Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

DarkShadowMD · Feb 7, 2026

Okay! Imma do this on Monday then! Probably will consult about updating my macrium USB drive as well (created using Macrium Free V8), I'll let you know the result for all my PC's, including mom's, which theoretically shouldn't be a problem because is almost the same specs as my desktop, except it uses an iGPU only X3.

One more question: This is permanent, right? If I reset a BIOS to defaults for some reason, this persists... right?

Thanks a bunch for all the help!

garlin · Feb 7, 2026

FerchogtX said:
Oh BTW... when doing this, is this permanent? Meaning if I reset my BIOS settings for whatever reason on any PC, will the Certs still be installed in there?

Typically a reset of normal BIOS settings won't clear the certs. If it does, then you get the factory default ones.

Which is why it's important to have the latest BIOS firmware, because it's more likely the newer certs are included in the factory list. If installing an updated BIOS magically adds the missing CA 2023 certs, then it will always be there on a reset. The only other to clear them is to perform Setup Mode, which means you clear them to allow a custom set of certs.

DarkShadowMD · Feb 7, 2026

garlin said:
Typically a reset of normal BIOS settings won't clear the certs. If it does, then you get the factory default ones.

Which is why it's important to have the latest BIOS firmware, because it's more likely the newer certs are included in the factory list. If installing an updated BIOS magically adds the missing CA 2023 certs, then it will always be there on a reset. The only other to clear them is to perform Setup Mode, which means you clear them to allow a custom set of certs.

Ah, fantastic! How about my Desktop? Didn't have a BIOS Update, but had the same successful results you saw earlier. Means it already had the certs available?

garlin · Feb 7, 2026

FerchogtX said:
You... think there could be another way to complete this without having to run updates? Sadly this can vary from system to system and would be a kick in the b*lls if any of my PC's ran into issues because an update broke something, or they have boot or shutdown issues -_-;

Oh also, I'm not looking into revoking certs just yet, maybe when I'm closer to June... is that fine or I absolutely need to?

The requirement for the Windows Update check is MS will sometimes update the Secure Boot files.

The major changes started back in April and June 2024, rolling out the SecureBootUpdates folder. But MS has revised some of the file versions (DBXUpdate.bin, DBXUpdate SVN and SkuSiPolicy) with minor added entries.

- July 2025 was the next major checkpoint with the DBXUpdate.bin getting one extra exclusion for a 3rd-party EFI shim (intermediate boot loader).

- October 2025 pushed a newer SkuSiPolicy file.

Are these recent changes really that important? Not so much to getting CA 2023 enabled, but like having the most recent Defender signatures for blocking new malware, it's better to have the later versions of both files.

Here's a version of the update script which removes the Windows build checking. If you do eventually update Windows, then please re-run the normal update script to make sure you have the latest DBX files.

The update script is smart, it doesn't "assume" anything. It checks what's in your UEFI and will detect if the local Secure Boot files (updated by Windows Update) are newer than what's currently installed. If there's no difference, then it will inform that no changes are required.

garlin · Feb 7, 2026

FerchogtX said:
Ah, fantastic! How about my Desktop? Didn't have a BIOS Update, but had the same successful results you saw earlier. Means it already had the certs available?

Because CA 2023 deployment is still optional (right now), the only ways to get the full set of certs:

1. Your last BIOS update included them in the factory defaults. This is MS's preferred outcome from the OEM's.
2. You ran some update script, or followed the Windows update process.
3. You ran Mosby.

The SkuSiPolicy file is copied to the EFI partition, so it's outside of the UEFI. Technically you can copy it by hand, by the update script has the -SkuSiPolicy option to perform the copy for you. It's only needed if VBS is enabled to improve its security.

DarkShadowMD · Feb 7, 2026

garlin said:
Because CA 2023 deployment is still optional (right now), the only ways to get the full set of certs:

1. Your last BIOS update included them in the factory defaults. This is MS's preferred outcome from the OEM's.
2. You ran some update script, or followed the Windows update process.
3. You ran Mosby.

The SkuSiPolicy file is copied to the EFI partition, so it's outside of the UEFI. Technically you can copy it by hand, by the update script has the -SkuSiPolicy option to perform the copy for you. It's only needed if VBS is enabled to improve its security.

Ahhh Okay, seems I went the #2 route using your scripts... which means my desktop won't clear the certs... I hope lol, I remember you told me my MoBo was in some sort of support list, which supports this theory?

garlin said:
The requirement for the Windows Update check is MS will sometimes update the Secure Boot files.

The major changes started back in April and June 2024, rolling out the SecureBootUpdates folder. But MS has revised some of the file versions (DBXUpdate.bin, DBXUpdate SVN and SkuSiPolicy) with minor added entries.

