Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

garlin · Feb 15, 2026

The script tried to append the signed KEK .bin file and failed. So the .der file is an equivalent option that should always work. “Should”.

barreleye · Feb 15, 2026

garlin said:
Yes it would suck. But look at it from at ASUS's perspective:

1. To provide you a new firmware with built-in CA 2023 certs requires them to do the KEK signing process. But releasing a new firmware is a can of worms. People are going to complain well if you bothered to release new code, why didn't you fix known [XYZ] BIOS bug that's been there for years.

2. Providing just the signed KEK to MS is the lesser of two evils for the OEM. Functionally it gets the Secure Boot process done without having the risk of releasing a whole new BIOS. And the QA effort in testing the BIOS, if they're not going to fake testing.

If they have too many old BIOS'es right on the edge of support, only signing the KEK allows them to keep more models going.

What happens if Microsoft has updated the certs on your machine, and a new BIOS is flashed that just has the old certs? If indeed "it would suck", I take it to mean the new BIOS would overwrite the new certs, putting you back where you started. Will Windows reapply the new certs when booted, or does it happen sometime later at the whim of Windows Update?

parttimewindows · Feb 15, 2026

So this is what I did on the Medion PC:

Reset the PK to factory default (MEDION certificate)
Reset the KEK to factory default (Microsoft Corporation KEK CA 2011)
Append the MEDION signed KEK (post-signed, MEDION folder, file KEKUpdate_PK2.bin, Microsoft Corporation KEK 2K CA 2023)

This is the verbose output of your check script:

Code:

Windows 11 25H2 (26200.7840)

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
    MEDION MD34060/2523
    Version: 370H4W0X.112
    Date: 2019-02-15

Factory Default UEFI PK Cert
----------------------------
    MEDION Certificate

UEFI PK Cert
------------
    MEDION Certificate

Factory Default UEFI KEK Certs
------------------------------
    Microsoft Corporation KEK CA 2011

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
    (NONE)
    EFI_CERT_SHA256_GUID Signatures: 77

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 7.0
    EFI_CERT_SHA256_GUID Signatures: 489

EFI Files
---------
    Disk 1: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        bootmgfw.efi File version: 26100.30227

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    Disk 1: SkuSiPolicy.p7b (for VBS) is CURRENT.

STATUS REPORT
-------------
    Registry: UEFICA2023Status = Updated

SUCCESS: NO UPDATES ARE REQUIRED.

Did I fix my previous mistake correctly like this?

(Windows boots with Secure Mode enabled, but it also did when I had the wrong PK...)

Or did I made a new stupid mistake? (Wouldn't be suprised if I did...

)

gunrunnerjohn · Feb 15, 2026

barreleye said:
What happens if Microsoft has updated the certs on your machine, and a new BIOS is flashed that just has the old certs? If indeed "it would suck", I take it to mean the new BIOS would overwrite the new certs, putting you back where you started. Will Windows reapply the new certs when booted, or does it happen sometime later at the whim of Windows Update?

My understand is a BIOS update doesn't overwrite the current certs, only the "BIOS" default certs. I've updated the BIOS on several machines here and my active keys didn't change or get erased.

garlin · Feb 15, 2026

barreleye said:
What happens if Microsoft has updated the certs on your machine, and a new BIOS is flashed that just has the old certs? If indeed "it would suck", I take it to mean the new BIOS would overwrite the new certs, putting you back where you started. Will Windows reapply the new certs when booted, or does it happen sometime later at the whim of Windows Update?

MS has a supposed "recovery" method for this scenario, but it's rather lame.
They copy a securebootrecovery.efi which can be renamed to bootfwmgr.efi, and it will temporarily allow booting.

The dirt simple method is to disable Secure Boot. Restart Windows and presumably once we're in the mandatory update stage, the Secure Boot scheduled task will detect it's got work to do and re-apply the missing certs. Now if the scheduled task couldn't handle this job before, it can't restore the full certs in the future.

