Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

garlin · Jan 31, 2026

It will finish the process, so there aren't any more REQUIRED ACTIONS. Some folks are are hesistant if you do the fully revocation without their approval. Others are comfortable doing it right away. I try to keep both parties satisfied.

TheVisitor · Jan 31, 2026

I finally got brave and ran the revoke. Does look OK ? I rebooted twice and nothing blew up yet:

PS C:\WINDOWS\system32> powershell -nop -ep bypass -f C:\temp1\check_uefi-ca2023.ps1
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 7.0

EFI Files
---------
Disk 0: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

Disk 0: SkuSiPolicy.p7b (for VBS) is CURRENT.

STATUS REPORT
-------------
Registry: UEFICA2023Status = Updated

garlin · Jan 31, 2026

TheVisitor said:
I finally got brave and ran the revoke. Does look OK ? I rebooted twice and nothing blew up yet:

You're done.

JamesSmith · Jan 31, 2026

Hi Garlin I decided to test your script on my wife's Laptop. It's a 2021 ThinkBook 14 G2 ITL Laptop - Type 20VD
Running Windows 11 Pro and latest BIOS update available was in early 2024.

I had not done any secure boot updates on this machine so I started from the beginning.

I ran the check script and I was missing a whole bunch of things. Next I ran the Update_UEFI-CA2023 It was easy able to follow and I was able to do all the things to script told me. However I did get stuck on the ".\Update_UEFI-CA2023.ps1" -SkuSiPolicy which would not work but followed your instructions in post #69 which fixed that. This whole process took about 10 - 15 minutes.

Here is the output for this Machine. Is this the last time I will need to update this secure boot stuff?

garlin · Jan 31, 2026

JamesSmith said:
Here is the output for this Machine. Is this the last time I will need to update this secure boot stuff?

"SUCCESS: NO UPDATES REQUIRED" means you're finished.

antspants · Jan 31, 2026

Meanwhile, where I should have left things well alone (because all that was missing were DBX entries) I deleted everything from my BIOS.
I’ve not been well and wasn’t focusing, I have no excuse and don’t know what I have done.

No PK
No KEK
No DB
No DBX

Can’t boot unless I change BIOS to “Other OS”
Can’t restore defaults or I am told I have to change to “Other OS”

I can manually add stuff, but I don’t know which files to add or restore.
The Github link has so many

Restoring the BIOS from a 2014 BIOS update (last one available) did nothing to replace the defaults.

Asus Maximus VI Formula

garlin · Jan 31, 2026

If you've deleted everything from your UEFI, then it's in Setup Mode. You should be able to use the Update_UEFI-CA2023.ps1 script to convert the UEFI to use the generic "Windows OEM Devices PK".

JamesSmith · Jan 31, 2026

garlin said:
"SUCCESS: NO UPDATES REQUIRED" means you're finished.

So no extra steps from now until June?

goink · Jan 31, 2026

@garlin

One more thing.

We started with (from my Log):

REQUIRED ACTION
===============

To revoke the [PCA 2011] cert, run the commands, run the commands:

manage-bde -Protectors -Disable C: -RebootCount 1
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x280 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

To install SkuSiPolicy.p7b, run the command:
Update_UEFI-CA2023.ps1 -SkuSiPolicy

We ended with:

If you want to perform both halves of the revocation process (block CA 2011 and update the VBS policy), you can run the update script:

Code:
powershell -ep bypass -f .\Update_UEFI-CA2023.ps1 -revoke

My question is:

Are the following x02 lines still required before running the all-in "powershell -ep bypass -f .\Update_UEFI-CA2023.ps1 -revoke":

manage-bde -Protectors -Disable C: -RebootCount 1
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x280 /f

Sorry for any bother...

antspants · Jan 31, 2026

garlin said:
If you've deleted everything from your UEFI, then it's in Setup Mode. You should be able to use the Update_UEFI-CA2023.ps1 script to convert the UEFI to use the generic "Windows OEM Devices PK".

OK, thank you. It's much better. But after I deleted everything, I already ran that so not sure what happened.

Also...

Check_UEFI-CA2023.ps1

Code:

PowerShell 7.5.4
Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    (NONE)
MethodInvocationException: C:\Check_UEFI-CA2023.ps1:441
Line |
 441 |      $SVN = '{0}.{1}' -f [int]::Parse($SignatureData.Substring(36,4),  …
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Exception calling "Substring" with "2" argument(s): "startIndex cannot be larger than length of string. (Parameter 'startIndex')"

EFI Files
---------
    Disk 2: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.
MethodInvocationException: C:\Check_UEFI-CA2023.ps1:441
Line |
 441 |      $SVN = '{0}.{1}' -f [int]::Parse($SignatureData.Substring(36,4),  …
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Exception calling "Substring" with "2" argument(s): "startIndex cannot be larger than length of string. (Parameter 'startIndex')"


REQUIRED ACTION
===============

To revoke the [PCA 2011] cert, run the commands, run the commands:

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x282 /f
    powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

PS C:\Windows\System32>

P.S.
Garlin, this isn't in my EFI partition

- Browse the system drive's EFI partition
- Enter the <EFI> folder
- Enter the <Updates> sub-folder

Check_DBXUpdate.bin

Code:

PowerShell 7.5.4
FAILED: Missing 431/431 SVN signatures from "dbxupdate.bin"
MethodInvocationException: C:\SecureBoot-CA-2023-Updates\Check_DBXUpdate.bin.ps1:279
Line |
 279 |      $SVN = '{0}.{1}' -f [int]::Parse($SignatureData.Substring(36,4),  …
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Exception calling "Substring" with "2" argument(s): "startIndex cannot be larger than length of string.
     | (Parameter 'startIndex')"
MethodInvocationException: C:\SecureBoot-CA-2023-Updates\Check_DBXUpdate.bin.ps1:279
Line |
 279 |      $SVN = '{0}.{1}' -f [int]::Parse($SignatureData.Substring(36,4),  …
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Exception calling "Substring" with "2" argument(s): "startIndex cannot be larger than length of string.
     | (Parameter 'startIndex')"
MethodInvocationException: C:\SecureBoot-CA-2023-Updates\Check_DBXUpdate.bin.ps1:279
Line |
 279 |      $SVN = '{0}.{1}' -f [int]::Parse($SignatureData.Substring(36,4),  …
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Exception calling "Substring" with "2" argument(s): "startIndex cannot be larger than length of string.
     | (Parameter 'startIndex')"
FAILED: Missing 3/3 SVN signatures from "DBXUpdate2024.bin"
MethodInvocationException: C:\SecureBoot-CA-2023-Updates\Check_DBXUpdate.bin.ps1:279
Line |
 279 |      $SVN = '{0}.{1}' -f [int]::Parse($SignatureData.Substring(36,4),  …
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Exception calling "Substring" with "2" argument(s): "startIndex cannot be larger than length of string.
     | (Parameter 'startIndex')"
MethodInvocationException: C:\SecureBoot-CA-2023-Updates\Check_DBXUpdate.bin.ps1:279
Line |
 279 |      $SVN = '{0}.{1}' -f [int]::Parse($SignatureData.Substring(36,4),  …
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Exception calling "Substring" with "2" argument(s): "startIndex cannot be larger than length of string.
     | (Parameter 'startIndex')"
MethodInvocationException: C:\SecureBoot-CA-2023-Updates\Check_DBXUpdate.bin.ps1:279
Line |
 279 |      $SVN = '{0}.{1}' -f [int]::Parse($SignatureData.Substring(36,4),  …
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Exception calling "Substring" with "2" argument(s): "startIndex cannot be larger than length of string.
     | (Parameter 'startIndex')"
FAILED: Missing 3/3 SVN signatures from "DBXUpdateSVN.bin"

PS C:\Windows\System32>

garlin · Jan 31, 2026

JamesSmith said:
So no extra steps from now until June?

No you're done for the year.

garlin · Jan 31, 2026

antspants said:

OK, thank you. It's much better. But after I deleted everything, I already ran that so not sure what happened.

Also...

Check_UEFI-CA2023.ps1

Code:

PowerShell 7.5.4
Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023
[/QUOTE]
Short answer:  This part went well.

[QUOTE="antspants, post: 704375, member: 19604"]

UEFI DBX Certs
--------------
    (NONE)
MethodInvocationException: C:\Check_UEFI-CA2023.ps1:441
Line |
 441 |      $SVN = '{0}.{1}' -f [int]::Parse($SignatureData.Substring(36,4),  …
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Exception calling "Substring" with "2" argument(s): "startIndex cannot be larger than length of string. (Parameter 'startIndex')"
[/QUOTE]
This part failed.  The script is trying to read your DBX entries (which are blank, or supposedly blank).  I've have to do a manual test to see if the script's at fault, or you have a funky messed up UEFI.

The checking is trying to extract data from the DBX's bytes, but it's malformed so it can't make sense of it.

antspants · Jan 31, 2026

garlin said:
or you have a funky messed up UEFI.

I’d say that ^
I doubt it’s your script.

antspants · Jan 31, 2026

Can I just add one manually?
If yes, there are at least 10 DBX files at Github. Some are bin and some are json.
If I knew which one to append, I would.

antspants · Jan 31, 2026

I can:

Delete DBX file
Load default (fails)
Append (with what file?)

There is no folder in the EFI with any files.

Rollback_Jockey · Jan 31, 2026

antspants said:
Meanwhile, where I should have left things well alone (because all that was missing were DBX entries) I deleted everything from my BIOS.
I’ve not been well and wasn’t focusing, I have no excuse and don’t know what I have done.

No PK
No KEK
No DB
No DBX

Can’t boot unless I change BIOS to “Other OS”
Can’t restore defaults or I am told I have to change to “Other OS”

I can manually add stuff, but I don’t know which files to add or restore.
The Github link has so many

Restoring the BIOS from a 2014 BIOS update (last one available) did nothing to replace the defaults.

Asus Maximus VI Formula

Can you go into the secureboot setup and load defaults?

antspants · Jan 31, 2026

There is no folder in the EFI with any files.
In there, I have 2 folders “Microsoft” and “Boot”

Rollback_Jockey said:
Can you go into the secureboot setup and load defaults?

Not unless I want to screw stuff up.

antspants said:
I’ve not been well and wasn’t focusing, I have no excuse and don’t know what I have done.

No PK
No KEK
No DB
No DBX

Can’t boot unless I change BIOS to “Other OS”
Can’t restore defaults or I am told I have to change to “Other OS”

I can manually add stuff, but I don’t know which files to add or restore.
The Github link has so many

Restoring the BIOS from a 2014 BIOS update (last one available) did nothing to replace the defaults.

Asus Maximus VI Formula

garlin · Jan 31, 2026

There ought to be a factory reset mode for UEFI variables, even if you can't edit individual keys. The update script will only copy files to the EFI partition under \Cert folders, if it detects you have an unsupported BIOS.

Unsupported means the BIOS thumbprint doesn't appear on MS's GitHub list of supported BIOS'es. The DBX situation is separate, I have one other report of a "funky" UEFI where the DBX was balky (from kelper).

antspants · Jan 31, 2026

garlin said:
There ought to be a factory reset mode for UEFI variables, even if you can't edit individual keys. The update script will only copy files to the EFI partition under \Cert folders, if it detects you have an unsupported BIOS.

Unsupported means the BIOS thumbprint doesn't appear on MS's GitHub list of supported BIOS'es. The DBX situation is separate, I have one other report of a "funky" UEFI where the DBX was balky (from kelper).

REPUBLIC OF GAMERS UEFI BIOS Utility - Advanced Mode

Boot \ Secure Boot menu \ Key Management >

Clear Secure Boot

Save Secure Boot Keys

PK Management

Delete PK

Load PK from File

KEK Management

Delete the KEK

Load KEK from File

Append KEK from File

DB Management

Delete the db

Load db from File

Append db from File

DBX Management

Delete the dbx

Load dbx from File

Append dbx from File

Loading defaults on any of them causes the following:

The system found unauthorised changes on the firmware, operating system or UEFI drivers.

Press [N] (does nothing) to run the next boot device, or enter directly to the BIOS setup if there are no other boot devices installed.
Go to BIOS setup > Advanced > Boot and change the current boot device into "Other secured boot devices"

in fact, doing anything with DBX results in the above

garlin · Jan 31, 2026

I hate this part. Some UEFI's will allow for custom key management, but you have to change another Secure Boot setting. Don't know what it's called on your ASUS, but try exploring the other Secure Boot options. I know HP does the same thing.

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computer

Well-known member

My Computers

Member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computer

Well-known member

My Computer

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computer