Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

HuntyFtw · Apr 8, 2026

garlin said:
You're missing KEK CA 2023, which is the important one.

Depending on your BIOS, there's normally a setting for Custom (non-factory) mode. Once enabled, there might be an option to Remove All Keys or something similar to wipe all the current certs. This leaves your Secure Boot UEFI in a blank state, where we can install the MS provided Windows OEM Devices PK as a replacement set of certs.

That part is a little tricky, the exact screens or wording can be different on your BIOS version. Otherwise you may have menu options to delete individual keys, and you can try deleting all of them until none are left.

Thanks for the reply. This is what my BIOS looks like:

Is it the option "Erase all Secure Boot setting"?

garlin · Apr 8, 2026

I believe so.

garlin · Apr 8, 2026

UPDATE:

I have released a (long overdue) update to version 2026.04.01, on post #1 and on GitHub.

Mostly bug fixes for everything reported in the past two months:

1. Suspend-BitLocker script function unintentionally has the same name as the Suspend-BitLocker command

2. Change the recommendation to install SkuSiPolicy.p7b from mandatory to optional

3. Get-UEFICert function returns (NONE) for Gigabyte and other cert signers

4. Get-SecureBootUEFI isn't properly trapped for 0xC0000100 errors in multiple script functions

5. Update the EDK2 binaries zip file to version 1.6.4

6. Check if the PK key contains an incorrectly enrolled KEK certificate

7. Check_UEFI-CA2023.ps1 doesn't correctly handle a blank date for BIOS ReleaseDate

8. Add warning that HP BIOS'es missing the "SBKPFV3" tag in the version string are unsupported

9. Update the function Confirm-MinimumUBR to report newer Insider releases as unsupported

10. Check_UEFI-CA2023.ps1 instructs the user to revoke PCA 2011 by "run the commands, run the commands"

11. Hide "implicit module loading" message for PowerShell 7 users

12. Report on the SkuSiPolicy.p7b file's policy version

13. Report on the Windows boot manager SVN number if PowerShell supports Get-SecureBootSVN

14. Get-SecureBootUEFI error handler doesn't work for non-English locales

15. Add W11 26H1, W10 Server 2016, W10 Server 2019 to list of supported Windows releases

OldNavy · Apr 8, 2026

Well done garlin, thank you for all of your great work.

neldog · Apr 8, 2026

I have released a (long overdue) update to version 2026.04.01, on post #1 and on GitHub.

"long overdue" - are you kidding me! Seems to me you have had your hands full lately just putting out fires here in this and other threads. We all thank you... I hope you still have a marriage when this is all over.

parttimewindows · Apr 8, 2026

Happy to report that after installing today's "Update for Windows Security platform" (KB5007651), my Secure Boot certificate update status displayed on the Device security page in the Windows Security app now states this:

Secure Boot is on and all required certificate updates have been applied.
No further certificate changes are needed.

(see Microsoft's admin guide Secure Boot certificate update status in the Windows Security app for details; today Phase 1 has started)

Thanks again @garlin!

garlin · Apr 8, 2026

April 8, 2026 (or later) is when users should get Phase 1 of the revised Security Center app, with slightly improved confirmation on your Secure Boot update progress. While Green is obviously good, it probably doesn't provide enough troubleshooting help if your PC isn't Green.

May 16, 2026 will be Phase 2 of the revised Security Center, with a bit more nagging if you're not in compliance.

Dirtyflash · Apr 8, 2026

parttimewindows said:
Happy to report that after installing today's "Update for Windows Security platform" (KB5007651), my Secure Boot certificate update status displayed on the Device security page in the Windows Security app now states this:

(see Microsoft's admin guide Secure Boot certificate update status in the Windows Security app for details; today Phase 1 has started)

Thanks again @garlin!

Thanks for the KB, found it in the Microsoft Update Catalog and installed it.

Microsoft Update Catalog

DarkShadowMD · Apr 8, 2026

Tested the new script on my machines, obviously I am updated and all is reported without issues.
As usual, thank you SO MUCH for all your support. You are being an angel for all of us, poor souls that are lost in this sea of contradictory info from the source lol.

garlin · Apr 8, 2026

Dirtyflash said:
Thanks for the KB, found it in the Microsoft Update Catalog and installed it.

Microsoft Update Catalog

I tried the Catalog version, while the description says 4/8, link is for the older app. You can tell because the year/month is part of the file’s URL.

This support page has the 4/8 app for sure:

Windows Security app update - Microsoft Support

support.microsoft.com

neldog · Apr 8, 2026

EDIT: I just did a "Check for Updates", and it was there and it downloaded. Took a few moments to show up changed.

garlin · Apr 8, 2026

Hmmm I feel like stealing that phrase for my check script. “NO UPDATES ARE REQUIRED” still gets too many questions on whether we’re finished or not.

Dirtyflash · Apr 8, 2026

garlin said:
I tried the Catalog version, while the description says 4/8, link is for the older app. You can tell because the year/month is part of the file’s URL.

This support page has the 4/8 app for sure:

Windows Security app update - Microsoft Support

support.microsoft.com

Interesting and very useful, thanks for posting.

Dirtyflash · Apr 8, 2026

garlin said:
Hmmm I feel like stealing that phrase for my check script. “NO UPDATES ARE REQUIRED” still gets too many questions on whether we’re finished or not.

