub to remind them to update some documentation details.

Buddywh · Dec 4, 2025

garlin said:
Mosby supports SVN 7.0.

I wonder since when.

But doing a bit of research, it appears SVN 7.0 was distributed with KB5062552 (for Windows 11 22H2/23H2) and KB5062553 (for Windows 11 24H2) in July's patch Tuesday. And also, that it would come with a clean install of 25H2, which is the case for the computer I'm most curious about since it got clean-installed with 25h2. I had run MOSBY on it previously, with a version that predates the inclusion of the 2023 OpROM key. So whichever way I got it on that machine, it got the latest assuming that information is factual.

But what that suggests to me is if someone wants to stay current with both a secure boot manager AND updated revocations, they'll need to let Microsoft do it's thing going forward. But I'd dearly like to know when they're diddling with Secure Boot variables since my machines are binding PCR 7 for protecting their BootLocker keys.

If keeping restore disks current is an issue I imagine Macrium and the like will have to figure a way to make it as painless as possible.

Ghot · Dec 4, 2025

Scroll down and follow the directions, here... Create New Macrium Reflect Rescue Media

Macrium Reflect X

knowledgebase.macrium.com

garlin · Dec 4, 2025

Buddywh said:
But what that suggests to me is if someone wants to stay current with both a secure boot manager AND updated revocations, they'll need to let Microsoft do it's thing going forward. But I'd dearly like to know when they're diddling with Secure Boot variables since my machines are binding PCR 7 for protecting their BootLocker keys.

That's why they recommend you temporarily suspend BitLocker when updating any Secure Boot keys.

It's not explicitly stated what the "\Microsoft\Windows\PI\Secure-Boot-Update" task is doing behind the scenes, but I would assume it's doing "manage-bde -Protectors -Disable C: -RebootCount 1"

Buddywh · Dec 4, 2025

Ghot said:
Scroll down and follow the directions, here... Create New Macrium Reflect Rescue Media

I was aware they have a way to do it... but if Microsoft is updating boot manager files and revocations in DBX "behind the scenes" and unbeknownst to users how do they know to run that process after an update to not be left with a recovery disk they can't use?

garlin said:
It's not explicitly stated what the "\Microsoft\Windows\PI\Secure-Boot-Update" task is doing behind the scenes, but I would assume it's doing "manage-bde -Protectors -Disable C: -RebootCount 1"

That certainly says they have a way at least. But I'll still keep a printout of my recovery key handy and itself protected.

Ghot · Dec 4, 2025

Buddywh said:
how do they know to run that process after an update to not be left with a recovery disk they can't use?

After every update I test boot from my USB MR rescue media.
If it doesn't work, I rebuild it with the new MS ADK.

If there's a better way, I dunno what it is.
As many have mentioned, MS is not very forthcoming.

garlin · Dec 4, 2025

July 2024 was when MS pushed out DBXupdateSVN.bin across the CU's for W10 22H2 and all W11 releases.
The file size is 3,509 bytes.

Which is the same file as maintained on the official MS Secure Boot Objects GitHub. Reporting SVN 7.0 is the latest. So you don't have to be super paranoid about this file unless Brink passes along a future MS security advisory.

XxXxX · Dec 4, 2025

@garlin
SVN 7.0 on all my systems here at home

best of luck Steve ..

garlin · Dec 4, 2025

A future release of my script will check if the SecureBootUpdates\DBXupdateSVN.bin is newer than your UEFI's current SVN. And if so, compare the boot file versions to see if they don't match. That's as best as I can figure it out.

XxXxX · Dec 4, 2025

garlin said:
A future release of my script will check if the SecureBootUpdates\DBXupdateSVN.bin is newer than your UEFI's current SVN. And if so, compare the boot file versions to see if they don't match. That's as best as I can figure it out.

i beleive that when MS release to secure boot updates for general release
that the whole DBX base will be replaced.

but the time line on that is unknown.
best of luck Steve ..

Brian48 · Dec 4, 2025

Buddywh said:
But doing a bit of research, it appears SVN 7.0 was distributed with KB5062552 (for Windows 11 22H2/23H2) and KB5062553 (for Windows 11 24H2) in July's patch Tuesday. And also, that it would come with a clean install of 25H2

I did a clean install of 25H2 on 26/10 (version 26200.6899) and, according to @garlin's script, I only have SVN 2.0.
So I don't know why mine wasn't updated to 7.0

PerpetualCycle · Dec 4, 2025

suatcini54 said:
Great point.

