Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

x_1 · 2026-07-17T12:04:33-0400

garlin said:
If you're in PowerShell, you may need to add the full path to the batch file.

ok, let me try (i was in PS)

garlin · 2026-07-17T12:10:51-0400

t2s50 said:
MS is working quite a lot on the SkuSiPolicy.p7b. Compare the 3.0.0.10 version to the latest version and there are quite some additions. Version 3.0.0.10 focused solely on winload.efi (osloader.exe) and winresume.efi (hiberrsm.exe), version 3.0.0.16 has in addition
cbproxy.exe (10 entries)
ffuloader.efi (10 entries)
hvloader.efi (2 entries)
memdiag.exe (10 entries)
mmosloader.efi (10 entries)
Mobilestartup (10 entries)
resetphone.efi (10 entries)
SecConfig.efi (10 entries)
SfhRecovery.efi (8 entries)

I'm wondering if there's an actual security issue with those files, or they're rolling a new feature which requires every executable to be replaced.

What's with the Windows Phone files (like resetphone.efi)? I get the "one Windows for all" mantra, but it kinda seems ridiculous to list them for a desktop SKU.

x_1 · 2026-07-17T12:22:07-0400

garlin said:
.

i've edited the post above.

garlin · 2026-07-17T12:33:42-0400

x_1 said:
ok, let me try (i was in PS)

Looks like they may changed something in the policy file format. I'll have to investigate.

garlin · 2026-07-17T13:01:28-0400

I don't see a problem with the current SkuSiPolicy.p7b (version 3.0.0.16).

Your existing copy of the file on the EFI volume may be corrupted or the wrong file. Since the reported file version is 4.3, that is always greater than 3.0.0.16, so the update script will not replace it.

1. Run these commands:

Code:

mountvol S: /s
copy S:\EFI\Microsoft\Boot\SkuSiPolicy.p7b BAD_COPY_SkuSiPolicy.p7b
copy C:\Windows\System32\SecureBootUpdates\SkuSiPolicy.p7b S:\EFI\Microsoft\Boot\SkuSiPolicy.p7b
mountvol S: /d

2. Please create a ZIP file of the "BAD_COPY_SkuSiPolicy.p7b" on your C: drive.

3. Attach the ZIP in your next post. I would like to see what kind of file was installed, because I don't understand why it has a version 4.3

Thanks.

x_1 · 2026-07-17T14:12:17-0400

garlin said:

1. Run these commands:

Code:

mountvol S: /s
copy S:\EFI\Microsoft\Boot\SkuSiPolicy.p7b BAD_COPY_SkuSiPolicy.p7b
copy C:\Windows\System32\SecureBootUpdates\SkuSiPolicy.p7b S:\EFI\Microsoft\Boot\SkuSiPolicy.p7b
mountvol S: /d

problem solved with these commands, thank you!

PerpetualCycle · 2026-07-17T23:19:46-0400

Hi,

I thought I had all of this taken care of, All the CA were updated and I had 2011 revoked. So i was just checking, ran your scripts again, and found 2011 was no longer revoked and the dbx was empty. So I revoked it again.

It had to be Microsoft. Why would Microsoft enable it?

garlin · 2026-07-17T23:39:21-0400

PerpetualCycle said:
I thought I had all of this taken care of, All the CA were updated and I had 2011 revoked. So i was just checking, ran your scripts again, and found 2011 was no longer revoked and the dbx was empty. So I revoked it again.

It had to be Microsoft. Why would Microsoft enable it?

There's no way to clear the DBX (or any of the Secure Boot variables) without going into the UEFI setup menus. You can always append new values to existing variables from Windows, but you can't clear them. It's a deliberate security measure, otherwise attackers could get Admin rights and simply defeat any Secure Boot settings you have. You must be physically present in the BIOS screens to manually clear variables.

Check if your BIOS got recently updated. Sometimes the process of applying a new firmware can break the existing settings (it's not supposed to, but on occasion it can end up in a messed up state). Normally you can reset to factory defaults, and repeat whatever process you did to get the certs updated (if it required manual intervention).

PerpetualCycle · 2026-07-17T23:41:41-0400

garlin said:
There's no way to clear the DBX (or any of the Secure Boot variables) without going into the UEFI setup menus. You can always append new values to existing variables from Windows, but you can't clear them. It's a deliberate security measure, otherwise attackers could get Admin rights and simply defeat any Secure Boot settings you have. You must be physically present in the BIOS screens to manually clear variables.

