Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Rollback_Jockey · Jan 27, 2026

Dirtyflash said:
Was your Tosh technically a W11 supported device?

Nope, all of my machines are antiques but all running 25H2, except for my Packard Bell which has an old style BIOS and no popcnt.

Dirtyflash · Jan 27, 2026

Rollback_Jockey said:
Nope, all of my machines are antiques but all running 25H3, except for my Packard Bell which has an old style BIOS and no popcnt.

Wow, I'm impressed, good work! Really surprised the OEM's in your case pushed out PK and KEK certs to your unsupported devices.

nikki605 · Jan 28, 2026

Rollback_Jockey said:
Nope, all of my machines are antiques but all running 25H2, except for my Packard Bell which has an old style BIOS and no popcnt.

WOW! I didn't think there were any Packard Bell computers left running. I used to work for the company that serviced their PCs back in the day. I made several trips to their headquarters in Chatsworth, CA until the building was destroyed by the 1994 earthquake.

Rollback_Jockey · Jan 28, 2026

nikki605 said:
WOW! I didn't think there were any Packard Bell computers left running. I used to work for the company that serviced their PCs back in the day. I made several trips to their headquarters in Chatsworth, CA until the building was destroyed by the 1994 earthquake.

Yep this PB is an all-in-one OneTwo with an upgraded processor.

neldog · Jan 28, 2026

Rollback_Jockey said:
Yep, this PB is an all-in-one OneTwo with an upgraded processor.

Let's see a picture of that bad boy if its nearby and not too much of a hassle.

Rollback_Jockey · Jan 28, 2026

neldog said:
Let's see a picture of that bad boy if its nearby and not too much of a hassle.

neldog · Jan 28, 2026

Thanks... that's great!

Rollback_Jockey · Jan 28, 2026

neldog said:
Thanks... that's great!

I've got it maxed out with Memory, upgraded the processor and it's booting from an SSD so it's probably not as PB intended it to be.

neldog · Jan 28, 2026

Rollback_Jockey said:
I've got it maxed out with Memory, upgraded the processor and it's booting from an SSD so it's probably not as PB intended it to be.

No, not at all, lol. That is an interesting life story for that machine and that it is operating today with Windows 11 - that's crazy!

Good job!

Thierry 83200 · Jan 28, 2026

PowerShell script with graphical interface for updating Windows installation media with UEFI CA 2023 certificates.

Compatible with all Windows languages: works on Windows in English, German, French, or any other language.

For Server And Client Windows ( 10 / 11 / Server 2016 /19 /22 /25 ) arm64 and 64 bits

English interface: all messages, buttons, and labels are now in English for international use.

Features:

Signature verification: detects whether an ISO uses the old certificate (PCA 2011) or the new one (CA 2023).

Automatic update: extracts and replaces boot binaries with the 2023 signed versions.

Native ISO creation: uses the Windows IMAPI2 API, no external tools required.

Bootable USB creation: FAT32 formatting with automatic splitting if install.wim > 4 GB.

Technical changes:

Removal of dependencies on localized commands (e.g., Get-Volume instead of text parsing).

Use of .NET/WMI APIs independent of the system language

Messages and logs entirely in English

Prerequisites:

Windows 10 / 11 with PowerShell 5.1+

Administrator rights

Thierry 83200 · Jan 29, 2026

No worries, I wasn't sure where to post it. Sorry again for the damage.

garlin · Jan 29, 2026

I think a GUI tool is an improvement over the Make2023BootableMedia.ps1 script provided by MS. Which supports a confusing array of options

.

Thierry 83200 · Jan 29, 2026

Not tested yet, we'll see.

goink · Jan 31, 2026

@garlin

Thanks for the magnificent work. I ran the Windows 11 "Secure Boot Allowed Key Exchange Key (KEK) Update"; however, after several reboots, I still seem to be on the 2011 cert.

I ran your "Check_UEFI-CA2023.ps1" script and generated a log. It appears there are some issues on my machine.

While the "REQUIRED ACTIONS" seem clear, I'm a bit worried that running the required actions might make my machine unbootable in some way.

Will performing the actions listed at the bottom of the log clear everything up without breaking my machine:

(LOG START)

Windows 11 25H2 (26200.7623)

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) ON

BIOS Firmware
-------------
Gigabyte Technology Co. Z390 I AORUS PRO WIFI
Version: F8
Date: 2021-11-04

Factory Default UEFI PK Cert
----------------------------
(NONE)

UEFI PK Cert
------------
(NONE)

Factory Default UEFI KEK Certs
------------------------------
Microsoft Corporation KEK CA 2011

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
(NONE)
EFI_CERT_SHA256_GUID Signatures: 77

UEFI DBX Certs
--------------
(NONE)
Windows BootMgr SVN is MISSING.
EFI_CERT_SHA256_GUID Signatures: 483

EFI Files
---------
Disk 1: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
bootmgfw.efi File version: 26100.30227

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

Disk 1: SkuSiPolicy.p7b (for VBS) is NOT PRESENT.

