Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Dirtyflash said:

@garlin is there a way for the Update script to run and leave the Lenovo PK in place? It seems when running the update it blows out the Lenovo key and tries to replace it, which is restricted and generates an error. Otherwise from my previous post you can see everything else installed nicely. I've reset the Factory Keys and fixed the bootloader so that I could turn Secure Boot back on.

Click to expand...

garlin said:

1. The normal mode of the update script tries to only append Secure Boot keys. It's very safe because if you have a PK (of any sort) in place, then only appends are allowed in the UEFI security model.

2. The script can detect you have a valid PK, but no KEK CA 2023. Then it will copy the KEK CA 2023 cert in file format to the EFI partition. And now you have to help the script by going into your UEFI menu and enrolling it.

3. The script can detect you're in Setup Mode, then it overwrites the PK with the Windows OEM Devices PK (provided by MS). It's done because your vendor hasn't signed a KEK for MS (yet).

I suspect for some users, the script has a bug where it's incorrectly detecting Setup Mode, and skipping past 1 and 2. Working on a possible fix.

Click to expand...

TheVisitor said:

@ garlin, here is the audit report:
PS C:\WINDOWS\system32> powershell -nop -ep bypass -f C:\temp\check_uefi-ca2023.ps1 -Verbose -Audit
Windows 11 25H2 (26200.7462)

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
HP HP Pavilion Desktop TP01-1xxx
Version: F.54
Date: 2025-08-03

Factory Default UEFI PK Cert
----------------------------
(NONE)

UEFI PK Cert
------------
(NONE)
[KEK CA 2023] Update is available from HP or Microsoft.

Click to expand...

powershell -nop -ep bypass -f C:\temp\WhatsMyPK.ps1

Subject      : CN=UEFI PK, OU=VirtualBox, O=Oracle Corporation, L=Redwood City, S=California, C=US
Issuer       : CN=UEFI PK, OU=VirtualBox, O=Oracle Corporation, L=Redwood City, S=California, C=US
Thumbprint   : 71294BE55141D77AC2901618E69F8A6DCA7E8B9D
FriendlyName :
NotBefore    : 9/29/2021 12:26:17 PM
NotAfter     : 1/15/2038 11:26:17 AM
Extensions   : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid}

garlin said:

Thank you!! That explains why the update script's been failing for several users. HP's PK certificate uses a different ordering for the "CN=" part. Which confuses my string parser, which expects it to be different, and falsely claims there's no PK cert.

I'll go work on a fix tonight.

Click to expand...

Dirtyflash said:

Here the output from the unsupported device if it's of any interest:

Click to expand...

    "7b4d9735151cb81afdc09531ebbff2f0e3588775": {
        "KEKUpdate": "Lenovo/KEKUpdate_Lenovo_PK2.bin",
        "Certificate": {
            "serial_number": "91dafcdb9605b0d8",
            "issued_to": "[email protected],CN=TPCDL-KEK,OU=TPCDL,O=Lenovo(Beijing) Ltd.,L=Beijing,ST=Beijing,C=CN",
            "issued_by": "[email protected],CN=TPCDL-KEK,OU=TPCDL,O=Lenovo(Beijing) Ltd.,L=Beijing,ST=Beijing,C=CN"
        }
    },

Fracer said:

And here is another sample, one of my problematical machines, a Lenovo M83 desktop:

Subject : CN=DO NOT TRUST - AMI Test PK
Issuer : CN=DO NOT TRUST - AMI Test PK
Thumbprint : 9A3056B5260F628645B4D9AC61AEBD8060305C3E
FriendlyName :
NotBefore : Wed 03 06 2013 08:16:55 AM
NotAfter : Mon 03 06 2017 08:16:54 AM
Extensions : {System.Security.Cryptography.Oid}

Click to expand...

Windows 11 25H2 (26200.7462)

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
ASUS All Series
Version: 2503
Date: 2016-02-26

Factory Default UEFI PK Cert
----------------------------
(NONE)

UEFI PK Cert
------------
(NONE)

Factory Default UEFI KEK Certs
------------------------------
(NONE)

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
(NONE)

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
(NONE)
Get-SecureBootUEFI : Variable is currently undefined: 0xC0000100
At H:\DOWNLOADS\SecureBoot-CA-2023-Updates\check_uefi-ca2023.ps1:1079 char:62
+ ... gnatures: {1}' -f $Tab4, (Get-SecureBootUEFI -Name dbxDefault | Get-U ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (Microsoft.Secur...BootUefiCommand:GetSecureBootUefiCommand) [Get-S
ecureBootUEFI], StatusException
+ FullyQualifiedErrorId : GetFWVarFailed,Microsoft.SecureBoot.Commands.GetSecureBootUefiCommand


UEFI DBX Certs
--------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 7.0
EFI_CERT_SHA256_GUID Signatures: 438

EFI Files
---------
Disk 0: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
bootmgfw.efi File version: 26100.30227

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

Disk 0: SkuSiPolicy.p7b (for VBS) is NOT PRESENT.


AUDIT REPORT
============
1. Secure Boot is DISABLED
2. SkuSiPolicy.p7b (for VBS) is missing


REQUIRED ACTION
===============

To install SkuSiPolicy.p7b, run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x20 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Click to expand...

gunrunnerjohn said:

@garlin Hi,

Is there an alternate way to install the SkuSiPolicy.p7b? I've tried the following several times, but I still get the same error. I'm running Win 11 Pro 25H2, Build 26220.7523.

View attachment 158768

Click to expand...