Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

kelper · Jan 18, 2026

garlin said:
Get-UefiDatabaseSignatures isn't my function (it's written by a big name Windows security researcher), is blowing up on dbxDefault.

Can you run this script, which creates a binary file of your dbxDefault's contents under C:\Users\Kelper\Downloads\dbxDefault.bin?
ZIP the bin file, and attach it to a post.

@garlin Which script? I think the attachment is missing?

krzemien · Jan 18, 2026

@garlin, your 'Update-UEFI.bat' - dated 21/12/25 - in the latest ZIP file (downloaded it just now) incorrectly refers to Update_UEFI-CA2023.ps rather than Update_UEFI-CA2023.ps1.

Small error, but rather important one for those uninitiated.

garlin · Jan 18, 2026

kelper said:
@garlin Which script? I think the attachment is missing?

Sorry. I was watching my football team got crushed in the playoffs, and forgot.

garlin · Jan 18, 2026

krzemien said:
@garlin, your 'Update-UEFI.bat' - dated 21/12/25 - in the latest ZIP file (downloaded it just now) incorrectly refers to Update_UEFI-CA2023.ps rather than Update_UEFI-CA2023.ps1.

Small error, but rather important one for those uninitiated.

Thanks. You're the second person to report it. I'll have another version later today.

kelper · Jan 18, 2026

garlin said:
Sorry. I was watching my football team got crushed in the playoffs, and forgot.

@garlin

Here it is. I hope this helps?

garlin · Jan 18, 2026

kelper said:
Here it is. I hope this helps?

Yep. I can confirm the function blows up with your copy of dbxDefault. dbxDefault is the factory data, you can't overwrite by manually going into Setup Mode or playing around with key management.

It's not a function I wrote, but I'll try to see what we can do about it.

kelper · Jan 18, 2026

garlin said:
Yep. I can confirm the function blows up with your copy of dbxDefault. dbxDefault is the factory data, you can't overwrite by manually going into Setup Mode or playing around with key management.

It's not a function I wrote, but I'll try to see what we can do about it.

I think if I delete all the keys the Bios might let me read and write to the keys

garlin · Jan 18, 2026

I found the source of your error, and it's strange. Matt Graeber's function Get-UefiDatabaseSignatures fails, because it thinks there's a X509 certificate stored in the dbxDefault variable (which is a factory default and cannot be updated, outside of a BIOS update).

The function aborts since .NET doesn't recognize the bytes as a valid certificate. But I can get back a SignatureOwner.

This signature 26dc4851-195f-4ae1-9a19-fbf883bbb35e belongs to the infamous AMI Test PK.

Let's roll back to the infamous "PK Fail" scandal... A number of major PC makers (Dell, HP, Lenovo) license the AMI BIOS. AMI provided a reference example of the BIOS code to the vendors, stamped "DO NOT TRUST - AMI Test PK".

Obviously the magic words "DO NOT TRUST" and "Test PK" should have informed the vendors you shouldn't just copy the AMI example and roll it out as your own BIOS. :facepalm:

Guess what? They did, and a few years back some Windows security researchers discovered hundreds of PC models using some form of "DO NOT TRUST" or Test PK's. The security model for UEFI says every vendor should make their own unique Platform Keys, so an attacker has to break one PK at a time. If everyone uses the same key, then breaking it means you have exposed everyone using the same BIOS source.

Some vendors went back, and re-released their BIOS to include a distinct vendor key (no more "DO NOT TRUST"). And other vendors never acknowledged the problem by offering a newer BIOS.

I have no idea why your dbxDefault looks corrupted. But I would suggest trying to reflash the last released BIOS on it again.

kelper · Jan 18, 2026

garlin said:
I found the source of your error, and it's strange. Matt Graeber's function Get-UefiDatabaseSignatures fails, because it thinks there's a X509 certificate stored in the dbxDefault variable (which is a factory default and cannot be updated, outside of a BIOS update).

The function aborts since .NET doesn't recognize the bytes as a valid certificate. But I can get back a SignatureOwner.

