Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

wilyoldbuzzard · Feb 12, 2026

Many thanks. I fixed the boot manager as instructed.

I've just used Delete all Security Boot Keys and then tried running the update script, but I now get the message: ERROR: This PC doesn't support Secure Boot.

garlin · Feb 12, 2026

wilyoldbuzzard said:
I've just used Delete all Security Boot Keys and then tried running the update script, but I now get the message: ERROR: This PC doesn't support Secure Boot.

Never seen that before. OK, just for you, I've made a version that removed the safety check.
Fingers crossed.

wilyoldbuzzard · Feb 12, 2026

Okay, I now get the output below. It's asking for a mount point... what do I need to enter?

PS C:\Windows\system32> powershell -nop -ep bypass -f E:\boot\WilyOldBuzzard_Update_UEFI-CA2023.ps1
Confirm-SecureBootUEFI : Variable is currently undefined: 0xC0000100
At E:\boot\WilyOldBuzzard_Update_UEFI-CA2023.ps1:1002 char:19
+ $SecureBoot = Confirm-SecureBootUEFI
+ ~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (Microsoft.Secur...BootUefiCommand:ConfirmSecureBootUefiCommand) [C
onfirm-SecureBootUEFI], StatusException
+ FullyQualifiedErrorId : GetFWVarFailed,Microsoft.SecureBoot.Commands.ConfirmSecureBootUefiCommand

Get-SecureBootUEFI : Variable is currently undefined: 0xC0000100
At E:\boot\WilyOldBuzzard_Update_UEFI-CA2023.ps1:1023 char:11
+ if (((Get-SecureBootUEFI SetupMode).Bytes -Join '') -eq 1) {
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (Microsoft.Secur...BootUefiCommand:GetSecureBootUefiCommand) [Get-S
ecureBootUEFI], StatusException
+ FullyQualifiedErrorId : GetFWVarFailed,Microsoft.SecureBoot.Commands.GetSecureBootUefiCommand

Downloading "edk2-x64-secureboot-binaries.zip" from GitHub.
Successfully wrote "Default3PDb.bin" to UEFI db.
Successfully wrote "DefaultDbx.bin" to UEFI dbx.

cmdlet Suspend-Bitlocker at command pipeline position 1
Supply values for the following parameters:
MountPoint[0]:

garlin · Feb 12, 2026

Please re-delete all your keys again. I've removed the Confirm-SecureBootUEFI call, and hardcoded Setup mode (since we know it's a special case).

wilyoldbuzzard · Feb 12, 2026

No errors now, but I still get this prompt for a mount point.

Downloading "edk2-x64-secureboot-binaries.zip" from GitHub.
Successfully wrote "Default3PDb.bin" to UEFI db.
Successfully wrote "DefaultDbx.bin" to UEFI dbx.

cmdlet Suspend-Bitlocker at command pipeline position 1
Supply values for the following parameters:
MountPoint[0]:

garlin · Feb 12, 2026

wilyoldbuzzard said:
No errors now, but I still get this prompt for a mount point.

You don't use BitLocker do you? I can remove that check.

wilyoldbuzzard · Feb 12, 2026

I don't use bitlocker, no.

garlin · Feb 12, 2026

3rd time's a charm?

wilyoldbuzzard · Feb 12, 2026

I think that did it, please see below. Thanks very much for your help, sorry to have been a bother. Anything else I need to do apart from run the two commands?

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
(NONE)

EFI Files
---------
Disk 2: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

AUDIT REPORT
============
1. [Production PCA 2011] is missing from UEFI DBX
2. Windows BootMgr SVN is missing from UEFI DBX

REQUIRED ACTION
===============

To revoke the [PCA 2011] cert, run the commands, run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x280 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

garlin · Feb 12, 2026

That actually worked, after bypassing all the safety checks!!

You're done on adding CA 2023 certs. If you want to finish the process by revoking the CA 2011 cert now (it's still optional as of today), you can re-run the update script with the -Revoke option on the command line.

wilyoldbuzzard · Feb 12, 2026

Haha, you sound surprised! I never doubted you for a microsecond

Thanks again,
wilyoldbuzzard

garlin · Feb 12, 2026

I'm surprised, because it's probably a really old BIOS that doesn't support all the specs of what the BIOS should be reporting to Windows. I might have to implement a "unsafe" mode to bypass safety checks to handle special cases like this (older PC's).

The reason it's challenging is I can't stand in front of your PC and try different things. Sending you a test script back and forth a few times doesn't work so well with some users. I'm happy that we got you squared away.

DarkShadowMD · Feb 12, 2026

Well, first of all, thank you so much, SO MUCH, for all the help. Thanks to this thread, I'm all set and running! I leave my latest outputs to check:

Desktop #1 & #2: (Using the same output because they are updated to same BIOS version)

Batch:

Windows PowerShell
Copyright (C) Microsoft Corporation. Todos los derechos reservados.

Instale la versión más reciente de PowerShell para obtener nuevas características y mejoras. https://aka.ms/PSWindows

Windows 11 25H2 (26200.6584)

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
    Micro-Star International Co. MS-7C95
    Version: 2.O1
    Date: 2025-09-15

Factory Default UEFI PK Cert
----------------------------
    MSI SHIP PK

UEFI PK Cert
------------
    MSI SHIP PK

Factory Default UEFI KEK Certs
------------------------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023
    MSI SHIP KEK

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023
    MSI SHIP KEK

Factory Default UEFI DB Certs
-----------------------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023
    MSI SHIP DB

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023
    MSI SHIP DB

Factory Default UEFI DBX Certs
------------------------------
    (NONE)
    EFI_CERT_SHA256_GUID Signatures: 416

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 7.0
    EFI_CERT_SHA256_GUID Signatures: 436

EFI Files
---------
    Disk 0: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        bootmgfw.efi File version: 26100.30227

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    Disk 0: SkuSiPolicy.p7b (for VBS) is CURRENT.