- July 2025 was the next major checkpoint with the DBXUpdate.bin getting one extra exclusion for a 3rd-party EFI shim (intermediate boot loader).
- October 2025 pushed a newer SkuSiPolicy file.

Are these recent changes really that important? Not so much to getting CA 2023 enabled, but like having the most recent Defender signatures for blocking new malware, it's better to have the later versions of both files.

Here's a version of the update script which removes the Windows build checking. If you do eventually update Windows, then please re-run the normal update script to make sure you have the latest DBX files.

The update script is smart, it doesn't "assume" anything. It checks what's in your UEFI and will detect if the local Secure Boot files (updated by Windows Update) are newer than what's currently installed. If there's no difference, then it will inform that no changes are required.

Saved! I'll run it on Monday! Thanks a ton mate!

garlin · Feb 7, 2026

FerchogtX said:
Ahhh Okay, seems I went the #2 route using your scripts... which means my desktop won't clear the certs... I hope lol, I remember you told me my MoBo was in some sort of support list, which supports this theory?

The check script's output for your desktop listed "OPTION 1: (DO NOTHING)". This means your PK is fully supported, and either Windows or the update script can finish without any problems.

MS maintains a list of OEM-provided KEK files on GitHub, and the script can confirm if your PK is registered or not.

DarkShadowMD · Feb 7, 2026

garlin said:
The check script's output for your desktop listed "OPTION 1: (DO NOTHING)". This means your PK is fully supported, and either Windows or the update script can finish without any problems.

MS maintains a list of OEM-provided KEK files on GitHub, and the script can confirm if your PK is registered or not.

Sorry if I sound stupid lol... this means the MoBo already had the certs?

garlin · Feb 7, 2026

Or it's on the supported PK list.

DarkShadowMD · Feb 7, 2026

garlin said:
Or it's on the supported PK list.

Either way... means I just can't accidentally erase them if I just perform a reset bios settings, or for example shorting two pins for emergencies?

garlin · Feb 7, 2026

You're stressing out too much. If your current BIOS firmware has the CA 2023 certs built-in, then a reset will copy the certs back. You will need to run the update script to pull the latest DBX revocations since those are not fixed (unlike the CA 2023 certs). Otherwise if you don't have factory CA 2023 certs built-in, you temporarily disable Secure Boot in BIOS, boot Windows normally, and then re-run the update script. Then re-enable Secure Boot mode.

Some of the other folks out there have more to worry about, because they have unsupported BIOS'es on old PC's.

DarkShadowMD · Feb 7, 2026

I guess you are right X3
Thank you so much mate, I'll return with results on Monday!

parttimewindows · Feb 8, 2026

garlin said:
Here's the one to run.

And here's the output:

Code:

Subject      : CN=Dell Inc. Platform Key, O=Dell Inc., L=Round Rock, S=Texas, C=US
Issuer       : CN=Dell Inc. Platform Key, O=Dell Inc., L=Round Rock, S=Texas, C=US
Thumbprint   : 44D641CACA0809002398B4877B8E982ED26F7B76
FriendlyName :
NotBefore    : 6/1/2016 10:20:07 PM
NotAfter     : 6/1/2031 10:30:06 PM
Extensions   : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid}

garlin · Feb 8, 2026

This is a supported PK, according to the KEK list on GitHub:

Code:

    "44d641caca0809002398b4877b8e982ed26f7b76": {
        "KEKUpdate": "Dell/KEKUpdate_Dell_PK4.bin",
        "Certificate": {
            "serial_number": "50a1bd858ae7b6bc402dca78cdd268a1",
            "issued_to": "CN=Dell Inc. Platform Key,O=Dell Inc.,L=Round Rock,ST=Texas,C=US",
            "issued_by": "CN=Dell Inc. Platform Key,O=Dell Inc.,L=Round Rock,ST=Texas,C=US"
        }
    },

Unless your UEFI variables are corrupted, it should allow Windows or my update script to append CA 2023 certs. If you're having problems, I would try a factory reset of the UEFI certs first, or put it into Setup Mode (no certs). My script will handle both scenarios.

The GitHub issues for Mosby note that some AMI BIOS variants have a bug where appending to the KEK throws an error. It might be bypassed by using Setup Mode, since the script installs a DefaultKEK.bin which includes both KEK CA 2011 & KEK CA 2023 (thus no appending is needed).

parttimewindows · Feb 8, 2026

garlin said:
I would try a factory reset of the UEFI certs first, or put it into Setup Mode (no certs)

The reset did not change anything, but after manually deleting all four certs using Expert Management in Custom Mode, I did no longer get an error at the first Update_UEFI-CA2023.ps1 run, but Windows is now using a different PK?

