INTRO
For the last two months, I've been working on new PowerShell scripts to automate the Secure Boot CA 2023 update process. A number of contributed scripts or guides presented on various ElevenForum threads (including a few of my earlier scripts) are lacking in clarity. There's simply too much confusion and guesswork to what's going with updates. The whole process should be easier to follow.
Why should you use these scripts?
All the UEFI security certificates and policy files are either sourced from the \Windows\System32\SecureBootUpdates folder, or the Microsoft GitHub repo for Secure Boot Objects. The MS GitHub is referenced by the UEFI Forum group as the official site for downloading Secure Boot CA 2023 updates.
W10 22H2 and all W11 releases, which have the July 2025 (or later) Monthly Update are supported. Including x64, x86, arm64 and arm architectures.
DO I NEED TO READ EVERYTHING BELOW?
No. If you want to just get started, first run the Check_UEFI-CA2023.ps1 script. If it doesn't suggest you to run the Update_UEFI-CA2023.ps1 script, then you have the option to do nothing (wait for MS to safely upgrade your PC in 2026), or follow the onscreen instructions. The instructions mirror the current MS guides.
Whenever you see the MS instructions for "reg add"..., you can always run the Update_UEFI-CA2023.ps1 and skip the waiting. The upgrade script does everything at the same time, so there's no need to check any Windows event logs. Run the Check_UEFI-CA2023.ps1 script again, and see if there are no more instructions left.
You have the option to stop right now, after adding the CA 2023 certs. The revocation of CA 2011 isn't expected to happen until early-mid 2026.
Before we get started, let's review an important requirement for the CA 2023 update:
When Secure Boot is enabled, your UEFI must have a signed KEK CA 2023 certificate in order to properly install the CA 2023 certs and updated boot files.
In the UEFI security model, Micorosoft provides the PC or motherboard maker a signed Key Exchange Key (KEK) signed by MS. The OEM in turn signs the KEK with their Platform Key (PK) to bless the KEK as authenticated by the vendor. The OEM has the option to provide one of two solutions:
Fortunately, another option is available. Most UEFI's have a Setup Mode, where the user clears the UEFI of all existing certs and signature hashes, and allows a tool to write certs directly into UEFI. This is what Mosby tries to do. But we don't actually need Mosby (and its requirement to format an USB drive) if you have a script or tool that runs on Windows.
There are three scripts in the release:
USAGE
Check_UEFI-CA2023.ps1
Report on the current UEFI certs enrolled in the KEK, DB, and DBX variables, Secure Boot and Virtualization-Based Security modes, BitLocker encryption status, and if the Windows Boot Manager is allowed by the current UEFI setup. Each command-line option may be used on its own, or in combination with any or all of them.
Supported options:
Check_UEFI-CA2023.ps1
Check_UEFI-CA2023.ps1 -Audit
Update_UEFI-CA2023.ps1
Install the UEFI CA 2023 certs, and optionally revoke the CA 2011 cert if desired; copy the CA 2023 boot manager file to the EFI (ESP) partition, and any removable USB drives which have an \EFI\boot\bootx64.bin boot file. SkuSiPolicy.p7b file will be copied to EFI, if Virtualization-Based Security (VBS) is currently enabled.
Before the script runs, it checks if your Windows release is July 2025 or later, in order to have the latest Secure Boot files. When BitLocker is enabled, it's suspended for 1 or 3 reboots (depending on VBS), so changes in the UEFI don't require you to provide a BitLocker recovery key.
The script is smart enough to only perform the missing steps. If you partially updated the UEFI before running the script, it will finish whatever is expected. If you want to perform the entire upgrade in one pass, you can use the -Revoke flag.
If you have a supported BIOS (where the OEM has submitted a signed KEK to MS), then Update_UEFI-CA2023.ps1 can run without needing any help.
If you have any unsupported BIOS, you have two options:
Update_UEFI-CA2023.ps1
Update_UEFI-CA2023.ps1 -Revoke
Check_DBXUpdate.bin.ps1
For normal users, this script isn't needed for the update process. When Windows releases a new DBXUpdate or SVN, it will be part of the usual Monthly Updates and eventually pushed to the UEFI. If you want to confirm that the DBX variable contains all signatures in a provided DBXupdate or DBXupdateSVN bin file, run this script. The script will report how many matched or missing EFI or SVN signatures from the submitted file are found in the DBX variable.