Yes, I've noticed that a lot. Maybe we all need a little reassurance and a kudo if done well.

gunrunnerjohn · Apr 8, 2026

garlin said:
Hmmm I feel like stealing that phrase for my check script. “NO UPDATES ARE REQUIRED” still gets too many questions on whether we’re finished or not.

It sure seemed enough for me, just ran your latest scripts, they were all happy.

SaliesBuzz · Apr 8, 2026

garlin said:
If you have the Windows OEM Devices PK, the update script can install all of the required certs because MS provides a complete set of post-signed certs for vendors using this PK.

The easiest method is to clear all certs (with Secure Boot disabled) and run the update script. It should recognize you're in Setup Mode and install everything in one pass. I don't know if you cleared the non-PK certs. It's better in this case to have a clean slate so the replacement certs don't get a conflict with pre-existing ones.

That's just how MS packages these certs for use. Since your factory default is the AMI Test PK, MS would instruct you to do the same thing.

Helping a friend with another Nipogi Mini PC, I found that Secure Boot was not enabled. I loaded the BIOS, cleared all the Certificates and put Secure Boot in setup mode. Cannot now login to Windows with his PIN as it has disappeared. It needs to send a code to the email registered to his Microsoft Account to either login that way or create another PIN. Locked in a mortal embrace until I can get hold of the guy to tell me the code he has received!
I have read this can happen with some TPM implementations. I have posted this as a warning to others trying this procedure.
On a more positive note my Acemagic S1 has now received KB5007651 update and is reporting in Device Security:
"Secure Boot is on and all required certificate updates have been applied. No further certificate changes are needed" with a Green Tick.
Does that mean I should just leave it, or still go through the procedure you described above to clear the AMI Test Key?

garlin · Apr 8, 2026

SaliesBuzz said:
Helping a friend with another Nipogi Mini PC, I found that Secure Boot was not enabled. I loaded the BIOS, cleared all the Certificates and put Secure Boot in setup mode. Cannot now login to Windows with his PIN as it has disappeared. It needs to send a code to the email registered to his Microsoft Account to either login that way or create another PIN. Locked in a mortal embrace until I can get hold of the guy to tell me the code he has received!
I have read this can happen with some TPM implementations. I have posted this as a warning to others trying this procedure.

That is a known problem with some TPM's, they watch for Secure Boot changes and presume something unauthorized happened. They will ask for the BitLocker recovery key, and invalidate Windows Hello PIN's stored in TPM. While my check script does report the BitLocker status, and warns you to temporarily suspend it (and the update script does it for you), it doesn't warn about Windows Hello.

I will add that important messaging, since users don't anticipate this problem.

SaliesBuzz said:
On a more positive note my Acemagic S1 has now received KB5007651 update and is reporting in Device Security:
"Secure Boot is on and all required certificate updates have been applied. No further certificate changes are needed" with a Green Tick.
Does that mean I should just leave it, or still go through the procedure you described above to clear the AMI Test Key?

That's the new "you are super good" message from Security Center. But I don't know if Security Center just ignores the AMI Test Key, because it doesn't know enough background to care about it.

It's not ideal. Secure Boot is enforced, but a number of security folks do believe the AMI Test Key is compromised because the confidential key details were leaked in a supply chain hack on a Chinese manufacturer that builds sub-contracted PC's

My preference is nobody should be running a BIOS with "Test" or "Example" PK's. But you should decide for yourself. Read this:
PKfail: Untrusted Platform Keys Undermine Secure Boot on UEFI Ecosystem

GunnzAkimbo · Apr 8, 2026

OK! Success.
The Output LOG:

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 7.0

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

STATUS REPORT
-------------
Registry: UEFICA2023Status = Updated

SUCCESS: UPDATES ARE FINISHED. UEFI CA 2023 certs are present, PCA 2011 cert is revoked.
---------------------------------------------------------------------------------------------------------

2. The option in bios that forced secure boot into setup mode on my X99 Godlike board (2015 era) so the update script can install the certs:

Step 0 - MANUAL management of secure boot keys (NOT standard mode)

Step 1 - DISABLE factory default option
Step 2 - DELETE all factory default keys
Step 3 - A msg box appears stating all keys will be deleted and force secure boot into setup mode.

Run the check script then update script.

garlin · Apr 8, 2026

Two quick updates:

1. I've forwarded a copy of the Get-SecureBootSVN bug report to my friend at MS. He doesn't work in the Windows or Secure Boot group, but hopefully the right people will take a look at the report.

2. Added Windows Hello PIN detection in the next version. The check script will remind you that Windows Hello is enabled, and warn you again in the Setup mode instructions. The update script won't do any detection, because if you've already wiped the certs, then it's too late to turn off the PIN.

JamesSmith · Apr 8, 2026

@garlin I ran your new script in power shell and Malwarebytes picked it up as Malware

Please see the screenshots.

This only happens once. If I run the script again Malwarebytes ignores it until a system restart.

This happened on my laptop and desktop. There was no pop up. I saw the result when I went into Malwarebytes and was like what the heck but can say it happens exactly when the script runs. You need to open the program and go to detection history and it will be there.

James.

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Rancho Seldom Siesta

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Peaceful Citizen

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Rancho Seldom Siesta

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computers My Computers

At a glance

At a glance

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computers