So every night before we go to bed, we must update all of our bootable Windows Installation disks, Windows Recovery disks, etc. Or next morning we may wake up to a big surprise. Is this really so ??

Well, if they won't boot, then fix them. No need to be proactive and waste time.

Ghot · Dec 4, 2025

Brian48 said:
So I don't know why mine wasn't updated to 7.0

Did you do this part of the first post?

Apply the SVN update to the firmware. To do this, open a Command Prompt window as an Administrator, type each of the following commands separately, and then press Enter:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Brian48 · Dec 4, 2025

Ghot said:
Did you do this part of the first post?

No I didn't, but the way I read @Buddywh's post, it would be done with a clean install of 25H2, which I did on 26/10

Buddywh said:
But doing a bit of research, it appears SVN 7.0 was distributed with KB5062552 (for Windows 11 22H2/23H2) and KB5062553 (for Windows 11 24H2) in July's patch Tuesday. And also, that it would come with a clean install of 25H2

Buddywh · Dec 4, 2025

Brian48 said:
a clean install of 25H2, which I did on 26/10

I did the clean install just recently (in the last week) from a USB installation drive I created using Microsoft's Media Creation Tool just prior to it. I'm not at that system now, but I seem to recall the build installed after it's post-install updates wound up at 26200.7171 (could be wrong). I suppose any other method used for getting it might not result in the latest version or SVN rev.

And my other systems that have it I have no idea how they got it, whether by the MOSBY key updates I did or Microsoft updates that have posted. Which is the case for this system too since I also updated keys with MOSBY before I did the clean install. I'm really not sure how I got the latest SVN in any instance.

Dirtyflash · Dec 4, 2025

Buddywh said:
And my other systems that have it I have no idea how they got it, whether by the MOSBY key updates I did or Microsoft updates that have posted. Which is the case for this system too since I also updated keys with MOSBY before I did the clean install. I'm really not sure how I got the latest SVN in any instance.

I think Windows Update does a check for you on schedule everyday, twice a day and updates the SVN if there's a newer version.

garlin · Dec 4, 2025

Dirtyflash said:
I think Windows Update does a check for you on schedule everyday, twice a day and updates the SVN if there's a newer version.

No, it doesn't work that way. SVN's are only pushed out as part of a Monthly Update as a planned security fix. They're not like Defender definitions, which are refreshed every day.

The scheduled task that watches for Secure Boot changes runs every day to check if there's something it should be doing, simply because it doesn't know if you manually installed a Windows update on a non-Patch Tuesday.

suatcini54 · Dec 4, 2025

PerpetualCycle said:
Well, if they won't boot, then fix them. No need to be proactive and waste time.

Thanks for replying.

Recovery procedure could be painful by the MS documentation:

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

Looking at the "Recovery Procedure" section of the above-mentioned MS documentation, the steps to be carried out to resurrect dead Windows machines may be difficult. In fact, we may go as far as reinstalling Windows from scratch.

There are millions and millions of people running Windows machines with Secure-Boot-State on, who may not be knowledgeable enough to repair and/or reinstall Windows easily in such Windows-not-booting scenarios. My post was to draw attention to this issue.

PerpetualCycle · Dec 5, 2025

garlin said:
ootUpdates\DBXupdateSVN.bin is newer than yo

suatcini54 said:
Thanks for replying.

Recovery procedure could be painful by the MS documentation:

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

Looking at the "Recovery Procedure" section of the above-mentioned MS documentation, the steps to be carried out to resurrect dead Windows machines may be difficult. In fact, we may go as far as reinstalling Windows from scratch.

There are millions and millions of people running Windows machines with Secure-Boot-State on, who may not be knowledgeable enough to repair and/or reinstall Windows easily in such Windows-not-booting scenarios. My post was to draw attention to this issue.

I agree. I can't see how Microsoft can expect millions of normal users to deal with this and other things like having to deal with increasing recovery partition size manually on an update.

suatcini54 · Dec 5, 2025

PerpetualCycle said:
I agree. I can't see how Microsoft can expect millions of normal users to deal with this and other things like having to deal with increasing recovery partition size manually on an update.

Good point.

Solved Finding the UEFI's DBX SVN number using PowerShell

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Syzygy

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Syzygy

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

My Computer

My Computers

My Computers

My Computer

My Computers

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer

My Computers

My Computer

My Computer

My Computers

My Computers

My Computers