Solved garlin's PowerShell scripts for updating Secure Boot CA 2023


Wish me luck, I'll contact MSI and check if they ever released updates that include the certs

I know all motherboards aren’t the same, but I was able to do my ASUS ROG Maximus VI Formula. The last BIOS update for that was 2016.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 25H2 Build 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Sin-built 2013
    CPU
    Intel(R) Core(TM) i7-4770K CPU @ 3.50GHz
    Motherboard
    ASUS ROG Maximus VI Formula
    Memory
    32.0 GB of I forget and the box is in storage.
    Graphics Card(s)
    Gigabyte nVidia GeForce GTX 1660 Super OC 6GB
    Sound Card
    Onboard thingy
    Monitor(s) Displays
    5 x LG 25MS500-B - 1 x 24MK430H-B - 1 x Wacom Pro 22" Touch Screen Tablet
    Screen Resolution
    All over the place
    Hard Drives
    Too many to list.
    OS on Samsung 1TB 870 QVO SATA
    PSU
    Silverstone 1500
    Case
    NZXT Phantom 820 Full-Tower Case
    Cooling
    Noctua NH-D15 Elite Class Dual Tower CPU Cooler / 6 x EziDIY 120mm / 2 x Corsair 140mm somethings / 1 x 140mm Thermaltake something / 2 x 200mm Corsair.
    Keyboard
    Corsair K95 / Logitech diNovo Edge Wireless
    Mouse
    Logitech: G402 / G502 / Mx Masters / Mx Air Cordless
    Internet Speed
    2000/500Mbps
    Browser
    All sorts
    Antivirus
    Kaspersky Premium
    Other Info
    ㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
    TP-Link BE9300 WiFi 7 Bluetooth 5.4 (Archer TBE550E)
    TP-Link TX201 V1 2.5GB Lan

    Grandstream HT812 - VoIP
    ASUS DSL-AX82U - Mesh
    ASUS RT-AC68U - Mesh
    ASUS RT-BE88U Router

    Brother MFC-L2880DW Printer

    I’m on a horse.
  • Operating System
    Windows 11 Pro 25H2 Build 26200.8524
    Computer type
    Laptop
    Manufacturer/Model
    LENOVO Yoga 7 14IRL8 - 7i EVO OLED 14" Touchscreen i5 12 Core 16GB/512GB
    CPU
    Intel Core 12th Gen i5-1240P Processor (1.7 - 4.4GHz)
    Memory
    16GB LPDDR5 RAM
    Graphics card(s)
    Intel Iris Xe Graphics Processor
    Sound Card
    Optimized with Dolby Atmos®
    Screen Resolution
    QHD 2880 x 1800 OLED
    Hard Drives
    M.2 512GB
    Antivirus
    Defender / Malwarebytes
    Other Info
    …still on a horse.
B550M PRO-VDH WIFI apparently got a Secure Boot update in 2022. You have to scroll through the release notes, for each of the BIOS versions. Some vendors like HP are terrible, and don't appear to consistently provide release notes.

Run the check script with the "-Verbose" option, and it will report whether you have a supported PC. It may report you have a supported KEK image.
 

My Computer

System One

  • OS
    Windows 7
B550M PRO-VDH WIFI apparently got a Secure Boot update in 2022. You have to scroll through the release notes, for each of the BIOS versions. Some vendors like HP are terrible, and don't appear to consistently provide release notes.

Run the check script with the "-Verbose" option, and it will report whether you have a supported PC. It may report you have a supported KEK image.

Sure!

Desktop #1
Powershell:
Windows PowerShell
Copyright (C) Microsoft Corporation. Todos los derechos reservados.

Instale la versión más reciente de PowerShell para obtener nuevas características y mejoras. https://aka.ms/PSWindows

Windows 11 25H2 (26200.6584)

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
    Micro-Star International Co. MS-7C95
    Version: 2.D0
    Date: 2022-12-11

Factory Default UEFI PK Cert
----------------------------
    MSI SHIP PK

UEFI PK Cert
------------
    MSI SHIP PK

Factory Default UEFI KEK Certs
------------------------------
    Microsoft Corporation KEK CA 2011
    MSI SHIP KEK

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023
    MSI SHIP KEK

Factory Default UEFI DB Certs
-----------------------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
    Debian Secure Boot Signer
    Canonical Ltd. Secure Boot Signing
    EFI_CERT_SHA256_GUID Signatures: 191

UEFI DBX Certs
--------------
    Debian Secure Boot Signer
    Canonical Ltd. Secure Boot Signing
    Windows BootMgr SVN 7.0
    EFI_CERT_SHA256_GUID Signatures: 443

EFI Files
---------
    Disk 0: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        bootmgfw.efi File version: 26100.30227

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    Disk 0: SkuSiPolicy.p7b (for VBS) is CURRENT.


