Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Anibor_11 said:

Same question, I think - why does the Microsoft Corporation UEFI CA 2011 cert is not revoked?

Click to expand...

We don't revoke the Microsoft UEFI CA 2011 because that cert is reserved for booting Linux. Windows PCA 2011 covers Windows releases.

The cert names may be confusing. Microsoft owns the UEFI CA 2011 cert, because MS provided it on behalf of Linux distros since no OEM is going to bundle every distro's unique signing certs in the BIOS. So they share a generic one to get past the UEFI security check.

Any cert that includes the word "Windows" manages Windows boot files.

I'm avoiding anything that would impact a Linux setup. Most Linuxes use the SBAT file on the EFI partition as their equivalent method of banning outdated boot files.

nikki605 said:

I run Lenovo System Update regularly and BIOS version FBKTE0AUS is the most recent.

Click to expand...

Lenovo installed your BIOS on Feb. 2022, but this firmare was released in early Jan 2022 (and factory signed as late Dec 2021).

That makes perfect sense to me. If you've ever worked in a large company, the handoff between different groups takes a little while to process.

Akeo said:

There's no way it shouldn't work if we have the same BIOS. Can you please create an issue in pbatard/Mosby and post your full Mosby.log there (you'll find the Mosby.log at the root of the USB).

Again, I extensively tested Mosby on that machine (and I am positive I have the exact same T460 model as you have), so there has to be an explanation as to why you can't seem to get the same results as I do. The log should explain it.

Click to expand...

I have no doubt your fix worked, it's just my device is being a pain. Here's the log of my two attempts:

Dirtyflash said:

I have no doubt your fix worked, it's just my device is being a pain. Here's the log of my two attempts:

Lenovo T460 Security Violation · Issue #25 · pbatard/Mosby

[Mosby session started: 2026-02-21 15:09:43 [UTC] UEFI v2.40 (Lenovo, 0x00001450) LENOVO R06ET71W (1.45 ) LENOVO 20FN002JUS Not installing SBAT since this system's SBAT is either the same or newer ...

github.com

Click to expand...

From what I can tell, you are still using an old version of Mosby, since your log entry should have the Mosby version reported (this reporting was added in newer versions precisely so we can tell if someone is not using an up to date Mosby), which entirely explains your issue. Please download and extract Mosby 3.0 again to the root of your USB. You should find that it works a lot better.

Akeo said:

From what I can tell, you are still using an old version of Mosby, since your log entry should have the Mosby version reported (this reporting was added in newer versions precisely so we can tell if someone is not using an up to date Mosby), which entirely explains your issue. Please download and extract Mosby 3.0 again to the root of your USB. You should find that it works a lot better.

Click to expand...

Your wish is my command:

[Mosby session started: 2026-02-21 18:51:34]
Mosby v3.0 x64
UEFI v2.40 (Lenovo, 0x00001450)
LENOVO R06ET71W (1.45 )
LENOVO 20FN002JUS
Reusing existing MosbyKey.crt certificate...
Not installing SBAT since this system's SBAT is either the same or newer
Generating PK certificate...
Installing SSPV: 'SkuSiPolicyVersion [2023.04.29]'
Installing SSPU: 'SkuSiPolicyUpdateSigners [2023.04.29]'
Installing DBX: 'DBX for x86 (64 bit) [2025.10.16]'
Installing DBX: 'Windows Bootmgr SVN 7.0 DBX update [2025-06-06]'
Installing DB: 'Microsoft Windows Production PCA 2011'
Installing DB: 'Microsoft Corporation UEFI CA 2011'
Installing DB: 'Windows UEFI CA 2023'
Installing DB: 'Microsoft UEFI CA 2023'
Installing DB: 'Microsoft Option ROM UEFI CA 2023'
Installing DB: 'MosbyKey [2026.02.21]'
Installing KEK: 'Microsoft Corporation KEK CA 2011'
Installing KEK: 'Microsoft Corporation KEK 2K CA 2023'
Installing PK: 'Mosby Generated PK [2026.02.21]'
[Mosby session ended: 2026-02-21 18:51:44]


You are very talented!