By default, the script compares the DBX files in \Windows\System32\SecureBootUpdates (refreshed by the Monthly Updates). You can provide a list of individual files or folders to be searched for *DBX*.bin named files. After a successful update (or revoke), there should be no missing signatures.
Check_DBXUpdate.bin.ps1
The latest version of the script is available from GitHub, or attached as a ZIP file below.
Release v2026.05.31 · garlin-cant-code/SecureBoot-CA-2023-Updates
For the last two months, I've been working on new PowerShell scripts to automate the Secure Boot CA 2023 update process. A number of contributed scripts or guides presented on various ElevenForum threads (including a few of my earlier scripts) are lacking in clarity. There's simply too much confusion and guesswork to what's going with updates. The whole process should be easier to follow.
Why should you use these scripts?
- Find out if your BIOS is currently supported by MS or not
- Find out if your Secure Boot update is completed right now, without the need to run other commands or looking at the Event Viewer logs
- Force an immediate update to CA 2023 certs, and optionally revoke the CA 2011 cert at this time
- Update your boot files on USB removable media (including Macrium recovery drives)
All the UEFI security certificates and policy files are either sourced from the \Windows\System32\SecureBootUpdates folder, or the Microsoft GitHub repo for Secure Boot Objects. The MS GitHub is referenced by the UEFI Forum group as the official site for downloading Secure Boot CA 2023 updates.
W10 22H2 and all W11 releases, which have the July 2025 (or later) Monthly Update are supported. Including x64, x86, arm64 and arm architectures.
DO I NEED TO READ EVERYTHING BELOW?
No. If you want to just get started, first run the Check_UEFI-CA2023.ps1 script. If it doesn't suggest you to run the Update_UEFI-CA2023.ps1 script, then you have the option to do nothing (wait for MS to safely upgrade your PC in 2026), or follow the onscreen instructions. The instructions mirror the current MS guides.
Whenever you see the MS instructions for "reg add"..., you can always run the Update_UEFI-CA2023.ps1 and skip the waiting. The upgrade script does everything at the same time, so there's no need to check any Windows event logs. Run the Check_UEFI-CA2023.ps1 script again, and see if there are no more instructions left.
You have the option to stop right now, after adding the CA 2023 certs. The revocation of CA 2011 isn't expected to happen until early-mid 2026.
Before we get started, let's review an important requirement for the CA 2023 update:
When Secure Boot is enabled, your UEFI must have a signed KEK CA 2023 certificate in order to properly install the CA 2023 certs and updated boot files.
In the UEFI security model, Micorosoft provides the PC or motherboard maker a signed Key Exchange Key (KEK) signed by MS. The OEM in turn signs the KEK with their Platform Key (PK) to bless the KEK as authenticated by the vendor. The OEM has the option to provide one of two solutions:
- Recent BIOS firmware update which includes the CA 2023 certs as factory defaults
- Submit a re-signed KEK for inclusion in the MS GitHub repo (and Windows can perform the update by itself)
Fortunately, another option is available. Most UEFI's have a Setup Mode, where the user clears the UEFI of all existing certs and signature hashes, and allows a tool to write certs directly into UEFI. This is what Mosby tries to do. But we don't actually need Mosby (and its requirement to format an USB drive) if you have a script or tool that runs on Windows.
There are three scripts in the release:
- Check_UEFI-CA2023.ps1
Checks the current state of your UEFI certs, and the boot files for Windows and any bootable DVD or USB media. The script can provide an Audit Report, listing what steps need to be completed to be in compliance with the CA 2023 update, and what commands to run.
- Update_UEFI-CA2023.ps1
Updates the UEFI certs and boot files for Windows and any bootable USB media. You have the option to only install the UEFI CA 2023 certs, and not revoke the PCA 2011 cert; or to complete the entire process in one pass.
- Check_DBXUpdate.bin.ps1
Compares any submitted DBXUpdate.bin file against the current UEFI DBX variable, and informs you if there are any EFI or SVN signatures that need to be installed.
USAGE
Check_UEFI-CA2023.ps1
Report on the current UEFI certs enrolled in the KEK, DB, and DBX variables, Secure Boot and Virtualization-Based Security modes, BitLocker encryption status, and if the Windows Boot Manager is allowed by the current UEFI setup. Each command-line option may be used on its own, or in combination with any or all of them.