This signature 26dc4851-195f-4ae1-9a19-fbf883bbb35e belongs to the infamous AMI Test PK.

Let's roll back to the infamous "PK Fail" scandal... A number of major PC makers (Dell, HP, Lenovo) license the AMI BIOS. AMI provided a reference example of the BIOS code to the vendors, stamped "DO NOT TRUST - AMI Test PK".

Obviously the magic words "DO NOT TRUST" and "Test PK" should have informed the vendors you shouldn't just copy the AMI example and roll it out as your own BIOS.

Guess what? They did, and a few years back some Windows security researchers discovered hundreds of PC models using some form of "DO NOT TRUST" or Test PK's. The security model for UEFI says every vendor should make their own unique Platform Keys, so an attacker has to break one PK at a time. If everyone uses the same key, then breaking it means you have exposed everyone using the same BIOS source.

Some vendors went back, and re-released their BIOS to include a distinct vendor key (no more "DO NOT TRUST"). And other vendors never acknowledged the problem by offering a newer BIOS.

I have no idea why your dbxDefault looks corrupted. But I would suggest trying to reflash the last released BIOS on it again.

My vendor, Acemagic offers zero updates. Please let things lie. I think my case is an outlier and won't help others. But I am very grateful.

garlin · Jan 18, 2026

kelper said:
My vendor, Acemagic offers zero updates. Please let things lie. I think my case is an outlier and won't help others. But I am very grateful.

I'm adding a check in the script to skip over this error (no biggie). A lot of code maintenance is taking care of outliers. Because if you don't explore why the outlier failed, then you don't truly understand a problem.

kelper · Jan 18, 2026

Thanks. In your latest .bat files, could you add pause at the end so that the script output does not flash up and disappear? I know How to run it in a command prompt window, but if you right-click and run as admin, it comes and goes like a teenage boy.

Fracer · Jan 18, 2026

I'm having similar issues testing all three of the latest .ps1 scripts. Specifically,
Thu 01/15/2026 12:31 PM 45,944 Update_UEFI-CA2023.ps1
Sat 01/03/2026 03:44 PM 18,601 Check_DBXUpdate.bin.ps1
Thu 01/15/2026 12:31 PM 46,008 Check_UEFI-CA2023.ps1.

Scripts complain about missing files in 'C:\WINDOWS\System32\SecureBootUpdates\' directory.
A simple example for Check-UEFI.ps1:

Get-FileHash: D:\UTILS95\UEFISecureBootVariables-garlin\Check_UEFI-CA2023.ps1:1177
Line |
1177 | … $SkuSiPolicy_File_Hash = (Get-FileHash $SkuSiPolicy_File).Hash
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Cannot find path 'C:\WINDOWS\System32\SecureBootUpdates\SkuSiPolicy.p7b'
| because it does not exist.

Disk 0: SkuSiPolicy.p7b (for VBS) is WRONG VERSION.
DBX update file "C:\WINDOWS\System32\SecureBootUpdates\dbxupdate.bin" not found.
InvalidOperation: Unable to find type [works].

Both files 'C:\WINDOWS\System32\SecureBootUpdates\SkuSiPolicy.p7b' and 'C:\WINDOWS\System32\SecureBootUpdates\dbxupdate.bin'
exist. However they can only be modified by TrustedInstaller

Full Permissions) while all other access classes only have (Read-Execute Permission).

Could this, at least partially, be a permission problem? Help appreciated.

Thanks.

garlin · Jan 18, 2026

Fracer said:
I'm having similar issues testing all three of the latest .ps1 scripts. Specifically,
Thu 01/15/2026 12:31 PM 45,944 Update_UEFI-CA2023.ps1
Sat 01/03/2026 03:44 PM 18,601 Check_DBXUpdate.bin.ps1
Thu 01/15/2026 12:31 PM 46,008 Check_UEFI-CA2023.ps1.

Scripts complain about missing files in 'C:\WINDOWS\System32\SecureBootUpdates\' directory.

The scripts only need file read access, and obviously the folder execute permission to open "\Windows\System32\SecureBootUpdates".

