Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

anchamp65 · 2026-07-28T16:04:29-0400

XxXxX said:
open Task Manager
at the top is 'run new task' click that

when the run new task window opens
tick 'create this task with Admin privileges'

in the 'open' search/command box write
powershell.exe
then press enter

the powershell terminal will know open with full Admin privileges.
best of luck Steve ..

Curious, how is this different from running Powershell as administrator from the Start menu or from the Terminal window option like below... ?

nikki605 · 2026-07-28T16:24:47-0400

anchamp65 said:
can you provide a new screenshot of the error while using the winget version
can you also run these commands to validate all point to the winget version and not still pointing to MStore

Code:

$PSHOME (Get-Process -Id $PID).Path Get-Command pwsh | Select-Object Source where.exe pwsh winget list Microsoft.PowerShell

Winget = C:\Program Files\PowerShell\7\pwsh.exe
MStore = C:\Program Files\WindowsApps\Microsoft.PowerShell_7.6.4.0_x64__8wekyb3d8bbwe\

the part in red can be different...

New screen shot:

I ran your commands but I'm not sure I did it right:

Winget = C:\Program Files\PowerShell\7\pwsh.exe - THE POWERSHELL SUB-FOLDER DOESN'T EXIST
MStore = C:\Program Files\WindowsApps\Microsoft.PowerShell_7.6.4.0_x64__8wekyb3d8bbwe\ - DON'T HAVE PERMISSION TO ENTER THE WINDOWS APPS FOLDER

XxXxX · 2026-07-28T16:34:40-0400

anchamp65 said:
Curious, how is this different from running Powershell as administrator from the Start menu or from the Terminal window option like below... ?

View attachment 177801

it opens a separate instance of powershell from the default system admin account which is a hidden account.
best of luck Steve ..

anchamp65 · 2026-07-28T16:46:21-0400

nikki605 said:
New screen shot:

View attachment 177804

I ran your commands but I'm not sure I did it right:

View attachment 177805

Winget = C:\Program Files\PowerShell\7\pwsh.exe - THE POWERSHELL SUB-FOLDER DOESN'T EXIST
MStore = C:\Program Files\WindowsApps\Microsoft.PowerShell_7.6.4.0_x64__8wekyb3d8bbwe\ - DON'T HAVE PERMISSION TO ENTER THE WINDOWS APPS FOLDER

Your still running the MStore version.

uninstall MStore version from MStore directly
uninstall winget version if still present ("winget uninstall --id Microsoft.PowerShell")
make sure no other version is installed ("winget list Microsoft.PowerShell")
restart computer
install winget version ("winget install --id Microsoft.PowerShell")
if you do a search for "powershell" from Start menu, you should have this, and run it as Administrator.
Test again...

anchamp65 · 2026-07-28T17:40:00-0400

XxXxX said:
it opens a separate instance of powershell from the default system admin account which is a hidden account.
best of luck Steve ..

Ok, it's what I thought, it's the samething

Wannagofast · 2026-07-28T20:25:39-0400

I get this when I try and run your script after installing the 26200-8973 optional preview. Not sure If they broke your stuff or their own.

Go back to to a Macrium backup of 26200-8894 and they all run just fine. Right click and Run with Poweshell runs it fine.
Running Check-UEFI.bat does seem to work fine though. Just the ps1 file throws that error.

Also tried right click open with and pointed it at C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe to maybe fix the no application associated error but no dice. Very odd...

Also if I manually go to powershell and right click and open an Administrator Powershell Window then I can cd into the directory and run the file from there.

Gonna sleep on it I think i might be just a bit to tired for this puzzle tonight.

peace
wanna

garlin · 2026-07-28T21:27:59-0400

Wannagofast said:
I get this when I try and run your script after installing the 26200-8973 optional preview. Not sure If they broke your stuff or their own.

Go back to to a Macrium backup of 26200-8894 and they all run just fine. Right click and Run with Poweshell runs it fine.
Running Check-UEFI.bat does seem to work fine though. Just the ps1 file throws that error.

I don't see any PS-related changes in the July Preview release notes. I might update to the Preview after I'm done with my current improvements.

Scott · 2026-07-28T21:58:11-0400

Runs okay for me.

Code:

PS D:\Scripts\SecureBoot-CA-2023-Updates.v2026.07.24> .\Check_UEFI-CA2023.ps1 -bootmedia -verbose
Windows 11 25H2 (26200.8973)

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
    ASUS System Product Name
    Version: 4505
    Date: 2025-11-28

Factory Default UEFI PK Cert
----------------------------
    ASUSTeK MotherBoard PK Certificate

UEFI PK Cert
------------
    ASUSTeK MotherBoard PK Certificate

Factory Default UEFI KEK Certs
------------------------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023
    ASUSTeK MotherBoard KEK Certificate

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023
    Canonical Ltd. Master Certificate Authority
    ASUSTeK MotherBoard KEK Certificate

Factory Default UEFI DB Certs
-----------------------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023
    ASUSTeK MotherBoard SW Key Certificate
    ASUSTeK Notebook SW Key Certificate

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023
    Canonical Ltd. Master Certificate Authority
    ASUSTeK MotherBoard SW Key Certificate
    ASUSTeK Notebook SW Key Certificate

Factory Default UEFI DBX Certs
------------------------------
    (NONE)
    EFI_CERT_SHA256_GUID Signatures: 430

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 9.0
    EFI_CERT_SHA256_GUID Signatures: 454

UEFI Variables
--------------
    Credential Guard: ON
    SBAT (Linux only): sbat,1,2024010900 / shim,4 / grub,3 / grub.debian,4

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    SkuSiPolicy.p7b is CURRENT.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
        Version: 3.0.0.16
    NOT RECOMMENDED for dual-boot setups.

Macrium Folders
---------------
    Windows Boot Manager [Production PCA 2011] is BANNED.
        c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

Bootable Media
--------------
    USB Drive K: "MACRIUMBOOT"
        Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
            K:\EFI\Microsoft\Boot\bootmgfw.efi
            File Version: 28000.352, SVN 9.0

        K:\EFI\Microsoft\Boot\boot.stl [5/18/2026 07:44] is CURRENT.

STATUS REPORT
-------------
    Registry: "UEFICA2023Status" = Updated

    SUCCESS: UPDATES ARE FINISHED.
    UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

PS D:\Scripts\SecureBoot-CA-2023-Updates.v2026.07.24>

Scott · 2026-07-28T22:00:42-0400

Wannagofast said:
I get this when I try and run your script after installing the 26200-8973 optional preview. Not sure If they broke your stuff or their own.

Use the back slash as opposed to the forward slash.

Scott · 2026-07-28T22:18:02-0400

Looks like our WinRE updated today. Everything still boots fine.

Code:

C:\Windows\System32>powershell -ep bypass -f D:\Scripts\BlockedOrNot.ps1
Windows 11 25H2 (26200.8973)
VBS: ON

Policy File: "\\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b", Version 3.0.0.16

Filename                        FileVersion Status
--------                        ----------- ------
K:\sources\boot.wim             26100.8875  ALLOWED
C:\Windows\System32\winload.efi 26100.8972  ALLOWED
Disk 0 Partition 4 Winre.wim    26100.8971  ALLOWED
[Code]


C:\Windows\System32>

no0bie · 2026-07-29T09:21:24-0400

Garlin I HECKING LOVE YOU. My partner followed your instructions for my Acer Nitro 5 AN515-45 and it worked like a miracle. Made this account just to thank you on his behalf. You rock! keep doing the good work.

nikki605 · 2026-07-29T10:41:17-0400

anchamp65 said:
can you provide a new screenshot of the error while using the winget version
can you also run these commands to validate all point to the winget version and not still pointing to MStore

Code:

$PSHOME (Get-Process -Id $PID).Path Get-Command pwsh | Select-Object Source where.exe pwsh winget list Microsoft.PowerShell

Winget = C:\Program Files\PowerShell\7\pwsh.exe
MStore = C:\Program Files\WindowsApps\Microsoft.PowerShell_7.6.4.0_x64__8wekyb3d8bbwe\

the part in red can be different...

I uninstalled PS 7 as you instructed, rebooted the PC and re-ran your commands. It looks to me that PS 7 has been uninstalled:

Now I'll try to install PS 7 following your winget instructions.

Does this look correct?

I rebooted the PC and started PS 7. It looks like I'm still running the version from the MS Store. I'm lost.

anchamp65 · 2026-07-29T11:37:40-0400

nikki605 said:
I uninstalled PS 7 as you instructed, rebooted the PC and re-ran your commands. It looks to me that PS 7 has been uninstalled:

View attachment 177892

Now I'll try to install PS 7 following your winget instructions.

Does this look correct?

View attachment 177894

I rebooted the PC and started PS 7. It looks like I'm still running the version from the MS Store. I'm lost.

View attachment 177898

Not at home today...
But it sure looks like MStore Powershell is still present
Go to MStore, Library (bottom left), and search for "power"
Is there still a powershell ? If so, uninstall directly from MStore and restart PC
PS: You probably have Power Automate, but that's something else, don't worry about it

Capricornus · 2026-07-29T13:51:17-0400

Scott said:

Looks like our WinRE updated today. Everything still boots fine.

Code:

C:\Windows\System32>powershell -ep bypass -f D:\Scripts\BlockedOrNot.ps1
Windows 11 25H2 (26200.8973)
VBS: ON

Policy File: "\\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b", Version 3.0.0.16

Filename                        FileVersion Status
--------                        ----------- ------
K:\sources\boot.wim             26100.8875  ALLOWED
C:\Windows\System32\winload.efi 26100.8972  ALLOWED
Disk 0 Partition 4 Winre.wim    26100.8971  ALLOWED
[Code]


C:\Windows\System32>

I would appreciate it if you could send me a link to this script blockedornot.ps1. I would like to run it on one of my computers
Many thanks.

garlin · 2026-07-29T14:22:00-0400

Here you go.