REQUIRED ACTION
===============

To revoke the [PCA 2011] cert, run the commands, run the commands:

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x80 /f
    powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

PS C:\Windows\System32>

Desktop #2
Powershell:
Windows PowerShell
Copyright (C) Microsoft Corporation. Todos los derechos reservados.

Instale la versión más reciente de PowerShell para obtener nuevas características y mejoras. https://aka.ms/PSWindows

Windows 11 25H2 (26200.6584)

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

BIOS Firmware
-------------
    Micro-Star International Co. MS-7C95
    Version: 2.F0
    Date: 2023-05-17

Factory Default UEFI PK Cert
----------------------------
    MSI SHIP PK

UEFI PK Cert
------------
    MSI SHIP PK

Factory Default UEFI KEK Certs
------------------------------
    Microsoft Corporation KEK CA 2011
    MSI SHIP KEK

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023
    MSI SHIP KEK

Factory Default UEFI DB Certs
-----------------------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
    Debian Secure Boot Signer
    Canonical Ltd. Secure Boot Signing
    EFI_CERT_SHA256_GUID Signatures: 191

UEFI DBX Certs
--------------
    Debian Secure Boot Signer
    Canonical Ltd. Secure Boot Signing
    Windows BootMgr SVN 7.0
    EFI_CERT_SHA256_GUID Signatures: 443

EFI Files
---------
    Disk 0: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        bootmgfw.efi File version: 26100.30227

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.


REQUIRED ACTION
===============

To revoke the [PCA 2011] cert, run the commands, run the commands:

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x80 /f
    powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

PS C:\Windows\System32>

Here goes my dude!
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Built PC
    CPU
    AMD Ryzen 5 5600G @ 3.9/4.4Ghz
    Motherboard
    MSI B550M-PRO-WiFi Ver. 1.4
    Memory
    2 x 16 GB DDR4 Kingston Fury Beast 3200 Mhz
    Graphics Card(s)
    AMD Radeon RX 6600 XT MSI Mech 2X OC Edition 8 GB
    Sound Card
    Realtek High Definition Audio (Integrated)
    Monitor(s) Displays
    Samsung C50Rx 27" LED / HP S2031 20" LCD
    Screen Resolution
    1920 x 1080 px / 1600 x 900 px
    Hard Drives
    WD Blue SN570 NVME M.2 SSD [1 TB] -- External Drives: - WD Scorpion Blue 250 GB 5400 RPM (Data Backup) - Hitachi 500 GB 5400 RPM (Software / ISOs Backup) - Toshiba MQ01ABD100 1 TB 5400 RPM (OS Images) - HGST TravelStar 7K1000 1 TB, 7200 RPM USB 3.0 - ADATA SU800 2TB SSD USB 3.0
    PSU
    Corsair RM750e 750W Fully Modular
    Case
    Naceb Hydra NA-1602
    Cooling
    Naceb Orpheus x 3 (Front) + Naceb Cepheus 1200 RPM Max (Rear) + ThemalRight Assasin X 90 SE (CPU)
    Keyboard
    Logitech MK470 Wireless
    Mouse
    Logitech MK470 Wireless
    Internet Speed
    120 MB Symetrical
    Browser
    Firefox / Brave / Edge
    Antivirus
    Windows Defender
    Other Info
    - VMs: WMware Player - Windows 8.1 Pro x64 / Windows 11 Pro
    - Wacom Intuos Pro Small Tablet PTH-460
  • Operating System
    Windows 11 Pro 25H2
    Computer type
    Laptop
    Manufacturer/Model
    HP Pavilion 15-eh3000la (80M53LA)
    CPU
    AMD Ryzen 7 7730U @ 2.0/4.5 Ghz
    Motherboard
    HP 8BC7
    Memory
    2 x 16 GB Kingston Fury Impact DDR4 3200 Mhz
    Graphics card(s)
    Radeon (tm) Graphics Vega 8 (512 MB)
    Sound Card
    Realtek High Definition Audio (Integrated)
    Monitor(s) Displays
    AU Optronics
    Screen Resolution
    1920 x 1080 px (125% size)
    Hard Drives
    WD Blue SN570 1TB NVME M.2 Drive
    PSU
    45 Watt Charger
    Cooling
    Laptop Cooling Pad
    Keyboard
    Free Wolf Foldable Portable Keyboard
    Mouse
    Free Wolf Wireless Mouse
    Internet Speed
    120 MB Symetrical
    Browser
    Firefox / Brave / Edge
    Antivirus
    Windows Defender
    Other Info
    - 41mWh battery.
    - Wacom Intuos Pro Small Tablet PTH-460
My desktop machine has an MSI B450M Bazooka motherboard, and the latest BIOS update (dated 2025-09-23) came with the 2023 certs.
There's one of the same date as yours... but is labeled as beta... I'm hesitant to install beta stuff... (Yes I know, I suck... -_-) That's why I'm asking since when the certs could be added, maybe in some of the 2025 updates prior to this one...

