Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

man00 · Jan 15, 2026

garlin said:
That one's not my script. I wrote a different because the cjee21 script's output is harder to read.

Where is your script? Are there any other things in to download before I run it?

Scott · Jan 15, 2026

man00 said:
Where is your script? Are there any other things in to download before I run it?

Go here and download the .zip file.

Release v2026.01.03 · garlin-cant-code/SecureBoot-CA-2023-Updates

Updated the Windows UBR minimum requirement to Oct. 2025, in order to match the latest DBXUpdate.bin Corrected a major flaw with "CN=" regex parsing, cause some vendor certs to be wrongly reported ...

github.com

garlin · Jan 15, 2026

Also it's attached on post #1.

JohnSmith13 · Jan 16, 2026

Could this be related?
Unable to enter Safe Mode: The digital signature for winload.efi couldn't be verified

Thanks in advance.

Kees · Jan 16, 2026

@JohnSmith13 This is the third thread that you use to get attention for your own thread.
Could you please stop continuing that?
You are stealing other threads!

kelper · Jan 16, 2026

Kees said:
@JohnSmith13 This is the third thread that you use to get attention for your own thread.
Could you please stop continuing that?
You are stealing other threads!

I don't see it that way, he's trying to be helpful.

garlin · Jan 16, 2026

It's alright, I replied back to @JohnSmith13's thread. The HP PC in question probably doesn't have the factory BIOS update to install the KEK CA 2023, which is a common problem that the update script tries to solve.

man00 · Jan 16, 2026

all I come up with is
Check_DBXUpdate.bin.ps1 : The term 'Check_DBXUpdate.bin.ps1' is not recognized as the name of a cmdlet, function,
script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is
correct and try again.
At line:1 char:1
+ Check_DBXUpdate.bin.ps1 -audit

Rollback_Jockey · Jan 16, 2026

man00 said:
all I come up with is
Check_DBXUpdate.bin.ps1 : The term 'Check_DBXUpdate.bin.ps1' is not recognized as the name of a cmdlet, function,
script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is
correct and try again.
At line:1 char:1
+ Check_DBXUpdate.bin.ps1 -audit

First off, in Powershell type CD "Path to script folder" and press enter, then type ./Check_DBXUpdate.bin.ps1 (enter)

garlin · Jan 16, 2026

There are three scripts available in the ZIP file:

Check_UEFI-CA2023.ps1

Check_DBXUpdate.bin.ps1

Update_UEFI-CA2023.ps1

The primary script is Check_UEFI-CA2023.ps1, which takes the options -Audit and/or -Verbose

Check_DBXUpdate.bin.ps1 is included for technical folks who want to check DBXUpdate bin files. Normally you don't need to run this script, unless you're concerned the DBX variable contains every one of the banned files listed inside a DBXUpdate bin file.

PowerShell is a little weird that it doesn't just assume you want to run a script in the current directory (unlike CMD). You need to proceed the line with a dot/slash, or the full pathname.

Code:

 .\Check_UEFI-CA2023.ps1 -Audit
C:\Users\GARLIN\Downloads\Check_UEFI-CA2023.ps1 -Audit

kelper · Jan 17, 2026

I am getting this error. I used BIOS to delete all keys and tried again with the same result. This is a new laptop with an AMI BIOS.

PS C:\Users\Martin> cd C:\Users\Martin\Downloads\SecureBoot-CA-2023-Updates
PS C:\Users\Martin\Downloads\SecureBoot-CA-2023-Updates> .\Check_UEFI-CA2023.ps1
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF
ERROR: Failed to read UEFI Secure Boot settings.
Exception calling ".ctor" with "1" argument(s): "Cannot find the requested object.
"

Any ideas, please?

man00 · Jan 17, 2026

garlin said:
There are three scripts available in the ZIP file:

Check_UEFI-CA2023.ps1
Check_DBXUpdate.bin.ps1
Update_UEFI-CA2023.ps1

The primary script is Check_UEFI-CA2023.ps1, which takes the options -Audit and/or -Verbose

Check_DBXUpdate.bin.ps1 is included for technical folks who want to check DBXUpdate bin files. Normally you don't need to run this script, unless you're concerned the DBX variable contains every one of the banned files listed inside a DBXUpdate bin file.

PowerShell is a little weird that it doesn't just assume you want to run a script in the current directory (unlike CMD). You need to proceed the line with a dot/slash, or the full pathname.

Code:

.\Check_UEFI-CA2023.ps1 -Audit C:\Users\GARLIN\Downloads\Check_UEFI-CA2023.ps1 -Audit

Thanks for all the help, I created folders Garlin\download copied all the files in the zip
ran both
.\Check_UEFI-CA2023.ps1 -Audit and C:\Users\GARLIN\Downloads\Check_UEFI-CA2023.ps1 -Audit got the same results...Maybe something is missing in my ssetup?

garlin said:
There are three scripts available in the ZIP file:

Check_UEFI-CA2023.ps1
Check_DBXUpdate.bin.ps1
Update_UEFI-CA2023.ps1

The primary script is Check_UEFI-CA2023.ps1, which takes the options -Audit and/or -Verbose

Check_DBXUpdate.bin.ps1 is included for technical folks who want to check DBXUpdate bin files. Normally you don't need to run this script, unless you're concerned the DBX variable contains every one of the banned files listed inside a DBXUpdate bin file.

PowerShell is a little weird that it doesn't just assume you want to run a script in the current directory (unlike CMD). You need to proceed the line with a dot/slash, or the full pathname.

Code:

.\Check_UEFI-CA2023.ps1 -Audit C:\Users\GARLIN\Downloads\Check_UEFI-CA2023.ps1 -Audit

kelper · Jan 17, 2026

Try putting the filename in quotes.

Dirtyflash · Jan 17, 2026

man00 said:
Thanks for all the help, I created folders Garlin\download copied all the files in the zip
ran both
.\Check_UEFI-CA2023.ps1 -Audit and C:\Users\GARLIN\Downloads\Check_UEFI-CA2023.ps1 -Audit got the same results...Maybe something is missing in my ssetup?
View attachment 160169

The reason it did not work is that you're using the path ( file location ) that would be on Garlin's computer, not yours.

kelper · Jan 17, 2026

Dirtyflash said:
The reason it did not work is that you're using the path ( file location ) that would be on Garlin's computer, not yours.

No, he isn't. He created his own folder called Garlin!

Rollback_Jockey · Jan 17, 2026

kelper said:
Try putting the filename in quotes.

That shouldn’t cause an issue in this case as there's no spaces in the filename\path

Dirtyflash · Jan 17, 2026

I just keep it simple, it always works for all the different commands. I run it CMD as an Administrator:

powershell -nop -ep bypass -f C:\Temp\Check_UEFI-CA2023.ps1

garlin · Jan 17, 2026

@man00, you're taking the instructions a little too literally.

On the web, it's common practice to provide an example path to a folder by using the writer's name (for example C:\Users\GARLIN, instead of C:\Users\man00). Because we don't know your actual user account name.

You would substitute whatever folder name, you used to download and extract the ZIP to.

garlin · Jan 17, 2026

kelper said:
I am getting this error. I used BIOS to delete all keys and tried again with the same result. This is a new laptop with an AMI BIOS.

PS C:\Users\Martin> cd C:\Users\Martin\Downloads\SecureBoot-CA-2023-Updates
PS C:\Users\Martin\Downloads\SecureBoot-CA-2023-Updates> .\Check_UEFI-CA2023.ps1
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF
ERROR: Failed to read UEFI Secure Boot settings.
Exception calling ".ctor" with "1" argument(s): "Cannot find the requested object.
"

Something's wrong while trying to read one of the UEFI variables. Please run this test script with -Verbose

man00 · Jan 17, 2026

garlin said:
@man00, you're taking the instructions a little too literally.

On the web, it's common practice to provide an example path to a folder by using the writer's name (for example C:\Users\GARLIN, instead of C:\Users\man00). Because we don't know your actual user account name.

You would substitute whatever folder name, you used to download and extract the ZIP to.

I created folders Garlin\download copied all the files in the zip just to try and make things simpler and even to copy the full command

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

Attachments

My Computer

Well-known member

My Computer