Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

x_1 said:

And what about the system image captured before applying the patch if a restore becomes necessary?

Doesn't that defeat the purpose of taking snapshots?

Click to expand...

You can temporarily disable secure boot in firmware in a rescue situation.

With 'updated' rescue media and 'outdated' image you can restore an image with secure boot enabled, but have to disable secure boot to boot the restored ('outdated') image.
(But improbable combination: Who would bother with updating the rescue media while not taking a fresh image?)

With 'outdated' rescue media and 'outdated' image you have to disable secure boot for restoring the image and keep it disabled to boot the restored image.

With 'updated' rescue media and 'updated' image there's no problem...

When you have a SkuSiPolicy mismatch, the normal workaround is to disable Secure Boot. You might have to reboot twice.

Two reboots because:
1. After Windows notices that Secure Boot is disabled, it clears a possible "UEFI lock" on the SkuSiPolicy being in effect from the BIOS settings.

2. Second reboot allows the cleared state (no UEFI lock) to be in effect. Without the second reboot, Windows might get confused if Secure Boot was re-enabled since the future SkuSiPolicy won't match what version the UEFI lock thinks it should be.

At this point, if you restored from an older backup then your "correct" version of the SkuSiPolicy is whatever version is in the restored "C:\Windows\System32\SecureUpdates" folder.

You could just leave it alone and run Windows Update to bring your older image to the latest files (so your winload.efi matches again). But that depends on why you're restoring from a backup (maybe the last Monthly Update was unstable for you).