Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

garlin · May 12, 2026

If you have an unsupported PC, meaning the vendor will never provide a working KEK CA 2023 (because the PC is too old), then you must delete all of the Secure Boot keys first. You have to do whatever it takes to be able to get that BIOS menu option.

Or just live with Secure Boot being disabled.

anchamp65 · May 12, 2026

Capricornus said:
on an old Lenovo C340 All-in-One computer (with a UEFI from 2012)

@garlin a second one from 2012

JamesSmith · May 12, 2026

Just ran windows update for May. Microsoft didn’t mess with your script.

Klaver7 · May 12, 2026

They should thank him !

DarkShadowMD · May 12, 2026

Klaver7 said:
They should thank him !

Or pay him a good amount. He's fixing their mess for free for everyone. That is much more than just "Thank you for being more efficient than us..." :V

garlin · May 12, 2026

The boot manager (and SVN) only changes in response to recent Windows security fixes. Sometimes you will get several months in between changes (April 2025, July 2025, October 2025, April 2026).

Don't go expecting every month to have exciting news. The only difference is some users will finally get updates because their assigned Confidence Level changed from "More Data Needed" to "High Confidence" (based on telemetry data).

DarkShadowMD · May 12, 2026

I mean, I'm trying not to be a fanboy, but is not about having exciting news, this isn't exciting at all given we are all "messing" with the boot manager and UEFI certs for Secure Boot, which has been meaning updating many crucial files and even our BIOS (A thing I absolutely hate unless I really need to, one false step and you have an expensive brick sitting on your desk), and you are the only person that has been actively helping others with all this, giving information, a script easy to understand and use and assistance.

This is much more than what we get from Microsoft and the OEM vendors themselves.

At least they didn't push another update for the SVN this last cumulative update... I can live in peace for now lol.

But again, thank you for your help, coding and everything. You are making this much easier than it is in fact.

JamesSmith · May 12, 2026

Ever since last month’s windows update that added new files and script had to be changed to account for this. I have been a little nervous on patch Tuesday.

Thankfully we have Garlin on hand to help guide the way. No extra work for you it seems I think you should maybe take a short holiday :)

Thanks again.

Br0die · May 12, 2026

C:\Windows\SecureBoot\ExampleRolloutScriptsI

don't know when this showed up but I found it today after the updates.

HeavyHemi · May 12, 2026

Last step done with PCA 2011 revoked. So, I should be good to go.

anchamp65 · May 12, 2026

Br0die said:
C:\Windows\SecureBoot\ExampleRolloutScriptsI

don't know when this showed up but I found it today after the updates.

And it looks like they documented it here: Sample Secure Boot E2E Automation Guide
@garlin, an opinion on those scrips...?

JamesSmith · May 12, 2026

DarkShadowMD · May 12, 2026

I wouldn't trust Microsoft handling this tbh. I wouldn't be surprised if they just took Garlin's stuff and vibe coded this into AI slop.
Dunno... XD

anchamp65 · May 12, 2026

I took a look at the scripts and the documentation
I'm no Powershell expert, but they seem to be designed for domain joined computers
No idea why we're seing these scrips on standalone computers

Side note, @garlin, May updates/patches have not updated Secure Boot on either my SP9 or Dell Inspiron 3910
Pretty sure it's related to the fact that on those 2 computers telemetry is completly disabled

Your scripts it will be in the next few days...

JamesSmith · May 13, 2026

Change date	Change description
May 12, 2026	Previously, each sample script file was published as individual articles from which you would copy-and-paste the script. Starting with the Windows updates released on and after May 12, 2026, the sample scripts are located in the %systemroot%\SecureBoot\ExampleRolloutScripts folder on your device.

There’s 15 pages of documentation. I believe this is for enterprise purposes? The change log leads me to believe MS is making it easier to access the files. I assume nothing further is needed to be done. But I’ll wait for Garlin to chime in on this as I am not a secure boot expert.

hvoqasimo · May 13, 2026

After update build 262000.8457 I checked the Register and below is an overview regarding SecureBoot confidence device targeting data before en after: Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing
before:
ConfidenceLevel - Under Observation-More Data Needed
ConfideceUpdateType -(0)

After update build 262000.8457:
ConfidenceLevel - High Confidence
ConfideceUpdateType -(22852)

Caledon Ken · May 13, 2026

garlin said:
Run the update script. It should copy the KEK CA 2023 cert as both a .der and .crt file to the EFI partition.

Select Append Key / Load from file...
Browse the disks, see if there's a folder view with \EFI folder. Search under that folder for "Certs" folder.
Find the the KEK CA 2023 file, and import it.

If that works fine, restart Windows. Run the update script one more time, it should now add the CA 2023 certs.

While I actually did not follow these instructions, I'm decided to wait a little, I wanted to say thank you again Garlin for the work you are doing.

This Patch Tuesday my UEFI was updated by MS as part of their rollout.


Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    (NONE)
    Windows BootMgr SVN is MISSING.

EFI Files
---------
    Windows Boot Manager [Production PCA 2011] is ALLOWED.

    Registry: "WindowsUEFICA2023Capable" = 1
        [Windows UEFI CA 2023] in UEFI DB.

    [OPTIONAL] SkuSiPolicy.p7b (for VBS) is MISSING.
    NOT RECOMMENDED for dual-boot setups.

I will likely be back, I'm a Macrium user, using the older V8.1 and I see lots of posts in this thread related to Macrium boot media. I need to upgrade Macrium, create new boot media and test.

Thanks again for your efforts, you've help countless people.

anchamp65 · May 13, 2026

hvoqasimo said:
After update build 262000.8457 I checked the Register and below is an overview regarding SecureBoot confidence device targeting data before en after: Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing
before:
ConfidenceLevel - Under Observation-More Data Needed
ConfideceUpdateType -(0)

After update build 262000.8457:
ConfidenceLevel - High Confidence
ConfideceUpdateType -(22852)
View attachment 171396

A few weeks ago, Garlin had explained that the only registry key that really matters is "UEFICA2023Status" and if it's set to "Updated" your done. The other keys (buckethash, confidencelevel, confidenceupdatetype) are not always updated by Microsoft once the 2023 certificates are applied.

So, if UEFICA2023Status says "Updated" and Windows Security shows the following under Device security, Secure Boot, your all done.
Even Garlin's check script should tell you your done, maybe not for revoking CA 2021, but like Garlin also mentioned multiple times, this is not mandatory for now.

NormanF · May 13, 2026

Not really needed. The documented advice from OEMs and Microsoft is to keep secure boot turned on. If your OEM isn't going to patch your BIOS, all that will happen is you won't receive new secure boot level protections in the future.

Live with the secure boot certificate installed with your last BIOS update.

anchamp65 · May 13, 2026

NormanF said:
Not really needed. The documented advice from OEMs and Microsoft is to keep secure boot turned on. If your OEM isn't going to patch your BIOS, all that will happen is you won't receive new secure boot level protections in the future.

Live with the secure boot certificate installed with your last BIOS update.

who are you replying to ?
not sure...

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer

Member

My Computer

Well-known member

Attachments

My Computers

Member

My Computer

Peaceful Citizen

My Computers

Well-known member

My Computer

Peaceful Citizen

My Computers

Well-known member

My Computers

Active member

My Computer

Well-known member

My Computer

Member

My Computer

Well-known member

My Computers

Peaceful Citizen

My Computers

Member

My Computer

Well-known member

My Computers

Member

My Computer

Well-known member

My Computer

Member

My Computer

Well-known member

My Computers

Member

My Computer