It's the only thing (and revoking the 2011 ones) that I'm missing so far XD
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Built PC
    CPU
    AMD Ryzen 5 5600G @ 3.9/4.4Ghz
    Motherboard
    MSI B550M-PRO-WiFi Ver. 1.4
    Memory
    2 x 16 GB DDR4 Kingston Fury Beast 3200 Mhz
    Graphics Card(s)
    AMD Radeon RX 6600 XT MSI Mech 2X OC Edition 8 GB
    Sound Card
    Realtek High Definition Audio (Integrated)
    Monitor(s) Displays
    Samsung C50Rx 27" LED / HP S2031 20" LCD
    Screen Resolution
    1920 x 1080 px / 1600 x 900 px
    Hard Drives
    WD Blue SN570 NVME M.2 SSD [1 TB] -- External Drives: - WD Scorpion Blue 250 GB 5400 RPM (Data Backup) - Hitachi 500 GB 5400 RPM (Software / ISOs Backup) - Toshiba MQ01ABD100 1 TB 5400 RPM (OS Images) - HGST TravelStar 7K1000 1 TB, 7200 RPM USB 3.0 - ADATA SU800 2TB SSD USB 3.0
    PSU
    Corsair RM750e 750W Fully Modular
    Case
    Naceb Hydra NA-1602
    Cooling
    Naceb Orpheus x 3 (Front) + Naceb Cepheus 1200 RPM Max (Rear) + ThemalRight Assasin X 90 SE (CPU)
    Keyboard
    Logitech MK470 Wireless
    Mouse
    Logitech MK470 Wireless
    Internet Speed
    120 MB Symetrical
    Browser
    Firefox / Brave / Edge
    Antivirus
    Windows Defender
    Other Info
    - VMs: WMware Player - Windows 8.1 Pro x64 / Windows 11 Pro
    - Wacom Intuos Pro Small Tablet PTH-460
  • Operating System
    Windows 11 Pro 25H2
    Computer type
    Laptop
    Manufacturer/Model
    HP Pavilion 15-eh3000la (80M53LA)
    CPU
    AMD Ryzen 7 7730U @ 2.0/4.5 Ghz
    Motherboard
    HP 8BC7
    Memory
    2 x 16 GB Kingston Fury Impact DDR4 3200 Mhz
    Graphics card(s)
    Radeon (tm) Graphics Vega 8 (512 MB)
    Sound Card
    Realtek High Definition Audio (Integrated)
    Monitor(s) Displays
    AU Optronics
    Screen Resolution
    1920 x 1080 px (125% size)
    Hard Drives
    WD Blue SN570 1TB NVME M.2 Drive
    PSU
    45 Watt Charger
    Cooling
    Laptop Cooling Pad
    Keyboard
    Free Wolf Foldable Portable Keyboard
    Mouse
    Free Wolf Wireless Mouse
    Internet Speed
    120 MB Symetrical
    Browser
    Firefox / Brave / Edge
    Antivirus
    Windows Defender
    Other Info
    - 41mWh battery.
    - Wacom Intuos Pro Small Tablet PTH-460
AvailableUpdates = 0x80 means the only pending action is to revoke CA 2011 now (or later this year).
 

My Computer

System One

  • OS
    Windows 7
Yup... I also look into getting the default certs missing by updating BIOS... Whenever I know any of the 2025 updates on MSI has them... -_-;

I mean, as you can see all is perfect now thanks to your support, I'm just looking into getting that last bit... I mean, probably I'll just revoke the certs in all my PC's once I complete the quest XD

