Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

bikemanAMD · Jan 5, 2026

Am i supposed to use Macrium Reflect X Windows RE Boot Media or Windows PE Boot Media after revoking the 2011 Cert? thats last part i need to get all taken care of, and think i should be fine hopefully

Windows Media believe is already using 2023 Cert as Windows is using 2023 CA version from my last clean install of 25H2

Just need to get Macrium Reflect X Rescue Media all squared away and im good

garlin · Jan 5, 2026

bikemanAMD said:
Am i supposed to use Macrium Reflect X Windows RE Boot Media or Windows PE Boot Media after revoking the 2011 Cert? thats last part i need to get all taken care of, and think i should be fine hopefully

Windows Media believe is already using 2023 Cert as Windows is using 2023 CA version from my last clean install of 25H2

Just need to get Macrium Reflect X Rescue Media all squared away and im good

For the new scripts, the USB bootable media check isn't on by default. Insert your USB drive(s), and run the command:

Code:

Check_UEFI-CA2023.ps1 -BootMedia

If you need to update the same USB drive(s), then run:

Code:

Update_UEFI-CA2023.ps1 -BootMedia

I didn't want the script touching the USB drive's boot file (without permission), since it might be shared with another PC.

bikemanAMD · Jan 5, 2026

Except when i run the Update_UEFI-CA2023.ps1 -bootmedia portion i receive the following error

PS C:\Temp> ./Update_UEFI-CA2023.ps1 -BootMedia
Downloading "edk2-x64-secureboot-binaries.zip" from GitHub.
Incorrect authentication data: 0xC0000022

Guess at this point i'll hope i don't ever have a need to use it, then re update the Macrium Reflect X recovery USB after June 2026 lol.

garlin · Jan 5, 2026

Do you mind trying this version?

bikemanAMD · Jan 5, 2026

Results i get from trying this one

Code:

PS C:\Temp> ./Update_UEFI-CA2023.ps1 -BootMedia

Security warning
Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your
computer. If you trust this script, use the Unblock-File cmdlet to allow the script to run without this warning
message. Do you want to run C:\Temp\Update_UEFI-CA2023.ps1?
[D] Do not run  [R] Run once  [S] Suspend  [?] Help (default is "D"): R
At C:\Temp\Update_UEFI-CA2023.ps1:998 char:73
+ ... if ((Compare-Object (Get-SecureBootUEFI SetupMode).Bytes @(1)).Count)
+                                                                         ~
Missing statement block after if ( condition ).
At C:\Temp\Update_UEFI-CA2023.ps1:1280 char:1
+ }
+ ~
Unexpected token '}' in expression or statement.
    + CategoryInfo          : ParserError: (:) [], ParseException
    + FullyQualifiedErrorId : MissingStatementBlock

garlin · Jan 5, 2026

Bad typo.

bikemanAMD · Jan 5, 2026

Nope, It ran as was deigned it looked like

Code:

PS C:\Temp> ./Update_UEFI-CA2023.ps1 -BootMedia

Security warning
Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your
computer. If you trust this script, use the Unblock-File cmdlet to allow the script to run without this warning
message. Do you want to run C:\Temp\Update_UEFI-CA2023.ps1?
[D] Do not run  [R] Run once  [S] Suspend  [?] Help (default is "D"): R
Downloading "edk2-x64-secureboot-binaries.zip" from GitHub.
Incorrect authentication data: 0xC0000022

And thats why i still end up

garlin · Jan 5, 2026

What happens if you run:

Code:

((Get-SecureBootUEFI SetupMode).Bytes -Join '') -eq 1

bikemanAMD · Jan 5, 2026

This is the Result i get from that

Code:

PS C:\Temp> ((Get-SecureBootUEFI SetupMode).Bytes -Join '') -eq 1
False

Brian48 · Jan 5, 2026

@garlin, When I run the latest version of the "Check_UEFI-CA2023.ps1" script with the verbose, audit and log options set, this is my output.
Under the "Audit Report" it says Secure Boot is DISABLED. I have checked my BIOS setting and it is definitely enabled and also "msinfo32.exe" shows it as being on too.
Is this a bug with the script?