Here is my icacls output for the folder:

Code:

>icacls.exe C:\Windows\System32\SecureBootUpdates
C:\Windows\System32\SecureBootUpdates NT SERVICE\TrustedInstaller:(F)
                                      NT SERVICE\TrustedInstaller:(OI)(CI)(IO)(F)
                                      NT AUTHORITY\SYSTEM:(RX)
                                      NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(GR,GE)
                                      BUILTIN\Administrators:(RX)
                                      BUILTIN\Administrators:(OI)(CI)(IO)(GR,GE)
                                      BUILTIN\Users:(RX)
                                      BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
                                      APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
                                      APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)
                                      APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX)
                                      APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)

Successfully processed 1 files; Failed processing 0 files

>icacls.exe C:\Windows\System32\SecureBootUpdates\SKUSiPolicy.P7b
C:\Windows\System32\SecureBootUpdates\SKUSiPolicy.P7b NT SERVICE\TrustedInstaller:(F)
                                                      BUILTIN\Administrators:(RX)
                                                      NT AUTHORITY\SYSTEM:(RX)
                                                      BUILTIN\Users:(RX)
                                                      APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
                                                      APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX)

Successfully processed 1 files; Failed processing 0 files

Fracer · Jan 18, 2026

Thanks.

Here are my icacls for the individual files:
--------------------------------------------------------------
File 'SKUSiPolicy.P7b' Permissions:
C:\Windows\System32\SecureBootUpdates\SKUSiPolicy.P7b NT SERVICE\TrustedInstaller

F)
BUILTIN\Administrators

RX)
NT AUTHORITY\SYSTEM

RX)
BUILTIN\Users

RX)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES

RX)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES

RX)

Successfully processed 1 files; Failed processing 0 files

--------------------------------------------------------------
File 'dbxupdate.bin" Permissions:
C:\Windows\System32\SecureBootUpdates\dbxupdate.bin NT SERVICE\TrustedInstaller

F)
BUILTIN\Administrators

RX)
NT AUTHORITY\SYSTEM

RX)
BUILTIN\Users

RX)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES

RX)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES

RX)

Successfully processed 1 files; Failed processing 0 files

--------------------------------------------------------------

man00 · Jan 18, 2026

garlin said:

The scripts only need file read access, and obviously the folder execute permission to open "\Windows\System32\SecureBootUpdates".

Here is my icacls output for the folder:

Code:

>icacls.exe C:\Windows\System32\SecureBootUpdates
C:\Windows\System32\SecureBootUpdates NT SERVICE\TrustedInstaller:(F)
                                      NT SERVICE\TrustedInstaller:(OI)(CI)(IO)(F)
                                      NT AUTHORITY\SYSTEM:(RX)
                                      NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(GR,GE)
                                      BUILTIN\Administrators:(RX)
                                      BUILTIN\Administrators:(OI)(CI)(IO)(GR,GE)
                                      BUILTIN\Users:(RX)
                                      BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
                                      APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
                                      APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)
                                      APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX)
                                      APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)

Successfully processed 1 files; Failed processing 0 files

>icacls.exe C:\Windows\System32\SecureBootUpdates\SKUSiPolicy.P7b
C:\Windows\System32\SecureBootUpdates\SKUSiPolicy.P7b NT SERVICE\TrustedInstaller:(F)
                                                      BUILTIN\Administrators:(RX)
                                                      NT AUTHORITY\SYSTEM:(RX)
                                                      BUILTIN\Users:(RX)
                                                      APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
                                                      APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX)

Successfully processed 1 files; Failed processing 0 files

Maybe thats my issue, I don't have the folder "\Windows\System32\SecureBootUpdates

garlin · Jan 18, 2026

@Fracer:
Check the icacls for SecureBootUpdates folder.
You can have read/execute permissions for any file inside a folder, but not have folder permissions to navigate inside the folder.

@man00:
Everyone has a \Windows\System32\SecureBootUpdates folder if you're on W11 24H2/25H2, or have W10 22H2 and W11 21H2 thru 23H2 with the latest monthly updates. This folder has existed since April 2024.