really, thanks mate, you have been an angel. :D
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Built PC
    CPU
    AMD Ryzen 5 5600G @ 3.9/4.4Ghz
    Motherboard
    MSI B550M-PRO-WiFi Ver. 1.4
    Memory
    2 x 16 GB DDR4 Kingston Fury Beast 3200 Mhz
    Graphics Card(s)
    AMD Radeon RX 6600 XT MSI Mech 2X OC Edition 8 GB
    Sound Card
    Realtek High Definition Audio (Integrated)
    Monitor(s) Displays
    Samsung C50Rx 27" LED / HP S2031 20" LCD
    Screen Resolution
    1920 x 1080 px / 1600 x 900 px
    Hard Drives
    WD Blue SN570 NVME M.2 SSD [1 TB] -- External Drives: - WD Scorpion Blue 250 GB 5400 RPM (Data Backup) - Hitachi 500 GB 5400 RPM (Software / ISOs Backup) - Toshiba MQ01ABD100 1 TB 5400 RPM (OS Images) - HGST TravelStar 7K1000 1 TB, 7200 RPM USB 3.0 - ADATA SU800 2TB SSD USB 3.0
    PSU
    Corsair RM750e 750W Fully Modular
    Case
    Naceb Hydra NA-1602
    Cooling
    Naceb Orpheus x 3 (Front) + Naceb Cepheus 1200 RPM Max (Rear) + ThemalRight Assasin X 90 SE (CPU)
    Keyboard
    Logitech MK470 Wireless
    Mouse
    Logitech MK470 Wireless
    Internet Speed
    120 MB Symetrical
    Browser
    Firefox / Brave / Edge
    Antivirus
    Windows Defender
    Other Info
    - VMs: WMware Player - Windows 8.1 Pro x64 / Windows 11 Pro
    - Wacom Intuos Pro Small Tablet PTH-460
  • Operating System
    Windows 11 Pro 25H2
    Computer type
    Laptop
    Manufacturer/Model
    HP Pavilion 15-eh3000la (80M53LA)
    CPU
    AMD Ryzen 7 7730U @ 2.0/4.5 Ghz
    Motherboard
    HP 8BC7
    Memory
    2 x 16 GB Kingston Fury Impact DDR4 3200 Mhz
    Graphics card(s)
    Radeon (tm) Graphics Vega 8 (512 MB)
    Sound Card
    Realtek High Definition Audio (Integrated)
    Monitor(s) Displays
    AU Optronics
    Screen Resolution
    1920 x 1080 px (125% size)
    Hard Drives
    WD Blue SN570 1TB NVME M.2 Drive
    PSU
    45 Watt Charger
    Cooling
    Laptop Cooling Pad
    Keyboard
    Free Wolf Foldable Portable Keyboard
    Mouse
    Free Wolf Wireless Mouse
    Internet Speed
    120 MB Symetrical
    Browser
    Firefox / Brave / Edge
    Antivirus
    Windows Defender
    Other Info
    - 41mWh battery.
    - Wacom Intuos Pro Small Tablet PTH-460
But the catch is pbatard really doesn't like going on public forums and answering support questions (at length).

Huh, excuse me?

I didn't know I had a spokesperson here...

I am not disparaging your utilities, so I would appreciate if you didn't try to disparage mine, or my alleged attitude towards support, which is at the opposite of what you claim it is.

I have no problem answering support questions (at length), and I have a long history, over all the many Open Source projects I got involved with, of doing so (heck, with other people, we've been going over the UEFI cert expiration issue long before it started to be discussed here). I however expect that they will be directed to the proper avenue for support, which are the Mosby issue tracker or any other relevant dedicated support thread (such as, if you want an example from a forum, the dedicated Rufus support thread from mydigitallife where you will find I answer almost immediately if someone asks a relevant question). And my direct e-mail is plastered in all the software I produce, meaning that, if you want to get directly in touch with me, you can.

I hope you can appreciate, one, that forums are NOT actually a great place to solve support questions, on account that questions and answers get too easily buried into lengthy threads, that will often go off-topic, and two, that developers can simply NOT go around looking for mentions of their software in all the user forums that exist out there (yeah, I pointed to a concurrent user forum for a good reason, because there are plenty of such forums besides elevenforum) and for threads they receive zero notification for.

Or am I supposed to be a precog and get subliminal notification that someone posted something about Mosby in a completely new thread? Am I supposed to have nothing better to do than browse user forums all day?

So that is why, rather than very erroneously trying to qualify my involvement with supporting Mosby or other software I produce as reluctant, you may want to change your perspective for a few seconds, and realise why the standard that you infer I should be adhering to is bullshit, and why, I keep hammering over and over on these forums that, I will be more than happy to answer support questions for my software, at length, as long as you use the proper channels to do so.

And please, do refrain from trying to assertively represent other people or their likes/dislikes in the future.
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Built
    Screen Resolution
    4k
I am not disparaging your utilities, so I would appreciate if you didn't try to disparage mine, or my alleged attitude towards support, which is at the opposite of what you claim it is.
I definitely haven't disparaged Mosby, other than pointing it's a different approach (self-signing), which I have also explained is a norm in the Linux world but not for Windows.

I have no problem answering support questions (at length), and I have a long history, over all the many Open Source projects I got involved with, of doing so (heck, with other people, we've been going over the UEFI cert expiration issue long before it started to be discussed here). I however expect that they will be directed to the proper avenue for support, which are the Mosby issue tracker or any other relevant dedicated support thread (such as, if you want an example from a forum, the dedicated Rufus support thread from mydigitallife where you will find I answer almost immediately if someone asks a relevant question). And my direct e-mail is plastered in all the software I produce, meaning that, if you want to get directly in touch with me, you can.

I hope you can appreciate, one, that forums are NOT actually a great place to solve support questions, on account that questions and answers get too easily buried into lengthy threads, that will often go off-topic, and two, that developers can simply NOT go around looking for mentions of their software in all the user forums that exist out there (yeah, I pointed to a concurrent user forum for a good reason, because there are plenty of such forums besides elevenforum) and for threads they receive zero notification for.
MDL and GitHub are open places to provide feedback and ask for help. But you know they are specialist places, and the people who engage there are self-selecting. The average Windows user doesn't know about them, or probably doesn't know how to engage a dev through GitHub issues.