Supported options:
| - Audit | Report what UEFI CA 2023 steps have not been completed. Check the Windows Boot Manager as if Secure Boot is enabled (in case you're running with Secure Boot as disabled). |
| - Verbose | Extended details including Windows build, BIOS versions, factory defaults for PK, KEK, DB and DBX variables, Windows BootMgr SVN, and count of EFI signature hashes for the DBX list. |
| - BootMedia | Check the boot file and Windows install image are allowed by the current UEFI setup. |
| - Log | Save output to a log named after the current date, and PC model. |
Check_UEFI-CA2023.ps1
Code:
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) ON
UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
UEFI DBX Certs
--------------
(NONE)
EFI Files
---------
Disk 0: Windows Boot Manager [Production PCA 2011] is ALLOWED.
Registry: WindowsUEFICA2023Capable = 0
[Windows UEFI CA 2023] not in UEFI DB.
Disk 0: SkuSiPolicy.p7b (for VBS) is NOT PRESENT.
REQUIRED ACTION
===============
OPTION 1: DO NOTHING. Windows will apply the UEFI updates in 2026 (supported BIOS).
OPTION 2: To install [UEFI CA 2023] certs WITHOUT REVOKING the [PCA 2011] cert, run the commands:
manage-bde -Protectors -Disable C: -RebootCount 1
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
OPTION 3: To install [UEFI CA 2023] certs and REVOKE the [PCA 2011] cert, run the commands:
manage-bde -Protectors -Disable C: -RebootCount 1
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5be6 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"Check_UEFI-CA2023.ps1 -Audit
Code:
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) ON
UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
UEFI DBX Certs
--------------
(NONE)
EFI Files
---------
Disk 0: Windows Boot Manager [Production PCA 2011] is ALLOWED.
Registry: WindowsUEFICA2023Capable = 0
[Windows UEFI CA 2023] not in UEFI DB.
Disk 0: SkuSiPolicy.p7b (for VBS) is NOT PRESENT.
AUDIT REPORT
============
1. Secure Boot is DISABLED
2. [Microsoft Corporation KEK 2K CA 2023] is missing from UEFI KEK
3. [Windows UEFI CA 2023] is missing from UEFI DB
4. [Microsoft UEFI CA 2023] is missing from UEFI DB
5. [Microsoft Option ROM UEFI CA 2023] is missing from UEFI DB
6. [Production PCA 2011] is missing from UEFI DBX
7. DBX Updates are missing from UEFI DBX
8. Windows BootMgr SVN is missing from UEFI DBX
9. Windows Boot Manager [Production PCA 2011] is wrong version
10. SkuSiPolicy.p7b (for VBS) is missing
REQUIRED ACTION
===============
OPTION 1: DO NOTHING. Windows will apply the UEFI updates in 2026 (supported BIOS).
OPTION 2: To install [UEFI CA 2023] certs WITHOUT REVOKING the [PCA 2011] cert, run the commands:
manage-bde -Protectors -Disable C: -RebootCount 1
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
OPTION 3: To install [UEFI CA 2023] certs and REVOKE the [PCA 2011] cert, run the commands:
manage-bde -Protectors -Disable C: -RebootCount 1
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5be6 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"Update_UEFI-CA2023.ps1
Install the UEFI CA 2023 certs, and optionally revoke the CA 2011 cert if desired; copy the CA 2023 boot manager file to the EFI (ESP) partition, and any removable USB drives which have an \EFI\boot\bootx64.bin boot file. SkuSiPolicy.p7b file will be copied to EFI, if Virtualization-Based Security (VBS) is currently enabled.
Before the script runs, it checks if your Windows release is July 2025 or later, in order to have the latest Secure Boot files. When BitLocker is enabled, it's suspended for 1 or 3 reboots (depending on VBS), so changes in the UEFI don't require you to provide a BitLocker recovery key.
The script is smart enough to only perform the missing steps. If you partially updated the UEFI before running the script, it will finish whatever is expected. If you want to perform the entire upgrade in one pass, you can use the -Revoke flag.
If you have a supported BIOS (where the OEM has submitted a signed KEK to MS), then Update_UEFI-CA2023.ps1 can run without needing any help.