Microsoft Windows [Version 10.0.28000.1641]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\System32>powershell -nop -ep bypass -f C:\Temp\check_uefi-ca2023.ps1 -Verbose
Windows 11 26H1 (28000.1641)

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

BIOS Firmware
-------------
LENOVO 20FN002JUS
Version: R06ET71W (1.45 )
Date: 2022-02-20

Factory Default UEFI PK Cert
----------------------------
TPCDL-KEK

UEFI PK Cert
------------
Mosby Generated PK [2026.02.21]

Factory Default UEFI KEK Certs
------------------------------
Microsoft Corporation KEK CA 2011
TPCDL-KEK

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
ThinkPad Product CA 2012
Lenovo UEFI CA 2014
TPCDL-DB

UEFI DB Certs
-------------
MosbyKey [2026.02.21]
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
(NONE)
EFI_CERT_SHA256_GUID Signatures: 77

UEFI DBX Certs
--------------
(NONE)
Windows BootMgr SVN 7.0
EFI_CERT_SHA256_GUID Signatures: 434

EFI Files
---------
Disk 0: Windows Boot Manager [Production PCA 2011] is ALLOWED.
bootmgfw.efi File version: 27954.300

Registry: WindowsUEFICA2023Capable = 1
[Windows UEFI CA 2023] in UEFI DB.


REQUIRED ACTION
===============

OPTION 1: DO NOTHING. Windows will apply the UEFI updates in 2026 (supported BIOS).

OPTION 2: To install Windows Boot Manager [UEFI CA 2023], run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x100 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

OPTION 3: To install [UEFI CA 2023] certs and REVOKE the [PCA 2011] cert, run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x80 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

There you go. Mosby was successful and your PK was installed without errors.

garlin said:

Here's what I'm thinking about the winload.efi problem:

1. winload.efi lives under \Windows\System32 on WinPE, Windows, and WinRE.

2. It's not part of the EFI partition files.

3. It's not part of \Windows\Boot, or \Windows\System32\SecureBootUpdates files.

4. Secure Boot variables are equally available to WinPE, Windows, and WinRE to read.
If you can boot Windows, why can't WinRE boot? It's the same variables for everyone.

5. Is there another WinRE security policy that blocks WinRE winload.efi?

6. Is this actually not a Secure Boot problem, but some weird BCD issue?

I have seen people complain about failed Windows installs due to winload.efi errors. It takes while, but after some point, Windows reboots itself to continue the installation and then fails. The install was working until the reboot, so it could boot the first time but not the next.

To me, that points to some policy or config setting (BCD?) that changed in between the two boots.

Click to expand...

The only way I found to avoid the 0xc0000428 error in winload.efi is to update the boot-/ installation- media via DISM with the latest cumulative update. This worked for WinRE, PE media (PEbakery) and PXE boot image (Server ess 2016 PXE client restore).

It might be this is SkuSiPolicy related- SkuSiPolicy version information is stored in the NVRAM of the PC if once activated, so it's not just deleting the file again to get rid of it. In 2026 an updated SkuSIPolicy 3.0.0.13 was distributed, WinRE got updated to 6807 for Win10 22H2, so I assume minimal required cumulative update level would be january 2026 for now.

garlin said:

For the last two months, I've been working on new PowerShell scripts to automate the Secure Boot CA 2023 update process.

Click to expand...

This weekend I updated two more laptops (from relatives). Both were Lenovo laptops; one rather recent, with the 2023 files in the BIOS, and a much older one that does not have them (and probably won't ever get a new BIOS). Using your scripts I was able to let them use the 2023 set and revoke the 2011 set. This was the first time for me that I didn't get errors for the KEK and I thus did not have to modify anything in their BIOS

Thanks again for creating these scripts, sharing them and supporting them!

I am glad some people know what is happening lol
my desktop updated itsself this morning with "secure boot allowed signature database" which from running your check script suggests its downloaded the new certs but they arent active until either windows does it or i run the suggested command.
my parents laptop got a different "secure boot kek update" which i presume does something similar

SillyBadger said:

I am glad some people know what is happening lol
my desktop updated itsself this morning with "secure boot allowed signature database" which from running your check script suggests its downloaded the new certs but they arent active until either windows does it or i run the suggested command.
my parents laptop got a different "secure boot kek update" which i presume does something similar

Click to expand...

"Secure Boot KEK Update" means the OEM provided a signed KEK to MS for deployment, via Windows Update. That means the rest of the update process can be handled entirely by Windows, when MS decides it's time.

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
(NONE)
Windows BootMgr SVN 7.0

EFI Files
---------
Disk 1: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

Disk 1: SkuSiPolicy.p7b (for VBS) is NOT PRESENT.


REQUIRED ACTION
===============

To revoke the [PCA 2011] cert, run the commands, run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x80 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

To install SkuSiPolicy.p7b, run the command:
Update_UEFI-CA2023.ps1 -SkuSiPolicy

PS C:\WINDOWS\system32>

I looks like mine is all good except for the SkuSiPolicy.p7b (for VBS) is NOT PRESENT.

Will I face any unforseen downsides to installing this policy?
Will my Macrium bootable usb and images made before this be affected?

peace
wanna

Wannagofast said:

I looks like mine is all good except for the SkuSiPolicy.p7b (for VBS) is NOT PRESENT.

Will I face any unforseen downsides to installing this policy?
Will my Macrium bootable usb and images made before this be affected?

Click to expand...

SkuSiPolicy is recommended whenever VBS is enabled. You should update the Macrium USB with the updated boot file.
Another Macrium Secure Boot Question

If you have a backup image from before the update, you can temporarily disable Secure Boot and restore the image. After getting into Windows, re-run the update script and it will copy the newer boot files into place.

Simple enough. Thanks Garlin.

peace
wanna

Hi Garlin,

Following your advice concerning my PC with an unsupported BIOS, I tried:
"select an uefi file as trusted for executing".
I ran the "Update_UEFI-CA2023.ps1" as administrator.
It downloaded, copied "Ms Corp KEK 2K CA 2023.der" to EFI
Successfully appended "dbupdate2024.bin", "DBUpdate3P2023.bin" and "DBUpdateOROM2023.bin" to UEFI DB
Copying EFI boot files.
Boot files successfully created.

So far so good. In the BIOS. I chose "select an uefi file as trusted for executing", but in the EFI\Certs folder there was no file to select from.
I created a Macrium Reflect image of the EFI partition. There were 2 files inside the Certs folder: "Microsoft Corporation KEK 2K CA 2023.crt", "Microsoft Corporation KEK 2K CA 2023.der"
It appears that the BIOS would only accept .efi extension.

Should I choose "Erase all Secure Boot Setting" instead, press ENTER and then F10 to save changes, boot into Windows and run the Update_UEFI-CA2023.ps1 script?

Thanks for your help!

Sorry to write again,
I couldn't find the edit button for my previous post.

Do I have to leave Secure Boot on, change Secure Boot Mode before proceeding?
Here are 2 screenshots of my BIOS.
Thanks

Nicolast said:

Sorry to write again,
I couldn't find the edit button for my previous post.

Do I have to leave Secure Boot on, change Secure Boot Mode before proceeding?
Here are 2 screenshots of my BIOS.
Thanks
View attachment 164117

View attachment 164119

Click to expand...

If you're trying to append just the 2023 KEK, then you'll want to, " Select an UEFI File as Trusted for Executing ". By selecting " Restore Secure Boot to Factory Setting ", you'll wipe out everything you've already done and will have to start all over from the beginning as it will restore the key/certs to what is in BIOS version. Every OEM BIOS is a little different, but you'll find by selecting either of the aforementioned choices, it will disable Secure Boot, otherwise you wouldn't be able to update the keys/certs. Once you're done successfully updating, depending on the device, it will turn Secure Boot back on by itself.

If you find you're unable to fully update the certs/keys manually because the device is unsupported, there's always the Mosby option.

If the manual enrollment wants an ".efi" file, then you can try these steps:

1. Run the Check_UEFI-CA2023.ps1 script.
2. Confirm BitLocker is not ON. If it's enabled, then disable BitLocker on C: drive.

3. Disable Secure Boot in BIOS.
4. Erase all Secure Boot Settings.
5. Restart Windows.

6. Run the Update_UEFI-CA2023.ps1 script. It should detect you're in Setup Mode.
7. Restart Windows.

I have run Garlin's latest script, and all my Secure Boot Certificates are correct. I completely uninstalled and reinstalled Macrium Reflect X to ensure that I had no cached Wims.

MR downloaded new PE Wims and yet I can't boot from the Windows boot menu or from the bootable USB SSD unless I disable Secure Boot.

I'm happy to disable SB but would like to know what's wrong.

All relevant wims are dated today.

What does "Check_UEFI-CA2023.ps1 -BootMedia" report when the Macrium USB is plugged in?

Are you specifying the Signing Certificate under Options?
https://kbx.macrium.com/macrium-reflect-x/creating-rescue-media#Options



I don't know how good the "Choose the best option" logic is (whether it's detecting you can't use CA 2011).

garlin said:

If the manual enrollment wants an ".efi" file, then you can try these steps:

1. Run the Check_UEFI-CA2023.ps1 script.
2. Confirm BitLocker is not ON. If it's enabled, then disable BitLocker on C: drive.

3. Disable Secure Boot in BIOS.
4. Erase all Secure Boot Settings.
5. Restart Windows.

6. Run the Update_UEFI-CA2023.ps1 script. It should detect you're in Setup Mode.
7. Restart Windows.

Click to expand...

When I run the Update_UEFI-CA2023.ps1, I get :
ERROR: Failed to read UEFI Secure Boot settings

When I run the Check_UEFI-CA2023.ps1, I get the same error and:
UEFI is in setup mode (no certs)