That filters the engagement, and if you wanted to support Mosby on ElevenForum you would have contributed more replies on your own.

So that is why, rather than very erroneously trying to qualify my involvement with supporting Mosby or other software I produce as reluctant, you may want to change your perspective for a few seconds, and realise why the standard that you infer I should be adhering to is bullshit, and why, I keep hammering over and over on these forums that, I will be more than happy to answer support questions for my software, at length, as long as you use the proper channels to do so.
Then make this point clear for the other folks. Tell them where and how to find you.

You also need a perspective change. Not everyone is as technical, and sometimes more effort is required to get a point across to a different audience. Those users are just as deserving to get help for their problems. Folks like me are trying hard to bridge that gap.

If you go on a forum suggesting someone use your tool, then clearly explain how they should find you. And maybe return to see how the discussion is going. Did I expect some of the Secure Boot threads to go over 154 pages when we started? No.

No one's trying to bring you down. If you're not actively engaged in place like ElevenForum, that's your perogative. But it's fair to make that observation that your prolonged absence means users aren't getting timely answers to their Mosby questions. If they can't get the answers, then users have to move on to other solutions where they're getting active support.
 

My Computer

System One

  • OS
    Windows 7
If I may add something to this from a user perspective... I did have an USB with Mosby installed... but I ended up going to this thread instead, because I saw a more friendly post instructing me on how to's and people willing to answer questions and give support. I've tried asking questions about Mosby here, but nobody knew if it even worked on a VM, to try the utility before deploying on a live system.

So... I better came here and found support. My problem is solved.

Maybe, just maaaaaaaaaaaybe be more clear in things like where to contact you for direct support. I'm not a tech illiterate, but this thing was superior to me, made me learn a couple of things, but more importantly, understand what I was gonna do. This certs thing has been a mess since day 1, and only here I found the info I needed to get this fixed.

Don't take it personally, after all is constructive critique... it helps sometimes ;)
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Built PC
    CPU
    AMD Ryzen 5 5600G @ 3.9/4.4Ghz
    Motherboard
    MSI B550M-PRO-WiFi Ver. 1.4
    Memory
    2 x 16 GB DDR4 Kingston Fury Beast 3200 Mhz
    Graphics Card(s)
    AMD Radeon RX 6600 XT MSI Mech 2X OC Edition 8 GB
    Sound Card
    Realtek High Definition Audio (Integrated)
    Monitor(s) Displays
    Samsung C50Rx 27" LED / HP S2031 20" LCD
    Screen Resolution
    1920 x 1080 px / 1600 x 900 px
    Hard Drives
    WD Blue SN570 NVME M.2 SSD [1 TB] -- External Drives: - WD Scorpion Blue 250 GB 5400 RPM (Data Backup) - Hitachi 500 GB 5400 RPM (Software / ISOs Backup) - Toshiba MQ01ABD100 1 TB 5400 RPM (OS Images) - HGST TravelStar 7K1000 1 TB, 7200 RPM USB 3.0 - ADATA SU800 2TB SSD USB 3.0
    PSU
    Corsair RM750e 750W Fully Modular
    Case
    Naceb Hydra NA-1602
    Cooling
    Naceb Orpheus x 3 (Front) + Naceb Cepheus 1200 RPM Max (Rear) + ThemalRight Assasin X 90 SE (CPU)
    Keyboard
    Logitech MK470 Wireless
    Mouse
    Logitech MK470 Wireless
    Internet Speed
    120 MB Symetrical
    Browser
    Firefox / Brave / Edge
    Antivirus
    Windows Defender
    Other Info
    - VMs: WMware Player - Windows 8.1 Pro x64 / Windows 11 Pro
    - Wacom Intuos Pro Small Tablet PTH-460
  • Operating System
    Windows 11 Pro 25H2
    Computer type
    Laptop
    Manufacturer/Model
    HP Pavilion 15-eh3000la (80M53LA)
    CPU
    AMD Ryzen 7 7730U @ 2.0/4.5 Ghz
    Motherboard
    HP 8BC7
    Memory
    2 x 16 GB Kingston Fury Impact DDR4 3200 Mhz
    Graphics card(s)
    Radeon (tm) Graphics Vega 8 (512 MB)
    Sound Card
    Realtek High Definition Audio (Integrated)
    Monitor(s) Displays
    AU Optronics
    Screen Resolution
    1920 x 1080 px (125% size)
    Hard Drives
    WD Blue SN570 1TB NVME M.2 Drive
    PSU
    45 Watt Charger
    Cooling
    Laptop Cooling Pad
    Keyboard
    Free Wolf Foldable Portable Keyboard
    Mouse
    Free Wolf Wireless Mouse
    Internet Speed
    120 MB Symetrical
    Browser
    Firefox / Brave / Edge
    Antivirus
    Windows Defender
    Other Info
    - 41mWh battery.
    - Wacom Intuos Pro Small Tablet PTH-460
If I may add something to this from a user perspective... I did have an USB with Mosby installed... but I ended up going to this thread instead, because I saw a more friendly post instructing me on how to's and people willing to answer questions and give support. I've tried asking questions about Mosby here, but nobody knew if it even worked on a VM, to try the utility before deploying on a live system.