Code:

Subject      : CN=Windows OEM Devices PK, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Issuer       : CN=Microsoft RSA Third Party PCA 2023, O=Microsoft Corporation, C=US
Thumbprint   : 3D8660C0CB2D57B189C3D7995572A552F75E48B5
FriendlyName :
NotBefore    : 9/21/2023 10:28:26 PM
NotAfter     : 9/18/2038 10:28:26 PM
Extensions   : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid,
               System.Security.Cryptography.Oid...}

Also, the script referred me to a README_UEFI.TXT which told me to manually import "Windows OEM Devices PK" and "KEK 2K CA 2023" into the BIOS, but I got the same error as before about signatures/format...

I ran the Update script a few more times (since the -Audit option gave different instructions every run) and finally ended up with this Check_UEFI-CA2023.ps1 output:

Code:

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 7.0

EFI Files
---------
    Disk 0: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    Disk 0: SkuSiPolicy.p7b (for VBS) is CURRENT.

STATUS REPORT
-------------
    Registry: UEFICA2023Status = Updated

SUCCESS: NO UPDATES ARE REQUIRED.

Does this actually mean I'm good now? Or should the 2011 parts have been removed instead of blacklisted?

parttimewindows · Feb 8, 2026

Below the verbose output. There's probably no hint there why I can't get it to work with Dell's default PK?

Code:

Windows 11 25H2 (26200.7705)

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
    Dell Inc. Latitude 3380
    Version: 1.28.0
    Date: 2024-07-05

Factory Default UEFI PK Cert
----------------------------
    Dell Inc. Platform Key

UEFI PK Cert
------------
    Windows OEM Devices PK

Factory Default UEFI KEK Certs
------------------------------
    Microsoft Corporation KEK CA 2011
    Dell Inc. Key Exchange Key

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Dell Inc. UEFI DB

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
    Microsoft Windows PCA 2010
    EFI_CERT_SHA256_GUID Signatures: 77

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 7.0
    EFI_CERT_SHA256_GUID Signatures: 437

EFI Files
---------
    Disk 0: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        bootmgfw.efi File version: 26100.30227

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    Disk 0: SkuSiPolicy.p7b (for VBS) is CURRENT.

STATUS REPORT
-------------
    Registry: UEFICA2023Status = Updated

SUCCESS: NO UPDATES ARE REQUIRED.

parttimewindows · Feb 8, 2026

And maybe not import for this forum, but the rEFInd boot manager and Ubuntu both still boot after these changes

antspants · Feb 8, 2026

parttimewindows said:
Or should the 2011 parts have been removed instead of blacklisted?

Nope

DarkShadowMD · Feb 9, 2026

Hey!

Today I ran the script to update the VBS thing. All good. The only thing I'm skipping is revoking the 2011 certs at least until May I guess, I dunno if it's recommended to do it earlier or just wait... But at least all is updated as it should.

Now begins my quest to add the certs to the BIOS of both my desktop PCs... because they don't seem to have them by default (please forgive me, for I betrayed you using another script to check if the BIOS has them by default). Fortunately the F.09 BIOS for my HP has them, so doing a reset is not an issue... but not for my desktop PCs lol...

Wish me luck, I'll contact MSI and check if they ever released updates that include the certs... they have been updating BIOSes, but as usual, they never state exactly what they update, unless is something like fixing Sinkclose vulneravilities or fixing TPM issues...

Thanks a ton @garlin & @antspants for all your support and help!!!! I'll keep you updated guys!

andyc56 · Feb 9, 2026

FerchogtX said:
Fortunately the F.09 BIOS for my HP has them, so doing a reset is not an issue... but not for my desktop PCs lol...

Wish me luck, I'll contact MSI and check if they ever released updates that include the certs... they have been updating BIOSes, but as usual, they never state exactly what they update...

My desktop machine has an MSI B450M Bazooka motherboard, and the latest BIOS update (dated 2025-09-23) came with the 2023 certs.

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Peaceful Citizen

My Computers

Well-known member

My Computer

Peaceful Citizen

My Computers

Well-known member

Attachments

My Computer

Well-known member

My Computer

Peaceful Citizen

My Computers

Well-known member

My Computer

Peaceful Citizen

My Computers

Well-known member

My Computer

Peaceful Citizen

My Computers

Well-known member

My Computer

Peaceful Citizen

My Computers

Active member

My Computer

Well-known member

My Computer

Active member

My Computer

Active member

My Computer

Active member

My Computer

Like a rolling drone.

My Computers

Peaceful Citizen

My Computers

Well-known member

My Computer