Fracer · Jan 18, 2026

garlin said:
@Fracer:
Check the icacls for SecureBootUpdates folder.
You can have read/execute permissions for any file inside a folder, but not have folder permissions to navigate inside the folder.

@man00:
Everyone has a \Windows\System32\SecureBootUpdates folder if you're on W11 24H2/25H2, or have W10 22H2 and W11 21H2 thru 23H2 with the latest monthly updates. This folder has existed since April 2024.

C:\Windows\System32\SecureBootUpdates NT SERVICE\TrustedInstaller(F)
NT SERVICE\TrustedInstaller(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM(RX)
NT AUTHORITY\SYSTEM(OI)(CI)(IO)(GR,GE)
BUILTIN\Administrators(RX)
BUILTIN\Administrators(OI)(CI)(IO)(GR,GE)
BUILTIN\Users(RX)
BUILTIN\Users(OI)(CI)(IO)(GR,GE)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES(RX)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGE(OI)(CI)(IO)(GR,GE)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES(RX)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES(OI)(CI)(IO)(GR,GE)

Successfully processed 1 files; Failed processing 0 files

garlin · Jan 18, 2026

That's the same rights. The script checks if you have Admin rights, and will re-run itself if you're not Admin. Did you modify your UAC?

Fracer · Jan 18, 2026

garlin said:
That's the same rights. The script checks if you have Admin rights, and will re-run itself if you're not Admin. Did you modify your UAC?

UAC is "OFF (Not Recommended.)"

Here is the cmd console configuration I run in (w/Administrator permissions):
GROUPS:
BUILTIN\Administrators Alias S-1-5-32
BUILTIN\Backup Operators Alias S-1-5-32
BUILTIN\Event Log Readers Alias S-1-5-32
BUILTIN\Remote Desktop Users Alias S-1-5-32
BUILTIN\Users Alias S-1-5-32
CONSOLE LOGON Well-known group S-1-2-1
Everyone Well-known group S-1-1-0
LOCAL Well-known group S-1-2-0
Mandatory Label\System Mandatory Level Label S-1-16-1
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11
NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4
NT AUTHORITY\Local account Well-known group S-1-5-11
NT AUTHORITY\Local account and member of Administrators group Well-known group S-1-5-11
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64
NT AUTHORITY\This Organization Well-known group S-1-5-15

garlin · Jan 18, 2026

I disabled UAC (Not Recommended), and Check_UEFI-CA2023.ps1 works fine for me.

But if I tried to copy the SkuSiPolicy.p7b, following the MS instructions, you'll get a permission error unless you're elevated to Admin. Try running the scripts from an Admin window.

Plain GARLIN (no UAC)

Code:

PS C:\Users\GARLIN\Downloads> mountvol S: /s
PS C:\Users\GARLIN\Downloads> copy C:\Windows\System32\SecureBootUpdates\SKUSiPolicy.P7b S:\EFI\Microsoft\Boot
Copy-Item: Access to the path 'S:\EFI\Microsoft\Boot\SKUSiPolicy.P7b' is denied.
PS C:\Users\GARLIN\Downloads> dir s:\efi\microsoft\boot
Get-ChildItem: Access to the path 'S:\efi\microsoft\boot' is denied.
PS C:\Users\GARLIN\Downloads> dir s:
Get-ChildItem: Access to the path 'S:\' is denied.

Admin

Code:

PS C:\Users\GARLIN\Downloads> mountvol S: /s
PS C:\Users\GARLIN\Downloads> dir s:

    Directory: s:\

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d----           1/13/2026 12:50 PM                EFI

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computers

Active member

My Computer

Well-known member

Attachments

My Computer

Well-known member

My Computer

Well-known member

Attachments

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

New member

Attachments

My Computer

Well-known member

My Computer

New member

My Computer

Well-known member

My Computer

Well-known member

My Computer

New member

My Computer

Well-known member

My Computer

New member

My Computer

Well-known member

My Computer