Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

garlin · Jan 3, 2026

cool59 said:
Here's my output in case it can help:

PS C:\WINDOWS\system32> C:\Users\Desktop\WhatsMyPK.ps1
Subject : CN=Dell Inc. UEFI Platform Key, OU=Signing, OU=1, DC=dell, DC=com
Issuer : CN=Dell Inc. Issuing CA 1, CN=AIA, CN=Public Key Services, CN=Services, CN=Configuration, DC=dell,
DC=com
Thanks

Thanks. I have enough samples now, as I found the MS KEK list has the Subject: line for most vendors.
Some of the vendors submitted some weird looking strings.

garlin · Jan 3, 2026

gunrunnerjohn said:
@garlin Hi,

Is there an alternate way to install the SkuSiPolicy.p7b? I've tried the following several times, but I still get the same error. I'm running Win 11 Pro 25H2, Build 26220.7523.

View attachment 158768

Don't use the AvailableUpdates = 0x20 method. I borrowed that from cjee21's posted chart of AvailableUpdates bitmasks, and it doesn't appear to work.

The file copy method mentioned will work.

starchase · Jan 3, 2026

@garlin When you update your scripts are you going to put the new script in the Reserved FAQ post or put the version # in the file name?

gunrunnerjohn · Jan 3, 2026

Phil_C said:
See post #69. Worked for me.

Thanks, I missed that one, but it worked fine. I though this was simple, but way better to check before nuking myself. :lmao:

garlin · Jan 3, 2026

Each script has a -Version flag, and I will update the thread and GitHub when a newer version is released.

Code:

PS C:\Users\GARLIN\Downloads> powershell -nop -ep bypass -f .\Check_UEFI-CA2023.ps1 -version
Check_UEFI-CA2023.ps1 version (2026.01.02)

PS C:\Users\GARLIN\Downloads> powershell -nop -ep bypass -f .\Update_UEFI-CA2023.ps1 -version
Update_UEFI-CA2023.ps1 version (2026.01.02)

kelper · Jan 4, 2026

I could not get any of these scripts to work, as my BIOS would not allow the keys to be read. But once I deleted all the keys, I was able to run the update scripts successfully.
On another laptop, I saw the SecureBootUpdates folder had a dozen files dated November 2025. So I used Regedit to schedule the updates and that worked.

TheVisitor · Jan 4, 2026

garlin said:
Each script has a -Version flag, and I will update the thread and GitHub when a newer version is released.

Code:

PS C:\Users\GARLIN\Downloads> powershell -nop -ep bypass -f .\Check_UEFI-CA2023.ps1 -version Check_UEFI-CA2023.ps1 version (2026.01.02) PS C:\Users\GARLIN\Downloads> powershell -nop -ep bypass -f .\Update_UEFI-CA2023.ps1 -version Update_UEFI-CA2023.ps1 version (2026.01.02)

Sorry, I'm not that tech savvy - I don't know how to run these scripts.

suatcini54 · Jan 4, 2026

Open a Command Prompt window as admin and change to the folder of the PS script. Then run the following command

powershell -nop -ep bypass -f .\Check_UEFI-CA2023.ps1 -version

This will give you the version. Do the same with the other script.

nikki605 · Jan 4, 2026

Several weeks ago I followed the older PS scripts to update my 2 systems and was successful. As a double-check, I just ran this newer Check script and got this same result on both systems. All looks okay but I wanted to verify one thing. Under Required Action, it says to revoke the 2011 certificates, but from what I've read in other threads, it's not absolutely necessary to revoke them right now, that there is no problem with just leaving them there as MS will remove them later this year. Is that correct?

kelper · Jan 4, 2026

Good question. I believe the 2011 certificates are really only a problem for enterprise, but I may be wrong.

suatcini54 · Jan 4, 2026

Revoking the old certs is no different from installing the new certs. Just run the reg file and the scheduled task. That's it.

When you can do it yourself, why wait for MS to do it for you. But it's your call, of course.

I take great pride and enjoyment in doing my chores myself.

Please do not forget to update your backups and recovery disks if you have them.

nikki605 · Jan 4, 2026

My backups and recovery USB drives (Macrium Reflect Free 8.0) and my Windows Recovery USB drives are my concern.

Anibor_11 · Jan 4, 2026

suatcini54 said:
When you can do it yourself, why wait for MS to do it for you. But it's your call, of course.

MS owns the problem, they created this mess. These things should be totally transparent to the user.

Dirtyflash · Jan 4, 2026

nikki605 said:
My backups and recovery USB drives (Macrium Reflect Free 8.0) and my Windows Recovery USB drives are my concern.

Make another recovery drive on a different USB stick and follow that up with a new backup. I think the only difference is the bootloader, the old one is 2011 and the new one is 2023 as it relates to your question. It's a simple task to switch back and forth to update the bootloader firmware to match your previous backups and recovery drive. There's no urgency for you to revoke the 2011 certificates, you have several months to either do it yourself, or leave it to MS, just think things through before doing so. If you put things in perspective, you'll realize this security issue has existed since 2023, mostly likely prior, in a sense, it's a little like trying to close the barn doors after the horses have bolted.

nikki605 · Jan 4, 2026

Dirtyflash said:
Make another recovery drive on a different USB stick and follow that up with a new backup. I think the only difference is the bootloader, the old one is 2011 and the new one is 2023 as it relates to your question. It's a simple task to switch back and forth to update the bootloader firmware to match your previous backups and recovery drive. There's no urgency for you to revoke the 2011 certificates, you have several months to either do it yourself, or leave it to MS, just think things through before doing so. If you put things in perspective, you'll realize this security issue has existed since 2023, mostly likely prior, in a sense, it's a little like trying to close the barn doors after the horses have bolted.

Since running the original scripts several weeks ago that added the 2023 certs to the 2011 certs on both my PCs as the scripts show, I have created new Macrium Reflect boot sticks and run several new backups. I have also recreated new Windows Recovery sticks. If I understand all these threads correctly, all the boot sticks should have been created with both the 2011 and 2023 certs. Yes? No?

neldog · Jan 4, 2026

Anibor_11 said:
MS owns the problem, they created this mess. These things should be totally transparent to the user.

I feel your pain... you, me and most everyone else here are not all that thrilled with these certificate changes. I mean not to sound condescending, (you and I are in the same boat, I really do feel your pain). But my take on this is that Microsoft are not the ones who "created this mess", but more like the ones trying to do the clean-up on aisle 5, that others created.

Microsoft wrote the code and created the operating system software, that part is true. But then, after-the-fact, nefarious others jumped in later and created a way to mess things up by writing malicious code like BlackLotus, Frankenstein, Godzilla

and whatever else they can cook-up to make everyone's life miserable. Those are the ones who are responsible for the creation of Secure Boot and other security measures like new certificates.

gunrunnerjohn · Jan 4, 2026

nikki605 said:
My backups and recovery USB drives (Macrium Reflect Free 8.0) and my Windows Recovery USB drives are my concern.

For most common bootable USB drives, certainly the Windows Recovery drive, you can copy the 2023 certs to them to allow them to boot with Secure Boot.

@garlin posted the script below, I'm showing the contents. I used it to update my Acronis Recovery Drive and the Windows Recovery drive, they boot fine with the 2011 cert revoked.

Code:

set /p id=Enter Destination Drive Letter with a colon:
echo %id%
pause

COPY %id%\EFI\MICROSOFT\BOOT\BCD %id%\EFI\MICROSOFT\BOOT\BCD.BAK
pause

bcdboot c:\windows /f UEFI /s %id% /bootex
pause

COPY %id%\EFI\MICROSOFT\BOOT\BCD.BAK %id%\EFI\MICROSOFT\BOOT\BCD
pause

garlin · Jan 4, 2026

Please download the latest version of the ZIP file (bottom of post #1), or from GitHub:
Release v2026.01.03 · garlin-cant-code/SecureBoot-CA-2023-Updates

This release has an important bug fix for HP and Lenovo PC's (and others), by correcting the cert parsing which incorrectly returned (NONE) for some UEFI's.

Update_UEFI-CA2023.ps1 now has a new -SkuSiPolicy option to install the SkuSiPolicy file. Don't follow the old instructions to use the reg key, as it's been confirmed as no longer working.

Code:

Update_UEFI-CA2023.ps1 -SkuSiPolicy

The revised Check_UEFI-CA2023.ps1 script will provide you the same command.

bikemanAMD · Jan 4, 2026

Well i already used the registry add option for SkuSiPolicy? So now what is recommended thing to do now?

gunrunnerjohn · Jan 4, 2026

Just downloaded the new script, nice job and well documented now!

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers