Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

garlin · Feb 1, 2026

EB2XR6 said:
I did a search and the answer was use the F10 key.
To create a bootable USB Drive download Rufus from Rufus - Create bootable USB drives the easy way

For now, temporarily disable Secure Boot in BIOS and start Windows. Run the check script, and post the output.

If you're in a boot loop, it's nearly impossible to debug it. Turning off Secure Boot will disable the security checks, and allow Windows to boot normally. From there, we can determine the next steps. Some older HP PC's appear to have a finicky BIOS that don't update correctly.

HerefordBull · Feb 1, 2026

garlin said:
For now, temporarily disable Secure Boot in BIOS and start Windows. Run the check script, and post the output.

If you're in a boot loop, it's nearly impossible to debug it. Turning off Secure Boot will disable the security checks, and allow Windows to boot normally. From there, we can determine the next steps. Some older HP PC's appear to have a finicky BIOS that don't update correctly.

I guess this reply was for me.
There's no way of getting into the BIOS, it's bricked. I've tried all the F keys and esc. Finally managed to format a usb with Fat32 and get the HP BIOS flash installed onto it but that doesn't work either. Also tried some other UEFI repair thing from HP and that did actually respond, telling me some files were corrupt and had been replaced but ultimately nothing changed. Finally tried Rufus with Win10 on it but that doesn't work either.
Just ordered a new mobo.

garlin · Feb 1, 2026

HerefordBull said:
I guess this reply was for me.
There's no way of getting into the BIOS, it's bricked. I've tried all the F keys and esc. Finally managed to format a usb with Fat32 and get the HP BIOS flash installed onto it but that doesn't work either. Also tried some other UEFI repair thing from HP and that did actually respond, telling me some files were corrupt and had been replaced but ultimately nothing changed. Finally tried Rufus with Win10 on it but that doesn't work either.
Just ordered a new mobo.

Can you try one last trick? Power off the system. Locate the motherboard battery, and remove it. Wait 10 min. and reinsert it. Power on.

The script can only apply changes to the UEFI Secure Boot variables. It cannot alter the BIOS firmware, or change other settings (for security reasons, BIOS changes other than firmware updates have to be done in person). I don't know why you can't at least enter the BIOS screen unless the HP BIOS tool had some problems.

HerefordBull · Feb 1, 2026

garlin said:
Can you try one last trick? Power off the system. Locate the motherboard battery, and remove it. Wait 10 min. and reinsert it. Power on.

The script can only apply changes to the UEFI Secure Boot variables. It cannot alter the BIOS firmware, or change other settings (for security reasons, BIOS changes other than firmware updates have to be done in person). I don't know why you can't at least enter the BIOS screen unless the HP BIOS tool had some problems.

Already tried the CMOS battery. When I start it I get the HP logo and in the bottom left of the screen it says 'entering set up menu' but then the pc just shuts down.

gunrunnerjohn · Feb 1, 2026

If removing the battery and then shorting it's terminals for 20-30 minutes doesn't do the trick, it sounds like you're truly bricked.

HerefordBull · Feb 2, 2026

gunrunnerjohn said:
If removing the battery and then shorting it's terminals for 20-30 minutes doesn't do the trick, it sounds like you're truly bricked.

Have to admit I've never heard of shorting the terminals, I just drained the power and took the battery out for 5-10 minutes then replaced it. I'll give that a try now. Thanks.

zbook · Feb 2, 2026

@HerefordBull

How to Clear Your Computer's CMOS to Reset BIOS Settings

If something has gone wrong, your computer won't POST, and you're at wits end --- don't worry. You can always reset everything back to factory defaults.

www.howtogeek.com

3 Ways to Reset Your BIOS - wikiHow:

How to Reset the BIOS on a Windows PC: 3 Easy Methods

Learn to reset your BIOS from within Windows or by accessing the motherboardIf you want to switch back to your original BIOS version after a bad update, it's easy to reset your PC's BIOS. This procedure can also be helpful if you need to...

www.wikihow.com

3 Easy Ways to Clear CMOS (Reset BIOS)

3 Easy Ways to Clear CMOS (Reset BIOS)

Here are three ways to clear the CMOS memory on your motherboard. Clearing CMOS will reset the BIOS settings to their factory default levels.

www.lifewire.com

HP Notebook PCs - Recovering the BIOS (Basic Input Output System) | HP® Customer Support

The BIOS is the first software to run after turning on the computer. If the BIOS on your computer becomes corrupted, the computer fails to boot to Windows.

support.hp.com

BIOS recovery options for PCs with HP Sure Start

HerefordBull · Feb 2, 2026

Well I did the 30 minutes short circuit for the CMOS and used the CMOS reset button. That did yield a result of sorts but I was too slow to take a photo of the message, it was something along the lines of 'time error... factory default settings applied' so that seemed to work as far as a CMOS reset, unfortunately it didn't actually change the PC's behaviour.

Tried the F10 and also the esc buttons but nothing doing there.
Tried the recovery drive, same result.

Next used the BIOS flash drive and the key combination, that yielded the same result as yesterday. A message that I did capture:
'HP sure start detected an unauthorised change to the secure boot keys.
The keys were restored automatically and there is no further action required.
The repeated occurence of this problem indicates a security problem that should not be ignored'

End result of this is that when I switch on the PC it now starts as before but instead of showing the HP logo before shutting down it goes to the HP Sure Start Recovery screen with the above message displayed. When I click 'OK' it goes to the HP logo screen with the message @entering set up menu' displayed in the bottom left corner then shuts down.

Think it's safe to say that it is bricked.

Many thanks to all who responded and tried to help.

suatcini54 · Feb 2, 2026

@HerefordBull

This is from Microsoft

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

If you have HP Sure Start, you cannot change or add new certificates because Sure Start does not let you do it. There is a BIOS setting that protects certificates. You can disable this setting and than try to install new certificates but neither Microsoft nor HP recommends it.

If your HP PC is 2018 model year or later, HP will release BIOS updates. You should wait for it.

Hope this helps.

suatcini54 · Feb 2, 2026

For those having HP Sure Start technology, the following screenshot is taken from

https://support.hp.com/my-en/document/ish_13070353-13070429-16

HerefordBull · Feb 2, 2026

suatcini54 said:
@HerefordBull

This is from Microsoft

View attachment 161942

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

If you have HP Sure Start, you cannot change or add new certificates because Sure Start does not let you do it. There is a BIOS setting that protects certificates. You can disable this setting and than try to install new certificates but neither Microsoft nor HP recommends it.

If your HP PC is 2018 model year or later, HP will release BIOS updates. You should wait for it.

Hope this helps.

Thanks. My PC is up to date with Microsoft updates and the BIOS I used for the repair drive from HP is dated December 2025. As for firmware updates, I have no way of entering the BIOS or any setting/recovery as previously explained. I really don't see how I can repair this mobo.

Edit: Seems I might not have updated the firmware from HP when updating Windows. My bad.

suatcini54 · Feb 2, 2026

Did you try this CMOS reset ?

HP Notebook PCs - Recovering the BIOS (Basic Input Output System) | HP® Customer Support

The BIOS is the first software to run after turning on the computer. If the BIOS on your computer becomes corrupted, the computer fails to boot to Windows.

support.hp.com

HerefordBull · Feb 2, 2026

suatcini54 said:
Did you try this CMOS reset ?

HP Notebook PCs - Recovering the BIOS (Basic Input Output System) | HP® Customer Support

The BIOS is the first software to run after turning on the computer. If the BIOS on your computer becomes corrupted, the computer fails to boot to Windows.

support.hp.com

I used the desktop procedure with the 'b' key. The results of which I posted earlier. Also tried it with the 'v' key but nothing happens at all.

HerefordBull · Feb 2, 2026

Carried out the PWSD jumper reset and that gave me a new message:

The HP Endpoint Security Controller settings have been recovered to their default state

But alas, it's still in perpetual boot

JLArranz · Feb 2, 2026

@HerefordBull

Have you tried detaching the disk? I'd try w/o disk at all (not bootable USB either) and if you succeed entering the BIOS and maybe correcting anything that you could see wrong (or even if you don't see anything), my following test would be with a Windows 10 install USB (if you know that was the OS, else 11), and if it boots I'd use a spare disk (even an old slow HDD you might have or borrow, preferably empty) and install the OS there as a proof.

My theory: on purpose or in error, the BIOS might be detecting a Secure Boot violation in your Windows disk and acting too expeditiously (when trying pendrives in my Secure Boot adventure, the most serious "reaction" I got was a red message and shut down on its own after some seconds, but every system's different), or either your Windows is trying something something incorrect/not allowed/etc with the UEFI BIOS,... even a disk hw failure would be covered by this proof.

In general, your Windows is/may be in the middle of an update that also involves changes to the motherboard's Secure Boot, and your mobo seems reset to factory defaults what Windows may not be expecting.

gunrunnerjohn · Feb 2, 2026

HerefordBull said:
Have to admit I've never heard of shorting the terminals, I just drained the power and took the battery out for 5-10 minutes then replaced it. I'll give that a try now. Thanks.

I know some motherboards in the past would hold up the chip for quite a while just on the stored charge after disconnecting, and shorting the battery contacts was recommended. It's been years since I've had to reset my BIOS, so I don't know if that advice still holds. OTOH, shorting the terminals can't possibly hurt with the battery out and the system disconnected from any power, so it safe to do.

parttimewindows · Feb 2, 2026

garlin said:
For the last two months, I've been working on new PowerShell scripts to automate the Secure Boot CA 2023 update process.

Thank you for creating this tool!

I'm trying to migrate to CA 2023 on an "ancient" Dell Latitude 3380, but I get this error when running the update script:

Code:

Downloading "KEKUpdate_Dell_PK4.bin" from GitHub.
ERROR: Failed to append "KEKUpdate_Dell_PK4.bin" to UEFI KEK.
Unexpected Result, status error: 0xC000000D

This is the output of the check script:

Code:

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows PCA 2010

EFI Files
---------
    Disk 0: Windows Boot Manager [Production PCA 2011] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 1
        [Windows UEFI CA 2023] in UEFI DB.

    Disk 0: SkuSiPolicy.p7b (for VBS) is NOT PRESENT.


REQUIRED ACTION
===============

Run the command:
    Update_UEFI-CA2023.ps1 -Revoke

Finish the UEFI steps to manually add the [KEK CA 2023] cert, if the script provided instructions.

What should be my next action?

(I don't dare to revoke 2011 until the 2023 KEK is in)

EDIT: The laptop still booted Windows 11 once or twice with Secure Boot on, but after I experimented with the BIOS settings (enabled & disabled Custom Mode in Expert Key Management under Secure Boot settings) it refuses that because of a Secure Boot validation failure loading bootmgfw.efi (Windows still boots with Secure Boot off and Ubuntu still boots with Secure Mode on). It looks like some 2023 certificates disappeared?

parttimewindows · Feb 2, 2026

PS: Maybe the fact that I'm using rEFInd to boot either Windows 11 or Ubuntu complicates things?

garlin · Feb 2, 2026

parttimewindows said:
PS: Maybe the fact that I'm using rEFInd to boot either Windows 11 or Ubuntu complicates things?

Maybe. The script assumes you're in a Windows-only environment. Not that it's unfriendly to Linux, but it only does things from a Windows perspective.

parttimewindows said:

The update script has determined your Dell's current Platform Key (PK) is supported by MS, because they submitted a signed KEK to the GitHub. But there's an unexpected error when trying to append the KEK CA 2023.

Since you're playing around with Linux, I presume you know if this Dell BIOS supports manual UEFI key enrollment. If that's possible, you can try copying the KEK CA 2023 cert manually to the EFI partition, and enrolling it thru the UEFI menu. Let me know if your UEFI supports it.

parttimewindows · Feb 2, 2026

garlin said:
Let me know if your UEFI supports it.

Yes, I think that’s what Expert Key Management in Custom Mode is about.

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer

New member

My Computer

Well-known member

My Computer

New member

My Computer

Well-known member

My Computers

New member

My Computer

Well-known member

My Computer

New member

My Computer

Well-known member

My Computers

Well-known member

My Computers

New member

My Computer

Well-known member

My Computers

New member

My Computer

New member

My Computer

Active member

My Computer

Well-known member

My Computers

Active member

My Computer

Active member

My Computer

Well-known member

My Computer

Active member

My Computer