Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Rollback_Jockey · Jan 6, 2026

garlin said:
I think the reason for both problems is I disabled Secure Boot on my test setup, to speed up some repetitive testing; and now that turned out to be a bad decision.

I did that with my TOSHIBA and all the scripts fail because it insists on it being in setup mode, i'm not given that option though.

Dirtyflash · Jan 6, 2026

Rollback_Jockey said:
I did that with my TOSHIBA and all the scripts fail because it insists on it being in setup mode, i'm not given that option though.

Do you have the option to clear all keys? Might be worth trying, assuming you could restore factory keys afterwards if required.

Rollback_Jockey · Jan 6, 2026

Dirtyflash said:
Do you have the option to clear all keys? Might be worth trying, assuming you could restore factory keys afterwards if required.

Nope, there are no options other than to toggle it on or off. I pulled the hard drive as a test and it still senses an an incompatible security file.

I'm busy trying to find an OEM BIOS but as the machine is 'Legacy' I’m pretty much stuffed.

nikki605 · Jan 6, 2026

garlin said:
Out of curiousity, are you using PS 5 (powershell.exe) or PS 7 (pwsh.exe)?

As a side note, can anyone tell me why I can't run these scripts with PS 7 (pwsh.exe)? What am I doing wrong? Yes, I am running it as an Administrator just like I do when I use PS 5 which works just fine.

suatcini54 · Jan 6, 2026

You can run the scripts easily when you give the pwsh command like below:

pwsh -nop -ep bypass -f "path to the powershell script"

as long as pwsh executable is defined as an environmental element.

Hope this helps.

nikki605 · Jan 6, 2026

suatcini54 said:
You can run the scripts easily when you give the pwsh command like below:

pwsh -nop -ep bypass -f "path to the powershell script"

as long as pwsh executable is defined as an environmental element.

View attachment 159108

Hope this helps.

Your instructions are a bit over my head. It looks like your PS 7 is installed in C:\Program Files\PowerShell\7\ but that's not where my PS 7 is installed on either of my 2 systems. They are installed here - C:\Program Files\WindowsApps\Microsoft.PowerShell_7.5.4.0_x64__8wekyb3d8bbwe

Maybe I should have installed it using WinGet rather than the MS Store.

suatcini54 · Jan 6, 2026

That should not be a problem. You should find where pwsh.exe is located and point to the folder including the drive letter C: with a back slash \ then pwsh.exe. Then input the arguments -nop -ep bypass -f “path to the powershell script”.

Like: “C:\Program Files\……….\pwsh.exe” -nop -ep bypass -f “path to file”

This should be in a command prompt with admin rights.

This should do.

suatcini54 · Jan 6, 2026

For info nop means no profile; ep bypass means to use bypass for execution policy and f means file.

nikki605 · Jan 6, 2026

suatcini54 said:
That should not be a problem. You should find where pwsh.exe is located and point to the folder including the drive letter C: with a back slash \ then pwsh.exe. Then input the arguments -nop -ep bypass -f “path to the powershell script”.

Like: “C:\Program Files\……….\pwsh.exe” -nop -ep bypass -f “path to file”

This should be in a command prompt with admin rights.

This should do.

I uninstalled the MS Store version of PS 7 and installed the .msi version which put it in the same directory that you have. Much cleaner installation.

But I am getting an error message about PSReadline module not loading. Any idea what that is all about and if I could/should fix it or can it be ignored?

Update: Searching for information on the web, I found this - "Beginning with PowerShell 7.0, the PSReadLine module auto-loading is skipped if a screen reader program is detected, as it doesn't work well with them." I have no idea what a screen reader program is or if I even have one installed. Sounds like maybe I don't need to be concerned. The .ps1 script runs just fine.

garlin · Jan 6, 2026

I provided a set of .BAT wrapper scripts in the latest ZIP file (thread post #1), which call the PS scripts using "-nop -execution bypass" flags. This allows you to run the scripts without modifying the Execution Policy (for security concerns).

Use the same command-line options you would use, and the batch file will pass them along.

Check-UEFI.bat
Check-UEFI.bat -audit

Check-DBX.bat

Upgrade-UEFI.bat
Upgrade-UEFI.bat -revoke

neldog · Jan 6, 2026

garlin said:
I provided a set of .BAT wrapper scripts in the latest ZIP file (thread post #1), which call the PS scripts using "-nop -execution bypass" flags. This allows you to run the scripts without modifying the Execution Policy (for security concerns).