Windows 11 25H2 (26200.7462)

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
HP HP Laptop 15s-fq5xxx
Version: F.27
Date: 2025-12-10

Factory Default UEFI PK Cert
----------------------------
HP UEFI Secure Boot PK 2017

UEFI PK Cert
------------
HP UEFI Secure Boot PK 2017

Factory Default UEFI KEK Certs
------------------------------
Microsoft Corporation KEK CA 2011
HP UEFI Secure Boot KEK 2017
Microsoft Corporation KEK 2K CA 2023

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
HP UEFI Secure Boot KEK 2017
Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
HP UEFI Secure Boot DB 2017
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
HP UEFI Secure Boot DB 2017
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
Debian Secure Boot Signer
Canonical Ltd. Secure Boot Signing
EFI_CERT_SHA256_GUID Signatures: 190

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Debian Secure Boot Signer
Canonical Ltd. Secure Boot Signing
Windows BootMgr SVN 7.0
EFI_CERT_SHA256_GUID Signatures: 446

EFI Files
---------
Disk 0: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
bootmgfw.efi File version: 26100.30227

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

Disk 0: SkuSiPolicy.p7b (for VBS) is CURRENT.

AUDIT REPORT
============
1. Secure Boot is DISABLED

STATUS REPORT
-------------
Registry: UEFICA2023Status = Updated

SUCCESS: NO UPDATES ARE REQUIRED.

garlin · Jan 5, 2026

Brian48 said:
@garlin, When I run the latest version of the "Check_UEFI-CA2023.ps1" script with the verbose, audit and log options set, this is my output.
Under the "Audit Report" it says Secure Boot is DISABLED. I have checked my BIOS setting and it is definitely enabled and also "msinfo32.exe" shows it as being on too.
Is this a bug with the script?

Brian48 said:
AUDIT REPORT
============
1. Secure Boot is DISABLED

Maybe a bug. Try this version.

Brian48 · Jan 5, 2026

garlin said:
Maybe a bug. Try this version.

Same result

Phil_C · Jan 5, 2026

I also get the Audit Report "Secure Boot is DISABLED" every time, even though everything else looks good.

garlin · Jan 5, 2026

Out of curiousity, are you using PS 5 (powershell.exe) or PS 7 (pwsh.exe)?

Phil_C · Jan 5, 2026

garlin said:
Out of curiousity, are you using PS 5 (powershell.exe) or PS 7 (pwsh.exe)?

It's pwsh.exe. Under Installed Apps it's 7.5.4.0 10/24/2025.

garlin · Jan 5, 2026

My bad, didn't see where I used an "or" instead of an "and" to check for [not in Setup Mode & not in Secure Boot mode].

Brian48 · Jan 6, 2026

garlin said:
My bad, didn't see where I used an "or" instead of an "and" to check for [not in Setup Mode & not in Secure Boot mode].

This is what I get now.
Using powershell.exe BTW.

garlin · Jan 6, 2026

I think the reason for both problems is I disabled Secure Boot on my test setup, to speed up some repetitive testing; and now that turned out to be a bad decision.

Brian48 · Jan 6, 2026

garlin said:
I think the reason for both problems is I disabled Secure Boot on my test setup, to speed up some repetitive testing; and now that turned out to be a bad decision.

Audit Report now empty

Thanks so much for tracking this down.

nikki605 · Jan 6, 2026

@garlin After running your latest script, I also no longer get SecureBoot disabled in the Audit section, but I do get "[Production PCA 2011] is missing from UEFI DBX" Is that something I need to be concerned about? This is on my Lenovo T490 laptop. I still need to run it on my older Lenovo M83 desktop.

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

BIOS Firmware
-------------
LENOVO 20N20028US
Version: N2IETA6W (1.84 )
Date: 2025-07-02

Factory Default UEFI PK Cert
----------------------------
Lenovo Ltd. PK CA 2012

UEFI PK Cert
------------
Lenovo Ltd. PK CA 2012

Factory Default UEFI KEK Certs
------------------------------
Microsoft Corporation KEK CA 2011
Lenovo Ltd. KEK CA 2012
Microsoft Corporation KEK 2K CA 2023

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Lenovo Ltd. KEK CA 2012
Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
ThinkPad Product CA 2012
Lenovo UEFI CA 2014
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
ThinkPad Product CA 2012
Lenovo UEFI CA 2014
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
Debian Secure Boot Signer
Canonical Ltd. Secure Boot Signing
EFI_CERT_SHA256_GUID Signatures: 466

UEFI DBX Certs
--------------
(NONE)
Windows BootMgr SVN 7.0
EFI_CERT_SHA256_GUID Signatures: 486

EFI Files
---------
Disk 0: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
bootmgfw.efi File version: 26100.30227

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

AUDIT REPORT
============
1. [Production PCA 2011] is missing from UEFI DBX

REQUIRED ACTION
===============

To revoke the [PCA 2011] cert, run the commands, run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x80 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

Attachments

My Computer

Well-known member

My Computers

Well-known member

Attachments

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Active member

My Computer

Well-known member

Attachments

My Computer

Active member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

Attachments

My Computer

Active member

My Computer

Well-known member

Attachments

My Computer

Active member

My Computer

Well-known member

My Computers