For those users, you'll have to repeat what you did before to get the PC updated.

Does this suck? Sure. But presumably the number of catastrophic events where all your current certs are lost will be rare.

garlin · Feb 15, 2026

parttimewindows said:
SUCCESS: NO UPDATES ARE REQUIRED.

You guys really don't like believing when the script reports "SUCCESS". You're done.

garlin · Feb 15, 2026

gunrunnerjohn said:
My understand is a BIOS update doesn't overwrite the current certs, only the "BIOS" default certs. I've updated the BIOS on several machines here and my active keys didn't change or get erased.

The problem is with some BIOS updates, something weird happens and users report it ends up reset the NVRAM (losing all the settings). This would include the current certs in the UEFI.

That shouldn't happen, but you can find people complaining about. Not about Secure Boot, but losing BIOS settings after a flash. You can't rule it out. And MS is aware of the problem, and even wrote a note about it in their Secure Boot docs.

parttimewindows · Feb 15, 2026

garlin said:
You guys really don't like believing when the script reports "SUCCESS". You're done.

I had that message before, but you then still pointed out a mistake I made...

garlin · Feb 15, 2026

parttimewindows said:
I had that message before, but you then still pointed out a mistake I made...

OK. I will file the @parttimewindows bug, check if user can't read and manually applies the wrong cert to PK.

leo_bell · Feb 15, 2026

Hello, I used your method to find the keys and updated Windows to 26200.7840, and everything is fine. I decided to reinstall the system from a fresh image using the Media Creation Tool. I did a security erase on the SSD, but the Windows flash drive won't boot and keeps booting me back to the BIOS. I have a backup of the previous Windows 11 system (26200.7623), but after restoring it, the system won't boot. I restored an even older backup from Windows 10 - it still won't boot and keeps booting me back to the BIOS window. I disabled security boot, and Windows 10 booted, and I'm writing from it now. What should I do to restore security boot and avoid bricking the motherboard? (MSI B450M PRO-VDH MAX motherboard, latest BIOS 7A38vBP1 (Beta version), 2025-09-23)

This is Windows 10 with security boot disabled, which I'm writing from now

Code:

Secure Boot: OFF
Virtualization Based Security: OFF
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    (NONE)

EFI Files
---------
    Disk 0: Windows Boot Manager [Production PCA 2011] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 1
        [Windows UEFI CA 2023] in UEFI DB.


REQUIRED ACTION
===============

OPTION 1:  DO NOTHING.  Windows will apply the UEFI updates in 2026 (supported BIOS).

OPTION 2:  To install Windows Boot Manager [UEFI CA 2023], run the commands:

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x100 /f
    powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

OPTION 3:  To install [UEFI CA 2023] certs and REVOKE the [PCA 2011] cert, run the commands:

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x282 /f
    powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

garlin · Feb 15, 2026

This PC has both sets of certs, and none are banned so you should be able to boot any Windows USB.

Can you run the script, but add "-Verbose -Audit" on the command line?

gunrunnerjohn · Feb 15, 2026

garlin said:
The problem is with some BIOS updates, something weird happens and users report it ends up reset the NVRAM (losing all the settings). This would include the current certs in the UEFI.

That shouldn't happen, but you can find people complaining about. Not about Secure Boot, but losing BIOS settings after a flash. You can't rule it out. And MS is aware of the problem, and even wrote a note about it in their Secure Boot docs.

Makes sense, I haven't seen that yet, but I've only personally done about eight machines, most of them fairly current.

leo_bell · Feb 15, 2026

garlin said:
This PC has both sets of certs, and none are banned so you should be able to boot any Windows USB.

Can you run the script, but add "-Verbose -Audit" on the command line?

Code:

PS C:\Windows\system32> E:\temp\Check_UEFI-CA2023.ps1 -Verbose -Audit

Windows 10 21H2 (19044.5965)



Secure Boot: OFF (Audit Report runs as ON)

Virtualization Based Security: OFF

BitLocker on (C:) OFF



BIOS Firmware

-------------

    Micro-Star International Co. MS-7A38

    Version: B.P1

    Date: 2025-09-12



Factory Default UEFI PK Cert

----------------------------

    MSI SHIP PK



UEFI PK Cert

------------

    MSI SHIP PK



Factory Default UEFI KEK Certs

------------------------------

    Microsoft Corporation KEK CA 2011

    Microsoft Corporation KEK 2K CA 2023

    MSI SHIP KEK



UEFI KEK Certs

--------------

    Microsoft Corporation KEK CA 2011

    Microsoft Corporation KEK 2K CA 2023

    MSI SHIP KEK



Factory Default UEFI DB Certs

-----------------------------

    Microsoft Corporation UEFI CA 2011

    Microsoft Windows Production PCA 2011

    Microsoft Option ROM UEFI CA 2023

    Microsoft UEFI CA 2023

    Windows UEFI CA 2023

    MSI SHIP DB



UEFI DB Certs

-------------

    Microsoft Corporation UEFI CA 2011

    Microsoft Windows Production PCA 2011

    Microsoft Option ROM UEFI CA 2023

    Microsoft UEFI CA 2023

    Windows UEFI CA 2023

    MSI SHIP DB



Factory Default UEFI DBX Certs

------------------------------

    (NONE)

    EFI_CERT_SHA256_GUID Signatures: 416



UEFI DBX Certs

--------------

    (NONE)

    Windows BootMgr SVN is MISSING.

    EFI_CERT_SHA256_GUID Signatures: 416



EFI Files

---------

    Disk 0: Windows Boot Manager [Production PCA 2011] will be ALLOWED.

        bootmgfw.efi File version: 19041.4648



    Registry: WindowsUEFICA2023Capable = 1

        [Windows UEFI CA 2023] in UEFI DB.





AUDIT REPORT

============

1.  Update W10 21H2 to KB5066791 (Oct 2025) or later

2.  Secure Boot is DISABLED

3.  [Production PCA 2011] is missing from UEFI DBX

4.  DBX Updates are missing from UEFI DBX

5.  Windows BootMgr SVN is missing from UEFI DBX

6.  Windows Boot Manager [Production PCA 2011] is wrong version





REQUIRED ACTION

===============



OPTION 1:  DO NOTHING.  Windows will apply the UEFI updates in 2026 (supported BIOS).



OPTION 2:  To install Windows Boot Manager [UEFI CA 2023], run the commands:



    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x100 /f

    powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"



OPTION 3:  To install [UEFI CA 2023] certs and REVOKE the [PCA 2011] cert, run the commands:



    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x282 /f

    powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

I went back into the BIOS and enabled Secure Boot, and a window appeared asking me to reset to defaults. I agreed. Now I can boot with Secure Boot enabled and also boot with the 26200.7840 installation image.
I'm about to install the latest Windows 11. Sorry for the false alarm.

PS C:\Windows\system32> E:\temp\Check_UEFI-CA2023.ps1
Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
(NONE)

EFI Files
---------
Disk 0: Windows Boot Manager [Production PCA 2011] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 1
[Windows UEFI CA 2023] in UEFI DB.

REQUIRED ACTION
===============

OPTION 1: DO NOTHING. Windows will apply the UEFI updates in 2026 (supported BIOS).

OPTION 2: To install Windows Boot Manager [UEFI CA 2023], run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x100 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

OPTION 3: To install [UEFI CA 2023] certs and REVOKE the [PCA 2011] cert, run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x282 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

DarkShadowMD · Feb 15, 2026

christantoan said:
During normal boot when I just press the power button, no, I don't get any video. But it still responsive to Ctrl Alt Del reboot command.

If I hold Ctrl Home then press the power button, I get logo but then it boots directly to Easy Flash.

Seems like the reflash process went wrong somehow then... Good news, not a hardware issues, bad news: the reflash route didn't work...
I'd suggest checking your process to reflash your bios, and also removing the battery to clear the CMOS completely.

DarkShadowMD · Feb 15, 2026

For people having problems reinstalling windows or older images... remember that we are signing the boot files with new certificates, older backups will have problems if you try to restore from them. You will need to update your bootable media to reinstall Windows if you want the OS to reinstall without problems.

Honestly, I would discard older backups, unless you absolutely need something inside them, and make new ones with the new certs, or if you feel you will need to restore an old image of Windows or install any version prior to October 2025, DO NOT revoke the 2011 certificate, otherwise, your systems won't be able to boot unless you turn off Secure Boot and run the script to sign the boot files with the new certs.

garlin · Feb 15, 2026

You don't need to discard older backups, or old recovery media. You can always disable Secure Boot before recovering the backup.
Without Secure Boot, UEFI doesn't enforce the cert check.

1. Disable Secure Boot.
2. Boot into the restored image (or boot from the recovery media). The only thing wrong with your old image is the CA 2011 version of the boot file.
3. Download and re-run the update script, and it will install the newer CA 2023 boot file for you.
4. Shutdown, and re-enable Secure Boot.

If you have Virtualization Based Security (VBS) enabled, and the script copied a current SkuSiPolicy.p7b file, you will need an extra step.

Boot from a recovery media or WinPE, and manually delete the SkuSiPolicy.p7b file from EFI. Then you can boot from the old image or recovery drive.

Code:

mountvol S: /s
del S:\EFI\Microsoft\Boot\SkuSiPolicy.p7b

DarkShadowMD · Feb 16, 2026

Another bit of useful info, thanks mate!
The SkuPolicy part, is done after enabling secure boot? Right after you have reinstalled all your CA 2023 certs?

nikki605 · Feb 16, 2026

FerchogtX said:
Honestly, I would discard older backups, unless you absolutely need something inside them, and make new ones with the new certs, or if you feel you will need to restore an old image of Windows or install any version prior to October 2025, DO NOT revoke the 2011 certificate, otherwise, your systems won't be able to boot unless you turn off Secure Boot and run the script to sign the boot files with the new certs.

That's exactly what I did. I had no reason to keep images from 4 months ago. I usually keep the most recent 3.

jak22 · Feb 16, 2026

Although my AM5 B850 system is showing event 1808, I noted my AM4 B550 PC is just showing 1801. I understand updating is an ongoing process, and haven't looked further than the event or run any scripts etc, but I thought I'd ask a few questions-

I don't often update mb BIOS but did last September to get an update that added TPM-B FW as well various other fixes - but it made no mention of whether it includes new SB certs.

A Gigabyte AM4 board defaults to SB Not Active after a BIOS update. The method to get SB to show as Active is to select Custom and then either a) restore factory keys and stay in Custom or b) switch back to Standard which also loads defaults

1) there's a post above about whether a BIOS update overwrites keys - even if it doesn't those steps to change SB to Active would seem to overwrite them with those from the BIOS - what happens then?

2) I chose method b) so I'm not in Custom any more - is there any chance this is preventing Windows from installing the certs - i.e is there some some of read-only state?

3) over time there are many BIOS versions - including interim 'beta' releases - so each user might end up with a different one - is the exact BIOS version used by the telemetry in deciding whether Windows will go ahead with the update?

garlin · Feb 16, 2026

nikki605 said:
That's exactly what I did. I had no reason to keep images from 4 months ago. I usually keep the most recent 3.

Some users are not as organized. They only make a backup right after an install or upgrade. The point is there's still a way to use those images, if there's no other alternative.

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

New member

My Computer My Computer

At a glance

Peaceful Citizen

My Computers My Computers

At a glance

At a glance

Peaceful Citizen

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Peaceful Citizen

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer

My Computers

My Computers

My Computer

My Computer