AUDIT REPORT
============
1.  Update W11 25H2 to KB5066835 (Oct 2025) or later

STATUS REPORT
-------------
    Registry: UEFICA2023Status = Updated

SUCCESS: NO UPDATES ARE REQUIRED.

PS C:\Windows\System32>

HP Laptop:

Batch:

Windows PowerShell
Copyright (C) Microsoft Corporation. Todos los derechos reservados.

Instale la versión más reciente de PowerShell para obtener nuevas características y mejoras. https://aka.ms/PSWindows

Windows 11 25H2 (26200.6584)

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
    HP HP Pavilion Laptop 15-eh3xxx
    Version: F.09
    Date: 2025-11-24

Factory Default UEFI PK Cert
----------------------------
    HP UEFI Secure Boot PK 2017

UEFI PK Cert
------------
    HP UEFI Secure Boot PK 2017

Factory Default UEFI KEK Certs
------------------------------
    Microsoft Corporation KEK CA 2011
    HP UEFI Secure Boot KEK 2017
    Microsoft Corporation KEK 2K CA 2023

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    HP UEFI Secure Boot KEK 2017
    Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    HP UEFI Secure Boot DB 2017
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    HP UEFI Secure Boot DB 2017
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
    Debian Secure Boot Signer
    Canonical Ltd. Secure Boot Signing
    EFI_CERT_SHA256_GUID Signatures: 190

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Debian Secure Boot Signer
    Canonical Ltd. Secure Boot Signing
    Windows BootMgr SVN 7.0
    EFI_CERT_SHA256_GUID Signatures: 445

EFI Files
---------
    Disk 0: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        bootmgfw.efi File version: 26100.30227

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    Disk 0: SkuSiPolicy.p7b (for VBS) is CURRENT.


AUDIT REPORT
============
1.  Update W11 25H2 to KB5066835 (Oct 2025) or later

STATUS REPORT
-------------
    Registry: UEFICA2023Status = Updated

SUCCESS: NO UPDATES ARE REQUIRED.

PS C:\Windows\System32>

I finally got a response from MSI via a ticket, and they told me that, in fact, if motherboards have a beta BIOS ready for update, dated 09-23-2025, it contains the new 2023 certificates in the database. Today I finally updated and revoked the 2011 certs for good.

I can rest...

I just have one last question: I have a Macrium Reflect V8 Rescue USB, and I assume it needs the new boot files. How can I update it to have that last bit of this journey fixed and safe?

Again, thank you SO MUCH!

garlin · Feb 12, 2026

FerchogtX said:
I just have one last question: I have a Macrium Reflect V8 Rescue USB, and I assume it needs the new boot files. How can I update it to have that last bit of this journey fixed and safe?

There's a couple of ElevenForum threads on Macrium recovery USB disks. I don't use Macrium myself, but one manual method is copying over the EFI boot file. It also depends on which version you used to create the drive (ADK, WinRE).

Copy over the boot file:

Code:

copy \Windows\Boot\EFI_EX\bootmgfw_EXI.efi E:\EFI\Boot\bootx64.efi

Revert the boot file:

Code:

copy \Windows\Boot\EFI\bootmgfw.efi E:\EFI\Boot\bootx64.efi

DarkShadowMD · Feb 12, 2026

Oh thanks!

I need to run both commands, right?

garlin · Feb 12, 2026

You run the first command, and try booting the Macrium V8 drive. If that doesn't work, run the second command to undo the change.

DarkShadowMD · Feb 12, 2026

Gotcha, will do it, I'll report results! Thanks!

gunrunnerjohn · Feb 12, 2026

garlin said:
I'm surprised, because it's probably a really old BIOS that doesn't support all the specs of what the BIOS should be reporting to Windows. I might have to implement a "unsafe" mode to bypass safety checks to handle special cases like this (older PC's).

The reason it's challenging is I can't stand in front of your PC and try different things. Sending you a test script back and forth a few times doesn't work so well with some users. I'm happy that we got you squared away.

I'm am somewhat awed that you were able to do this remotely! Nice job!

DarkShadowMD · Feb 12, 2026

Sadly, says the file cannot be found... -_-

garlin · Feb 12, 2026

Which file? The source file under "\Windows\Boot\EFI_EX\bootmgfw_EXI.efi, or the destination folder "E:\EFI\Boot"?
E: is the drive letter of the USB.

If there's no \EFI\Boot folder then it's the other longer method, which you have to check the Macrium threads on this forum.

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

New member

My Computer

Well-known member

Attachments

My Computer

New member

My Computer

Well-known member

Attachments

My Computer

New member

My Computer

Well-known member

My Computer

New member

My Computer

Well-known member

Attachments

My Computer

New member

My Computer

Well-known member

My Computer

New member

My Computer

Well-known member

My Computer

Peaceful Citizen

My Computers

Well-known member

My Computer

Peaceful Citizen

My Computers

Well-known member

My Computer

Peaceful Citizen

My Computers

Well-known member

My Computers

Peaceful Citizen

My Computers

Well-known member

My Computer