;)
It´s not possible to run Mosby in a VM. Mosby works at the firmware level, outside of Windows.
 

My Computer

System One

  • OS
    Windows 10
Well I dunno about that. Depends on how the UEFI is emulated.

For example, VMware lacks a "Setup Mode" but you can pretend it exists by resetting the existing keys (deleting your VM's .nvramrc), wait for VMware to repopulate the keys from the BIOS default, and manually delete those keys (one by one) in the VM's Secure Boot menu.

Now you have empty PK, KEK, DB and DBX variables.

Someone might accuse me of speaking out of turn, but I would assume this other tool would work in that setup. But MS created the "Windows OEM Devices PK" set of Default .bin files to handle unsupported devices (from Setup Mode).

If someone preferred a more MS-based solution, that would be the logical choice.
 

My Computer

System One

  • OS
    Windows 7
But you know they are specialist places

More specialist than a dedicated issue tracker for the software?

Look, I know it's easy for people who spend a lot of time in a few places to have their visions skewed into believing that, because they wander there, these places somehow happen to be the most relevant places in the world. But, again, you might want to broaden your horizons a bit, as it might change your perspective.

if you wanted to support Mosby on ElevenForum you would have contributed more replies on your own.

Same thing. If I wanted to support Mosby, when there is a dedicated issue tracker featuring prominently at the place where people download it, why should I have to go, and actively search for topics related to Mosby, on 10 different user forums or more, to try to support it. If anything, I'd see reddit as the second best place to look after the issue tracker, to look for support requests with Mosby (which I do try to monitor), as it's a lot more universal.

Then make this point clear for the other folks. Tell them where and how to find you.

I have done it over and over again, in the threads you complain that I don't post enough. Which leads me to think that, exactly as I was pointing out, important information does get lost in user forums such as this one, and, unless you have a dedicated thread for support on a specific software, makes general user forums, even technical ones dedicated to Windows (are you aware that, unlike your script, Mosby is not a Windows utility at all?) a poor place for support.

Your vision is skewed, because you created a Windows specific utility as the starting point of a thread on a Windows centric user forum. And now you are trying to apply that lens to something completely different, yet don't realise that your specific experience does not translate to everything else.

By the way, are you actively searching on reddit for support requests related to your script? Are there any posts from you there? Coz, if you wanna point the finger at someone not doing enough to support their products, I can easily point you to existing posts I made on reddit related to Mosby, which I obviously had to actively search for, so please don't assume that because you don't see their efforts in the small lens through which you are looking at them, someone is not actively trying to support their stuff.


You also need a perspective change. Not everyone is as technical, and sometimes more effort is required to get a point across to a different audience. Those users are just as deserving to get help for their problems. Folks like me are trying hard to bridge that gap.

If you are only doing it here, then colour me unimpressed. "I don't see someone enough in my neck of the woods, so I'm going to assume that they must be idling elsewhere rather than working as hard, if not harder, as I do, so support their users".

Newsflash: Elevenforum is just one of many, many, places where people can engage in technical discussion. Trying to push it as the bee's knees, just because it happens to be the place you elected to spend a vast majority of your time, doesn't make it so.

If you go on a forum suggesting someone use your tool, then clearly explain how they should find you.

I did. There's a post somwhere in the "Did you update your secure boot keys...?" thread, and I'm pretty sure it's one of the first posts I made there, where I did just that.

And maybe return to see how the discussion is going.

I did. The "Did you update your secure boot keys..." thread kinda died. Then I discovered that there was another new thread, where people mentioned Mosby. I think I posted there, which I think got people logging an issue in the Mosby issue tracker. And today (because I am actually busy, and can't spend my days on elevenforums), I discovered that there was yet another new thread (this one) where people started to mention Mosby.

As I already pointed out, which you seem to assert is due to me not caring rather than being busy, I can't spend my time going through every forum to check if a new thread might mention Mosby.

So, every few weeks or so, when I actually have some gap (you can thank Microsoft changing their requirements to be able to sign UEFI bootloaders for Secure Boot, which currently prevents my company from being able to do so, hence some unexpected downtime), I will go around and check the various software I produce (Mosby is only one of them) for mentions.

But hey, I guess being busy and not checking elevenforum every single hour is sign of a poor level of user commitment...

Did I expect some of the Secure Boot threads to go over 154 pages when we started? No.

I did. Especially after seeing the mess and lack of clarity Microsoft made of it from looking at it right from its inception, and the fact that the issue in the Rufus issue tracker has devolved into one of the longest topics I have there, even though we were only concerned by the most technical aspects of it, and had very few particpants. As far as I am concerned, on a site like elevenforum, it was bound to devolve into lengthy thread. Which breeds repeating the same thing over and over and over, and you can deduce the rest.

No one's trying to bring you down. If you're not actively engaged in place like ElevenForum, that's your perogative.

No, that's a logical constraint. Trying to paint it any other way is very disingenuous on your part.

But it's fair to make that observation that your prolonged absence means users aren't getting timely answers to their Mosby questions.

Again, the reason why I push people towards the dedicated issue tracker (and expect people like you who are aware of Mosby, and by all means should have seen the posts where I point people to use the issue tracker if they have an issue with it -- Wanna help people? How about you direct them there if they seem to have an issue with Mosby, just like, if someone has an issue with your script on the Mosby issue tracker, I would direct them here. I genuinely would have expected you to do just that instead of seemingly complaining that "The Mosby developer isn't visit elevenforum often enough, boo!"), is that the minute someone posts something there, I get notified. But here, someone can start a new thread about updating their certs, then 5 pages later, someone will mention they have an issue with Mosby, and I OBVIOUSLY don't get any notification about that. Yet, I'm somehow at fault for that, on account that you (apparently) have made this forum your home, and (from what I can tell) have the ability to spend an afwul lot of time perusing new threads, whereas constraints dictate that I simply cannot do that.

If they can't get the answers, then users have to move on to other solutions where they're getting active support.

The issue tracker feature prominently on the page where people download Mosby. And people do get active support there.

Please don't conflate active support with getting support on the place you decided to spend time, which may or may not happen to fit others, for a multitude of reasons.

Which brings us to another very real downsite of user forums like this one, where, and this is something I alluded to above, people start to look at things through the very narrow lens of "you should belong here", and if you start to express even the remotest idea that, no, this forum is not the most bestest place on the internet for various things (such as providing support for software that is not directly related to Windows 11 -- Mosby is as much for Linux folks as it is for Windows folks), some people will be adament to try to prove to other (from the same flock, so it's a lot easier to get the message across) that you are "somehow" a bad actor and not as great as the good folks who frequent this neck of the wood.

Which brings me to the point, again, that, because I want to be inclusive for support, and not suddenly grant one of the many places outside the issue tracker more prominence than it should really have, I cannot spend every day seeking for new threads that happen to mention "Mosby" here (but, because I am actually more dedicated to support my product that you give me credit for, the proof being that I found this thread, I will continue to try to look for those, here AND ELSEWHERE, every few weeks or so).
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Built
    Screen Resolution
    4k
Hi all,

any pointers on why I might be seeing this error (Illegal characters in path) ? tried on multiple HP Business devices and all get the same error (Update Bios etc)
Also tried another script found on this forum site


Screenshot 2026-02-11 084315.webp
 

My Computer

System One

  • OS
    Windows 11
Hi all,

any pointers on why I might be seeing this error (Illegal characters in path) ? tried on multiple HP Business devices and all get the same error (Update Bios etc)
Also tried another script found on this forum site


View attachment 162918
Just in case this helps anyone else. I figured out the issue was when mounting the bootmgfw.efi file.


To resolve the issue I added the following code before line 1157

IF((Test-Path $BootMgr_File) -eq $False){
mountvol B: /S
$BootMgr_File = "B:\EFI\Microsoft\Boot\bootmgfw.efi"
}

and

mountvol B: /D

at the end of the script.

Assuming nothing in my environment is using B: for anything.
Script now completes and shows expected results.

Thanks @garlin for this script, this is really going to help us understand what's left to do in our environment.
 

My Computer

System One

  • OS
    Windows 11
Hi all,

any pointers on why I might be seeing this error (Illegal characters in path) ? tried on multiple HP Business devices and all get the same error (Update Bios etc)
Also tried another script found on this forum site


View attachment 162918
I've written this w/o seeing your post #494. Glad you got it fixed. FWIW.

Is that the complete output of

Check_UEFI-CA2023.ps1 -verbose

or

Check_UEFI-CA2023.ps1 -audit -verbose ?

What is the complete path from where you've run either of the two?
or
Does it have "special" characters?

With the horror stories I've heard about HP's Secure Boot, if it's booting and working fine a good option is leaving it alone. The part that can be seen is normal except the error. I cannot know what importance should it have.

For instance Idk myself if you or an app could store photos in the ESP and, regardless of how much useful would it be instead of a normal path in C: or a data disk, if the UEFI-GPT boot with Secure Boot included or not would just ignore the jpgs or throw an error, or if such hypothetical redundant files could cause the script to throw it. Another option is that your Powershell might be doing it for any script, or for some of them. W/o more context there're zillions of possible causes.