Use the same command-line options you would use, and the batch file will pass them along.

Check-UEFI.bat
Check-UEFI.bat -audit

Check-DBX.bat

Upgrade-UEFI.bat
Upgrade-UEFI.bat -revoke

Thank you...

garlin · Jan 6, 2026

nikki605 said:
UEFI DBX Certs
--------------
(NONE)
Windows BootMgr SVN 7.0
EFI_CERT_SHA256_GUID Signatures: 486

nikki605 said:
AUDIT REPORT
============
1. [Production PCA 2011] is missing from UEFI DBX

REQUIRED ACTION
===============

To revoke the [PCA 2011] cert, run the commands, run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x80 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

That's interesting. It's possible to instruct the scheduled task to perform some (but not all) of the revoke steps. So your UEFI has the SVN applied (good), and DBX updates (good), but not revoked CA 2011 (which was the original point of this exercise).

Follow the REQUIRED ACTION's instructions to finish the update.

garlin · Jan 8, 2026

Can I ask a favor of everyone who's gotten a failure running the update script?

Please run this short script, SecureBoot_Test.ps1

There is no "right" answer, as I'm trying to understand what's going on with different BIOS'es. If you have Secure Boot enabled, it should correctly determine if you're in Custom/Setup or Standard/User mode. Or let me know if your BIOS calls it a different name.

I have read other comments that sometimes Secure Boot as enabled/disabled is reported one way by Windows, but doesn't match the UEFI setting.
Thanks!

Fracer · Jan 8, 2026

Per your request...
------------------------------------------------------------------------
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoE -Nop -ep bypass PUSHD D:\UTILS95\UEFISecureBootVariables-garlin\; .\SecureBoot_Test.ps1;

LENOVO 10A8S03D09
FBKTE0AUS

The system is running in UEFI mode without CSM.
Secure Boot: ON and STANDARD (User) mode with factory/default keys.

PK = 862 bytes
CN=Trust - Lenovo Certificate
Count: 1

KEK = 1560 bytes
CN=Microsoft Corporation KEK CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Count: 1

DB = 8498 bytes
CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Microsoft Corporation UEFI CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
CN=Trust - Lenovo Certificate
CN=Windows UEFI CA 2023, O=Microsoft Corporation, C=US
CN=Microsoft Option ROM UEFI CA 2023, O=Microsoft Corporation, C=US
CN=Microsoft UEFI CA 2023, O=Microsoft Corporation, C=US
Count: 6

DBX = 20848 bytes
Count: 0

garlin · Jan 8, 2026

Fracer said:
Per your request...

Thanks!

suatcini54 · Jan 8, 2026

@garlin Sorry I haven't used your update script because I didn't know of a need to use it as my PC is fully updated regarding Secure Boot CA certificates thanks to you and others but I ran your test script. Here is the result.

I hope you find it useful for your valuable contributions to MS Secure Boot certificate update world.

garlin · Jan 8, 2026

suatcini54 said:
@garlin Sorry I haven't used your update script because I didn't know of a need to use it as my PC is fully updated regarding Secure Boot CA certificates thanks to you and others but I ran your test script. Here is the result.

suatcini54 said:
I hope you find it useful for your valuable contributions to MS Secure Boot certificate update world.

The more results I can gather will help me understand if there are differences out there. Thanks!

Alan Smithee · Jan 8, 2026

My result

cool59 · Jan 8, 2026

Hello.
Here is my output:

zbook · Jan 8, 2026

garlin said:
The more results I can gather will help me understand if there are differences out there. Thanks!

This is a computer with Windows 10:

Code:

Secure Boot: OFF
Virtualization Based Security: OFF
BitLocker on (C:) OFF

UEFI is in Setup Mode (NO CERTS).

EFI Files
---------
    Disk 0: Windows Boot Manager [Production PCA 2011] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 0
        [Windows UEFI CA 2023] not in UEFI DB.


REQUIRED ACTION
===============

OPTION 1:  To install [UEFI CA 2023] certs WITHOUT REVOKING the [PCA 2011] cert, run the command:

    Update_UEFI-CA2023.ps1


OPTION 2:  To install [UEFI CA 2023] certs and REVOKE the [PCA 2011] cert, run the command:

    Update_UEFI-CA2023.ps1 -Revoke

PS C:\WINDOWS\system32>

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

Attachments

My Computer

New member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer