Solved garlin's PowerShell scripts for updating Secure Boot CA 2023


Use command prompt as admin and run

Powershell -nop - ep bypass -f “path to the file”

Otherwise, you may have to define execution policy, profile, etc. in powershell console before you can run the .ps1 script.

Hope this helps.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro build 26200.8524Intel i7-4790Teams DDR3-1600 4x4 GBMSI Nvidia GeForce GTX 1050Ti
    OS
    Windows 11 Pro build 26200.8524
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home Built
    CPU
    Intel i7-4790
    Motherboard
    Asus H97 Pro Gamer with add-on TPM1.2 module
    Memory
    Teams DDR3-1600 4x4 GB
    Graphics Card(s)
    MSI Nvidia GeForce GTX 1050Ti
    Sound Card
    Realtek ALC1150
    Monitor(s) Displays
    Dell P2425D
    Screen Resolution
    2560 by 1440 pixels
    Hard Drives
    Corsair NVMe M.2 Core XT 1000 GB (Windows 11 v.25H2); Samsung SATA Evo 870 500 GB (Windows 11 v.25H2);
    PSU
    Corsair HX850
    Case
    Gigabyte Solo 210
    Cooling
    Zalman CNPS7X Tower
    Keyboard
    Microsoft AIO Wireless (includes touchpad)
    Mouse
    HP S1000 Plus Wireless
    Internet Speed
    500 Mb fiber optic
    Browser
    Chrome; MS Edge
    Antivirus
    Windows Defender

  • At a glance

    MacOS 12 MontereyIntel Core i58 GBIntel integrated
    Operating System
    MacOS 12 Monterey
    Computer type
    Laptop
    Manufacturer/Model
    Apple Macbook Air
    CPU
    Intel Core i5
    Memory
    8 GB
    Graphics card(s)
    Intel integrated
    Screen Resolution
    1440 by 900 pixels
    Hard Drives
    128 GB
    Keyboard
    Built-in
    Mouse
    Microsoft Wireless
    Internet Speed
    802.11 ac
    Browser
    Chrome; Safari
    Antivirus
    N/A
@garlin

PS C:\Users\Martin> C:\Users\Martin\Downloads\Debug_Kelper.ps1 -verbose
Windows 11 25H2 (26200.7623)

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
AB8139 LX15PRO
Version: CT_BI_AMI_LX15PRO_AB8139_A-004
Date: 2025-01-03
Trying to count bytes in PK
Trying to count bytes in KEK
Trying to count bytes in db
Trying to count bytes in dbx
Trying to read UEFI PKDefault:
Sending var to Get-UefiDatabaseSignatures
Trying to read UEFI KEKDefault:
Sending var to Get-UefiDatabaseSignatures
Trying to read UEFI dbDefault:
Sending var to Get-UefiDatabaseSignatures
Trying to read UEFI dbxDefault:
Sending var to Get-UefiDatabaseSignatures
ERROR: Failed to read UEFI Secure Boot settings.
Exception calling ".ctor" with "1" argument(s): "Cannot find the requested object.
"
 

My Computers My Computers

System One System Two Other systems

  • At a glance

    Windows 11 Pro 25H2 26200.8894AMD Ryzen 7 5825U with Radeon Graphics16GB
    OS
    Windows 11 Pro 25H2 26200.8894
    Computer type
    Laptop
    Manufacturer/Model
    Acemagic LX15PRO
    CPU
    AMD Ryzen 7 5825U with Radeon Graphics
    Motherboard
    BIOS CT_BI_AMI_LX15PRO_AB8139_A-004
    Memory
    16GB
    Screen Resolution
    1920 x 1080
    Hard Drives
    SSD 2TB
    Internet Speed
    30 Mbps
    Browser
    Brave
    Antivirus
    Webroot SecureAnywhere Complete beta

  • At a glance

    Windows 11 Pro 23H2 22631.2506Atom N450 1.66GHz2GB
    Operating System
    Windows 11 Pro 23H2 22631.2506
    Computer type
    Laptop
    Manufacturer/Model
    HP Mini 210-1090NR PC (bought in late 2009!)
    CPU
    Atom N450 1.66GHz
    Memory
    2GB
    Browser
    Brave
    Antivirus
    Webroot
  • Acer Swift SF114-34 laptop
    OS Windows 11 Pro 26200.8894
    CPU Pentium Silver N6000
    RAM 4GB
    BIOS v1.17
    SSD Samsung 970 EVO Plus SSD 2TB (an upgrade)
Not trying to be a smrta$$, but @garlin in his releases has provided 3 *.bat files
that execute the powershell scripts with all the afforementioned arguments.

So:
Check-DBX.bat executes Check_DBXUpdate.bin.ps1 as:
pwsh -nop -ep bypass -f "%~dp0\Check_DBXUpdate.bin.ps1" %*

Check-UEFI.bat executes Check_UEFI-CA2023.ps1 as:
pwsh -nop -ep bypass -f "%~dp0\Check_UEFI-CA2023.ps1" %*

Update-UEFI.bat executes Update_UEFI-CA2023.ps as:
pwsh -nop -ep bypass -f "%~dp0\Update_UEFI-CA2023.ps1" %*


Although, @garlin I will have to add that Update-UEFI.bat has a typo:
Update_UEFI-CA2023.ps
instead of
Update_UEFI-CA2023.ps1

Hope that helps.
 

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
kelper said:
Trying to read UEFI dbxDefault:
Sending var to Get-UefiDatabaseSignatures
ERROR: Failed to read UEFI Secure Boot settings.
Exception calling ".ctor" with "1" argument(s): "Cannot find the requested object.
"
Click to expand...
Get-UefiDatabaseSignatures isn't my function (it's written by a big name Windows security researcher), is blowing up on dbxDefault.

Can you run this script, which creates a binary file of your dbxDefault's contents under C:\Users\Kelper\Downloads\dbxDefault.bin?
ZIP the bin file, and attach it to a post.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
JohnSmith13 said:
Although, @garlin I will have to add that Update-UEFI.bat has a typo:
Update_UEFI-CA2023.ps
instead of
Update_UEFI-CA2023.ps1

Hope that helps.
Click to expand...
That's helpful. I'll fix that in the next build.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
If I may add my own results.

Last year I tried with registry entries to initiate an update, but got stuck in "InProgress".
Using this script, it appears that everything is updated
and the script works just fine, on 25H2 Build 26220.7653,
although 26220 is not officially supported.

Please feel free to advise if anything is amiss.

Thanks again.

Screenshot 2026-01-18 002527.webp


Screenshot 2026-01-18 002628.webp




Please feel free to advise if anything is amiss.
 
Last edited:

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
@garlin

secureboot_objects are on v1.6.2, but you seem to be using v1.6.1.
May I ask why? There are no significant changes between them?

Thanks in advance.
 

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
Trying to run the Update_UEFI-CA2023.ps1 and I get this error:

Downloading "edk2-x64-secureboot-binaries.zip" from GitHub.
Incorrect authentication data: 0xC0000022
PS C:\WINDOWS\system32>
 

My Computer My Computer

At a glance

Windows 11 Pro 25H2Gen 11 Core i516GB
OS
Windows 11 Pro 25H2
Computer type
Laptop
Manufacturer/Model
HP
CPU
Gen 11 Core i5
Memory
16GB
JohnSmith13 said:
@garlin

secureboot_objects are on v1.6.2, but you seem to be using v1.6.1.
May I ask why? There are no significant changes between them?
Click to expand...
The base certs (PK, KEK, DB) don't really change over time. Unless there's been a recent disaster with UEFI security.

However the DBX variable includes both X509 certs and EFI_SHA_256 hash signatures. The DBX certs haven't changed, but MS will occasionally add a few banned EFI files to the hash signature list (growing it). But the v1.6.1 defaults represent a baseline of banned EFI files.

If the Secure Boot objects version is a little behind, it's OK because my update script will check the \Windows\System32\SecureBootUpdates version of DBXUpdate.bin. The logic is to apply the Windows version of DBXUpdate.bin, whenever it finds a hash that's missing from your DBX variable.

So you're covered. You can always run the update script with "-Revoke -Latest", and it will check the DBXUpdate.bin in the MS GitHub to see if it needs to update DBX again.

By default -> checks \Windows\System32\SecureBootUpdates\DBXUpdate.bin
-Latest -> checks GitHub version of DBXUpdate.bin

But I'd move to the v1.6.2 version, now that I know it's been revised.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
Phirevixen said:
Trying to run the Update_UEFI-CA2023.ps1 and I get this error:

Downloading "edk2-x64-secureboot-binaries.zip" from GitHub.
Incorrect authentication data: 0xC0000022
PS C:\WINDOWS\system32>
Click to expand...
Can you try downloading the latest version (from post #1)? This error might be fixed by the latest version.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
Can you try downloading the latest version (from post #1)? This error might be fixed by the latest version.
Click to expand...
That's the one I used. I tried to do this:

REQUIRED ACTION
===============

To install SkuSiPolicy.p7b, run the command:
Update_UEFI-CA2023.ps1 -SkuSiPolicy
 

My Computer My Computer

At a glance

Windows 11 Pro 25H2Gen 11 Core i516GB
OS
Windows 11 Pro 25H2
Computer type
Laptop
Manufacturer/Model
HP
CPU
Gen 11 Core i5
Memory
16GB
Check looked like this:

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) ON

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 7.0

EFI Files
---------
Disk 0: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

Disk 0: SkuSiPolicy.p7b (for VBS) is NOT PRESENT.


REQUIRED ACTION
===============

To install SkuSiPolicy.p7b, run the command:
Update_UEFI-CA2023.ps1 -SkuSiPolicy

PS C:\WINDOWS\system32>
 

My Computer My Computer

At a glance

Windows 11 Pro 25H2Gen 11 Core i516GB
OS
Windows 11 Pro 25H2
Computer type
Laptop
Manufacturer/Model
HP
CPU
Gen 11 Core i5
Memory
16GB
If you run "Update_UEFI-CA2023.ps1 -Version", it returns 2026.01.14?
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
If you run "Update_UEFI-CA2023.ps1 -Version", it returns 2026.01.14?
Click to expand...
I don't know how to do that. I just right click and run with PowerShell. The file properties show 01/03/2026.
 

My Computer My Computer

At a glance

Windows 11 Pro 25H2Gen 11 Core i516GB
OS
Windows 11 Pro 25H2
Computer type
Laptop
Manufacturer/Model
HP
CPU
Gen 11 Core i5
Memory
16GB
Phirevixen said:
I don't know how to do that. I just right click and run with PowerShell. The file properties show 01/03/2026.
Click to expand...
OK, got it figured out. Says now:

PS C:\users\ralfy\downloads\SecureBoot-CA-2023-Updates> .\Update_UEFI-CA2023.ps1 -Version
Update_UEFI-CA2023.ps1 version (2026.01.14)

PS C:\users\ralfy\downloads\SecureBoot-CA-2023-Updates> .\Update_UEFI-CA2023.ps1
SUCCESS: NO UPDATES ARE REQUIRED.
 

My Computer My Computer

At a glance

Windows 11 Pro 25H2Gen 11 Core i516GB
OS
Windows 11 Pro 25H2
Computer type
Laptop
Manufacturer/Model
HP
CPU
Gen 11 Core i5
Memory
16GB
But still shows this:

EFI Files
---------
Disk 0: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

Disk 0: SkuSiPolicy.p7b (for VBS) is NOT PRESENT.


REQUIRED ACTION
===============

To install SkuSiPolicy.p7b, run the command:
Update_UEFI-CA2023.ps1 -SkuSiPolicy
 

My Computer My Computer

At a glance

Windows 11 Pro 25H2Gen 11 Core i516GB
OS
Windows 11 Pro 25H2
Computer type
Laptop
Manufacturer/Model
HP
CPU
Gen 11 Core i5
Memory
16GB
You still need to run "Update_UEFI-CA2023.ps1 -SkuSiPolicy" because it's considered a "revocation" step. Once it's copied to the EFI, the policy adds restrictions. It's not done by default, since if you didn't know it was being deployed, it might be a rude surprise.

"Update_UEFI-CA2023.ps1 -Revoke" will automatically do SkuSiPolicy at the same time, but update (by default) will not as a safety mechanism. Don't want to lock you out if that wasn't your intention to do so (meaning you don't have the right boot file on a Recovery USB or Windows install ISO).
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
You still need to run "Update_UEFI-CA2023.ps1 -SkuSiPolicy" because it's considered a "revocation" step. Once it's copied to the EFI, the policy adds restrictions. It's not done by default, since if you didn't know it was being deployed, it might be a rude surprise.

"Update_UEFI-CA2023.ps1 -Revoke" will automatically do SkuSiPolicy at the same time, but update (by default) will not as a safety mechanism. Don't want to lock you out if that wasn't your intention to do so (meaning you don't have the right boot file on a Recovery USB or Windows install ISO).
Click to expand...
So you say better safe than sorry and leave it alone?
 

My Computer My Computer

At a glance

Windows 11 Pro 25H2Gen 11 Core i516GB
OS
Windows 11 Pro 25H2
Computer type
Laptop
Manufacturer/Model
HP
CPU
Gen 11 Core i5
Memory
16GB
No, you can go ahead and use it. The previous version of the Update script was all or nothing. You couldn't update SkuSiPolicy without a full CA 2011 revocation. That's why it has its own option flag.

I realized it was kinda bad to leave VBS unprotected if you didn't do a full revoke. Now you have the option to do SkuSiPolicy separately, or together with the full revoke.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
Now we're talking, thank you Sir:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! Install PowerShell on Windows - PowerShell

PS C:\WINDOWS\system32> cd "C:\Users\Ralfy\Downloads\SecureBoot-CA-2023-Updates"
PS C:\Users\Ralfy\Downloads\SecureBoot-CA-2023-Updates> .\Check_UEFI-CA2023.ps1
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) ON

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 7.0

EFI Files
---------
Disk 0: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

Disk 0: SkuSiPolicy.p7b (for VBS) is CURRENT.

STATUS REPORT
-------------
Registry: UEFICA2023Status = Updated

SUCCESS: NO UPDATES ARE REQUIRED.
 

My Computer My Computer

At a glance

Windows 11 Pro 25H2Gen 11 Core i516GB
OS
Windows 11 Pro 25H2
Computer type
Laptop
Manufacturer/Model
HP
CPU
Gen 11 Core i5
Memory
16GB
You must log in or register to reply here.

Latest Support Threads

Latest Tutorials

Back
Top Bottom