I'm not in my Windows 11 now so I cannot use the script myself right now. This is an "imperfect" report I have posted elsewhere (it lacks the command I've run, that is "Check_UEFI-CA2023.ps1 -audit -verbose"). If you want, copy-paste the text between the tags [ code ] [ / code ] (like below) or [ quote ] [ / quote ] (like above), in both cases w/o the spaces.

Code:
Windows 11 25H2 (26200.7623)

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
    Fanless Mini PC Quieter2
    Version: 10.1
    Date: 2021-07-24

Factory Default UEFI PK Cert
----------------------------
    DO NOT TRUST - AMI Test PK

UEFI PK Cert
------------
    Windows OEM Devices PK

Factory Default UEFI KEK Certs
------------------------------
    Microsoft Corporation KEK CA 2011

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
    (NONE)
    EFI_CERT_SHA256_GUID Signatures: 77

UEFI DBX Certs
--------------
    (NONE)
    Windows BootMgr SVN is MISSING.
    EFI_CERT_SHA256_GUID Signatures: 481

EFI Files
---------
    Disk 0: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        bootmgfw.efi File version: 26100.30227

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    Disk 0: SkuSiPolicy.p7b (for VBS) is CURRENT.


AUDIT REPORT
============
1.  [Production PCA 2011] is missing from UEFI DBX
2.  Windows BootMgr SVN is missing from UEFI DBX


REQUIRED ACTION
===============

To revoke the [PCA 2011] cert, run the commands, run the commands:

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x280 /f
    powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

PS C:\Windows\System32>
 

My Computer

System One

  • OS
    Windows 11
    Manufacturer/Model
    MeLE Quieter 2Q (fanless miniPC)
    CPU
    Celeron J4125 (10th gen)
    Memory
    8GB DDR4
    Monitor(s) Displays
    Samsung SyncMaster T260
    Screen Resolution
    1920x1200
    Hard Drives
    256GB eMMC (Windows)
    2TB USB3 HDD Toshiba (Data)
Just in case this helps anyone else. I figured out the issue was when mounting the bootmgfw.efi file.


To resolve the issue I added the following code before line 1157

IF((Test-Path $BootMgr_File) -eq $False){
mountvol B: /S
$BootMgr_File = "B:\EFI\Microsoft\Boot\bootmgfw.efi"
}

and

mountvol B: /D

at the end of the script.

Assuming nothing in my environment is using B: for anything.
Script now completes and shows expected results.

Thanks @garlin for this script, this is really going to help us understand what's left to do in our environment.

I don't use mountvol to locate the EFI partition. Instead, it's identified by asking for the UNC path (\\?\) of the current Windows's EFI partition. Using the UNC path I can read the EFI volume's contents without using a mountvol.

Can your copy of the script print out the $EFI_Path variable for me? Thanks.
 

My Computer

System One

  • OS
    Windows 7
I'm not as smart as I would like to think. I have all the updates installed for the 2023 certs and I verified it too. Here's my challenge, I've built a new USB boot stick with the latest 25H2 iso using Rufus 4.12. When I try to boot from it, it says there's something wrong with the USB stick. Rufus has an option to add the 2023 certs when building the boot stick, tried it both with and without the certs to no avail. Anyone have an idea what's going on, the stick works without issue on a unsupported device?
 

My Computer

System One

  • OS
    Windows 11
it says there's something wrong with the USB stick.

Maybe run a bad blocks check of your USB stick (which Rufus can do, under advanced format options) or try a different one.
It would also help if you provided the exact error message you get then.

Note that, if you have the 2023 certs installed, and haven't revoked the 2011 PCA one, then either selecting or not selecting the 2023 option in Rufus should work.
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Built
    Screen Resolution
    4k
Hi @JLArranz and @garlin,

I had tried running Check_UEFI-CA2023.ps1 -verbose and Check_UEFI-CA2023.ps1.
I had not tried with the -Audit
I had also tried initially with the files on a network share and then tried Downloads and desktop. In all cases I was still facing the same message.

These devices were all original loaded with windows using a custom SCCM image where many of the steps date back many years so this could very well be the issue.
I will try on some other test devices tomorrow to verify $EFI_Path output and report back.
 

My Computer

System One

  • OS
    Windows 11
Maybe run a bad blocks check of your USB stick (which Rufus can do, under advanced format options) or try a different one.
It would also help if you provided the exact error message you get then.

Note that, if you have the 2023 certs installed, and haven't revoked the 2011 PCA one, then either selecting or not selecting the 2023 option in Rufus should work.
Thanks for the suggestions, I did try it a different USB boot stick with a 26H1 iso, same issue. One thing I found odd is Rufus was really slow building the USB stick, but it's really fast building one on an old unsupported device. I'll try to get the exact error message and post it for others to see as I'm sure it would be helpful.IMG_20260211_123305.webp
 
Last edited:

My Computer

System One

  • OS
    Windows 11
Back
Top Bottom