Bootable Media
--------------
DVD Drive E:

AUDIT REPORT
============
1. [Production PCA 2011] is missing from UEFI DBX
2. Windows BootMgr SVN is missing from UEFI DBX
3. SkuSiPolicy.p7b (for VBS) is missing

REQUIRED ACTION
===============

To revoke the [PCA 2011] cert, run the commands, run the commands:

manage-bde -Protectors -Disable C: -RebootCount 1
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x280 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

To install SkuSiPolicy.p7b, run the command:
Update_UEFI-CA2023.ps1 -SkuSiPolicy

(LOG END)

garlin · Jan 31, 2026

goink said:
@garlin

Thanks for the magnificent work. I ran the Windows 11 "Secure Boot Allowed Key Exchange Key (KEK) Update"; however, after several reboots, I still seem to be on the 2011 cert.

I ran your "Check_UEFI-CA2023.ps1" script and generated a log. It appears there are some issues on my machine.

While the "REQUIRED ACTIONS" seem clear, I'm a bit worried that running the required actions might make my machine unbootable in some way.

goink said:
AUDIT REPORT
============
1. [Production PCA 2011] is missing from UEFI DBX
2. Windows BootMgr SVN is missing from UEFI DBX
3. SkuSiPolicy.p7b (for VBS) is missing

REQUIRED ACTION
===============

To revoke the [PCA 2011] cert, run the commands, run the commands:

manage-bde -Protectors -Disable C: -RebootCount 1
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x280 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

To install SkuSiPolicy.p7b, run the command:
Update_UEFI-CA2023.ps1 -SkuSiPolicy

In your case, the CA 2023 certs are fully installed. But the CA 2011 certs have not been revoked (which is optional as of today, but will be enforced by Windows later this year). If you want to proceed with revocation, then follow the instructions in the first half of "REQUIRED ACTION".

The instructions are the same as MS provides. But the script does the "math" to figure out the registry value that is appropriate for your current state.

If you want to perform both halves of the revocation process (block CA 2011 and update the VBS policy), you can run the update script:

Code:

powershell -ep bypass -f .\Update_UEFI-CA2023.ps1 -revoke

starchase · Jan 31, 2026

@goink
I may be crazy but it looks like you are just fine with the CA 2013 certs. You don't need to revoke the 2011 - I'm going to wait until Microsoft does it or until June. The risk of bad actors getting into my machine via the CA 2011 cert is virtually non existent.

goink · Jan 31, 2026

@garin

What does "powershell -ep bypass -f" do?

and

Do I need to run " install SkuSiPolicy.p7b" - is it run before or after "powershell -ep bypass -f .\Update_UEFI-CA2023.ps1 -revoke"? Or is this taken care of by running "powershell -ep bypass -f .\Update_UEFI-CA2023.ps1 -revoke"?

And all this is safe?

Sorry, I'm a bit of a Nervous Nelly, worried about bricking my machine somehow...

goink · Jan 31, 2026

OK. I see, "powershell -ep bypass -f" bypasses the PS Execution Policy enforcement limitation. I should have known this.

garlin · Jan 31, 2026

goink said:
Do I need to run " install SkuSiPolicy.p7b" - is it run before or after "powershell -ep bypass -f .\Update_UEFI-CA2023.ps1 -revoke"? Or is this taken care of by running "powershell -ep bypass -f .\Update_UEFI-CA2023.ps1 -revoke"?

I added a separate -SkuSiPolicy option if you wanted to enforce the SkuSiPolicy without revoking the CA 2011 certs.
But -Revoke includes the -SkuSiPolicy to everything at the same time.

goink said:
And all this is safe?

Generally yes. I've tested the scripts several hundred times, trying to see what unexpected things can happen. We're following the same overall steps as Windows does, but doing it all at once instead of waiting a mysterious amount of time to check whether the process finished or not. If it fails from an error, you will know right away.

The normal Windows update task is slow from paranoia. But I'd added extensive checking in the scripts, so it will only the logical steps that are required.

goink · Jan 31, 2026

@garlin

Thank you for your swift responses!

I read that running "powershell -ep bypass -f .\Update_UEFI-CA2023.ps1 -revoke" will do everything and clear the issues.

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

Attachments

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Active member

Attachments

My Computer

Active member

My Computer

Well-known member

My Computer

Active member

My Computer

Member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Member

My Computer

Member

My Computer

Well-known member

My Computer

Member

My Computer