If you have any unsupported BIOS, you have two options:
- For PC's with an UEFI that supports manual key management, the script copies the KEK CA 2023 certificate to the EFI partition. You can use your UEFI's menu options to manually enroll the KEK file, from the EFI partition's \EFI\Certs folder.
If your PC has an untrusted PK cert ("DO NOT TRUST" or "TEST"), the script will copy the "Windows OEM Devices PK" cert to the EFI partition. Enroll this PK cert from the \EFI\Certs folder.
- For PC's that don't support manual key management of individual keys, you can choose Setup Mode (which deletes all certs). After clearing the certs, and restarting Windows, run the Update_UEFI-CA2023.ps1 script. It will complete the process without further help from you. This does almost the same thing as Mosby, except you're using the MS recommended "Windows OEM Devices PK" instead of self-signing the KEK cert.
| -Audit | Report what UEFI CA 2023 steps have not been completed. Check the Windows Boot Manager as if Secure Boot is enabled (in case you're running with Secure Boot as disabled). |
| -Revoke | Revoke the PCA 2011 cert, banning all old boot files. By default, the script only installs the CA 2023 certs, and will not revoke PCA 2011 unless requested. |
| -Latest | Check the MS GitHub, if later version of DBXUpdate.bin and DBXUpdateSVN.bin exist. Only apply changes if the bin files are newer. |
| -SBAT | Apply the optional Secure Boot Advanced Targeting (SBAT) update, if you're sharing EFI with a Linux system. Not required for a pure Windows setup. |
| -BootMedia | Replace the EFI bootfile (\EFI\Microsoft\Boot\bootx64.efi) on mounted USB drives, if the file is present. |
| -Log | Save output to a log named after the current date, and PC model. |
Update_UEFI-CA2023.ps1
Code:
Suspending BitLocker for one reboot.
Successfully appended "dbupdate2024.bin" to UEFI DB.
Successfully appended "DBUpdate3P2023.bin" to UEFI DB.
Successfully appended "DBUpdateOROM2023.bin" to UEFI DB.
Downloading "KEKUpdate_Microsoft_PK3d8660c0.bin" from GitHub.
Successfully appended "KEKUpdate_Microsoft_PK3d8660c0.bin" to UEFI KEK.
Copying EFI boot files.
Boot files successfully created.
REQUIRED ACTION
---------------
Restart Windows, for UEFI updates to take effect.Update_UEFI-CA2023.ps1 -Revoke
Code:
Successfully appended "dbxupdate.bin" to UEFI DBX.
Successfully appended "DBXUpdate2024.bin" to UEFI DBX.
Successfully appended "DBXUpdateSVN.bin" (SVN 7.0) to UEFI DBX.
Deployed SkuSiPolicy.p7b (for VBS).
REQUIRED ACTION
---------------
Restart Windows, for UEFI updates to take effect.Check_DBXUpdate.bin.ps1
For normal users, this script isn't needed for the update process. When Windows releases a new DBXUpdate or SVN, it will be part of the usual Monthly Updates and eventually pushed to the UEFI. If you want to confirm that the DBX variable contains all signatures in a provided DBXupdate or DBXupdateSVN bin file, run this script. The script will report how many matched or missing EFI or SVN signatures from the submitted file are found in the DBX variable.
By default, the script compares the DBX files in \Windows\System32\SecureBootUpdates (refreshed by the Monthly Updates). You can provide a list of individual files or folders to be searched for *DBX*.bin named files. After a successful update (or revoke), there should be no missing signatures.
| -Verbose | Download the "dbx_info_msft_latest.json" from MS GitHub, and extract the filename and vendor info for the missing EFI certs. If the missing signature is a SVN, report on the SVN. |
Check_DBXUpdate.bin.ps1
Code:
FAILED: Missing 404/431 EFI signatures from "dbxupdate.bin"
FAILED: Missing 3/3 SVN signatures from "DBXUpdate2024.bin"
FAILED: Missing 3/3 SVN signatures from "DBXUpdateSVN.bin"The latest version of the script is available from GitHub, or attached as a ZIP file below.
Release v2026.05.31 · garlin-cant-code/SecureBoot-CA-2023-Updates
Last edited:
My Computer
System One
-
- OS
- Windows 7