Check if your BIOS got recently updated. Sometimes the process of applying a new firmware can break the existing settings (it's not supposed to, but on occasion it can end up in a messed up state). Normally you can reset to factory defaults, and repeat whatever process you did to get the certs updated (if it required manual intervention).

OK, thanks

I had reinstalled the same BIOS since then so maybe that was it. I guess one should check after every BIOS update.

t2s50 · 2026-07-18T10:08:30-0400

PerpetualCycle said:
OK, thanks

I had reinstalled the same BIOS since then so maybe that was it. I guess one should check after every BIOS update.

+1, definitely!

(Normally bios updates should leave out the NVRAM and settings / certificates but my Gigabyte B760 overwrites the complete firmware, leaving the dbx thereby empty again and in addition the update downgraded the Intel ME in the process)

gunrunnerjohn · 2026-07-18T10:48:25-0400

t2s50 said:
+1, definitely!

(Normally bios updates should leave out the NVRAM and settings / certificates but my Gigabyte B760 overwrites the complete firmware, leaving the dbx thereby empty again and in addition the update downgraded the Intel ME in the process)

Are you sure? I recently upgraded my BIOS on my Gigabyte B760M GAMING PLUS WIFI motherboard, and all my secure boot variables were left intact.

PowerShell 7.6.3
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
MosbyKey [2025.07.17]
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

SkuSiPolicy.p7b is CURRENT.

STATUS REPORT
-------------
Registry: "UEFICA2023Status" = Updated

SUCCESS: UPDATES ARE FINISHED.
UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

t2s50 · 2026-07-18T11:11:19-0400

gunrunnerjohn said:
Are you sure?

Yes, but that may differ from board to board, mine is a b760m-ds3h-ddr4, bios was F24 (not F24A).

To confirm that they downgraded even the Intel ME (management engine) region see the timeline for MEInfo output:
First bios F24A with ME 16.1.42.2872 (manually updated), then after update to the latest F24 ME is downgraded to 16.1.40.2765, then manually updated ME firmware again to 16.1.42.2872)

And overwriting the complete ME region is one step further than deleting / "refreshing" the NVRAM.... But I used the builtin bios fuctionality for updating, no separate software tools- did never search if there exist some?

gunrunnerjohn · 2026-07-18T14:32:46-0400

I also used the built-in BIOS update option, I put the BIOS on a USB stick and then use the Q-Flash in the BIOS. It updated the BIOS and left my Secure Boot alone.

garlin · 2026-07-18T15:39:34-0400

UPDATE: 2026-07-18

1. Update the EDK2 binaries ZIP file to version 1.6.5
2. Create a block list of PC models that have reported UFI issues with "bricking" (Lenovo M700)
3. String check for HP BIOS versions should ignore non-HP models

PerpetualCycle · 2026-07-18T15:57:15-0400

garlin said:
UPDATE: 2026-07-18

1. Update the EDK2 binaries ZIP file to version 1.6.5
2. Create a block list of PC models that have reported UFI issues with "bricking" (Lenovo M700)
3. String check for HP BIOS versions should ignore non-HP models

Bree · 2026-07-18T16:04:19-0400

garlin said:
Create a block list of PC models that have reported UFI issues with "bricking" (Lenovo M700)

Bug report:

Code:

The regular expression pattern *LENOVO*M700* is not valid.
At F:\CA2023\SecureBoot-CA-2023-Updates.v2026.07.18\Check_UEFI-CA2023.ps1:1365 char:8
+        '*LENOVO*M700*' { $Unsafe_Model = $true }
+        ~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (*LENOVO*M700*:String) [], RuntimeException
    + FullyQualifiedErrorId : InvalidRegularExpression

garlin · 2026-07-18T16:05:31-0400

Oops, I formatted the "*" wrong. Forgot PS uses a different regex expression. I'll push the fix in the next 10 min.

garlin · 2026-07-18T16:14:14-0400

Pushed to post #1 and GitHub. I keep forgetting PS doesn't follow the same regular expressions as POSIX.

* (everything) is supposed to be .* (everything)

t2s50 · 2026-07-18T16:20:45-0400

In addition: Seems the Warning is displayed right in the firmware paragraph. In my system this would disappear up out of the PS window and in addition I might overlook it since I'm familiar with the system specs and wouldn't read this part thoroughly.

Might I suggest a repetition in the summary where the possible tasks are listed?

(No, your script doesn't detect my board, I just was curious how the warning would look alike)

garlin · 2026-07-18T16:28:27-0400

That's a good idea, I'll rewrite the REQUIRED ACTIONS to just stop and warn if you have an "unsafe" model.

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Syzygy

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Syzygy

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Syzygy

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer

My Computer

My Computer

My Computer