DJinSD · 2026-07-29T16:42:31-0400

A little help, plz.

My reading of the attached and some additional reading elsewhere is that my 9020's KEK being untrusted means no updates to either the db or dbx. Eventually, that system will be farther and farther behind the trust curve without those two databases being refreshed.

Additionally, since the system is well past the EOL threshold as published by Dell, there is no hope of resolving the KEK untrusted status.

If I'm in error/off base/missing some fundamental understand, fire away.

Code:

PS C:\Garlin> .\check_uefi-CA2023.ps1 -bootmedia -verbose
Windows 11 25H2 (26200.8737)

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

BIOS Firmware
-------------
    Dell Inc. OptiPlex 9020
    Version: A25
    Date: 2019-05-29

Factory Default UEFI PK Cert
----------------------------
    (NONE)

UEFI PK Cert
------------
    Dell Inc. UEFI Platform Key
        Manual update of [KEK CA 2023] is REQUIRED.

Factory Default UEFI KEK Certs
------------------------------
    (NONE)

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011

Factory Default UEFI DB Certs
-----------------------------
    (NONE)

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
    (NONE)
    EFI_CERT_SHA256_GUID Signatures: 0

UEFI DBX Certs
--------------
    Microsoft Windows PCA 2010
    Windows BootMgr SVN is MISSING.
    EFI_CERT_SHA256_GUID Signatures: 291

UEFI Variables
--------------
    Credential Guard: ON
    SBAT (Linux only): sbat,1,2024010900 / shim,4 / grub,3 / grub.debian,4

EFI Files
---------
    Boot File [Windows UEFI CA 2023] is UNTRUSTED
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.342, SVN 9.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

REQUIRED ACTION
===============

Run the command:
    Update_UEFI-CA2023.ps1 -Revoke

Finish the UEFI steps to manually add the [KEK CA 2023] cert, if the script provided instructions.

FIREMEDIC2700 · 2026-07-29T17:04:28-0400

I have done a lot of research :
here is what i have found.
this is a unsupported machine .
when i check the Secure Boot High Confidence Database i get a "Temporarily Paused" status. based on what i have seen this could be a combo of
1. i dont have a tpmi
2. my pc does not meet the basic system requirements
3. i used rufus to make a install iso.
my pc is current on all the certs and boots into secure boot. according to my research there is nothing i can do to fix it. and my pc should continue to function till it dies on its own. and i will still get all updates from wu. not sure about the once a year feature updates.

anchamp65 · 2026-07-29T17:07:20-0400

DJinSD said:
A little help, plz.

My reading of the attached and some additional reading elsewhere is that my 9020's KEK being untrusted means no updates to either the db or dbx. Eventually, that system will be farther and farther behind the trust curve without those two databases being refreshed.

Additionally, since the system is well past the EOL threshold as published by Dell, there is no hope of resolving the KEK untrusted status.

If I'm in error/off base/missing some fundamental understand, fire away.

You can follow Garlin's instructions in the README_UEFI.TXT in the same folder as the scripts.
See section: Manual installation of [KEK 2K CA 2023]

Also check the link for Dell computers at the end of the readme file.
Dell published instructions for different BIOS versions.

FYI: next time for your result, use this option it allows pasting your text result and easier for looking at it without needing to download a file

garlin · 2026-07-29T17:35:59-0400

The last BIOS update for Dell 9020 was from 2019. I would first investigate if your BIOS supports manual KEK key enrollment from the Secure Boot menus. You can try that first before the final option of clearing all keys.

DJinSD · 2026-07-29T18:43:00-0400

Yes, the most recent BIOS for the 9020 MT is A25 from 2019, and, my BIOS has been modded to support booting from an SSD mounted in an adapter board in a PCIe slot (Install and boot from an NVMe SSD on a Dell OptiPlex 9020, 7020 or 3020).

The readings of various postings found on the Dell web site addressing secure boot, etc., basically says Dell is not providing any kind of support or machine readables if the computer is past EOL, i.e. you're SOL.

Yes, I believe the firmware does support key enrollment. My machine is using a Type 2 BIOS. I say I believe it does support key enrollment b/c I'm not sure exactly what key enrollment means.

I've "reset" or cleared all keys previously. I've even attempted to change the KEK manually but ran into problems when the replacement key I was attempting to use did not match the expected key format.

I'll review the overlooked documentation then see if I have any more options to explore.

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Windows Outsider

Attachments

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computers My Computers

At a glance

At a glance

My Computer

My Computers

My Computers

My Computer

My Computer

My Computers

My Computer

My Computers

My Computers

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers