Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Scott · Mar 10, 2026

JamesSmith said:
Is there a reason GIGABYTE is listed 2 times under
Factory Default UEFI DB Certs
and
UEFI DB Certs

One might be for motherboard and the other for notebooks. Here's what my ASUS says:

garlin · Mar 10, 2026

Scott said:
One might be for motherboard and the other for notebooks. Here's what my ASUS says:

Unlike Gigabyte, ASUS has a clue and used the proper labeling on their self-issued certs.

JamesSmith · Mar 10, 2026

garlin said:
Unlike Gigabyte, ASUS has a clue and used the proper labeling on their self-issued certs.

I was going to wait until 1 week before June to do these keys. I am thankful I have done it now. Garlin you are a legend. Thank you for troubleshooting all of that with me.

Last thing I need to deal with is the revoke part. Based on my output do I need to manually remove any entries or will MS take care of it?

garlin · Mar 10, 2026

MS hasn't announced when they'll begin the mandatory revocation process (most likely it will happen in June or later).

You can wait if you prefer. The major change after revoking is if you have existing USB boot media for Windows install or recovery software, the boot file needs to be replaced with the CA 2023 version.

In the UEFI model, you don't remove banned certs. Instead changes are made by appending new entries. The revoked PCA 2011 continues to exist in the DB variable, but is canceled by simultaneously existing in the DBX. The UEFI's allow list is created by subtracting the DBX entries from the DB list.

JamesSmith · Mar 10, 2026

garlin said:
MS hasn't announced when they'll begin the mandatory revocation process (most likely it will happen in June or later).

You can wait if you prefer. The major change after revoking is if you have existing USB boot media for Windows install or recovery software, the boot file needs to be replaced with the CA 2023 version.

In the UEFI model, you don't remove banned certs. Instead changes are made by appending new entries. The revoked PCA 2011 continues to exist in the DB variable, but is canceled by simultaneously existing in the DBX. The UEFI's allow list is created by subtracting the DBX entries from the DB list.

So as long as we have the updated certificates then it doesn't matter is what I am understanding.

I built this computer listed under (my computer) for myself and my father who is 70+ years old. What I am wondering is this job done?
Because it is a bit of a trip to fly to my dads house and do all for this for him. I assume if anything changes I assume you (garlin) will let us know if there are any more steps? But as of 10th of March I can say Job done?

garlin · Mar 10, 2026

The check script follows a long list of individual checks, before reporting "SUCCESS: NO UPDATES ARE REQUIRED."

When you see those words, it's checked for everything required before the revocation. Since the deadline for revocation hasn't been announced, the script doesn't make it mandatory that you follow the revocation steps. After a date has been given, I'll probably update the script.

You have the option to revoke CA 2011 now (using the update script's -Revoke option), and test if the system boots. That way you don't need to worry about when MS decides to roll forward, and have to scheduled a possible check-in visit. All you need to do is to update the boot files on any bootable USB drives that are used to install Windows, or to run a Macrium-style recovery tool. After that's done, all your bases are covered.

Worse case, you can always temporarily disable Secure Boot mode. You might want to take pictures of the UEFI setup screen, so it's easily to show your dad how to do this in case of emergency.

antspants · Mar 10, 2026

I seem to have a DB cert in my DBX list. Is that worth worrying about?

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 7.0

Code:

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 7.0

EFI Files
---------
    Disk 2: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

STATUS REPORT
-------------
    Registry: UEFICA2023Status = Updated

SUCCESS: NO UPDATES ARE REQUIRED.

SaliesBuzz · Mar 10, 2026

I have an old Surface Pro 4 that I have managed to install Windows 11 25H2 on.
The BIOS is the default Microsoft BIOS that will not be updated.
Can I still use the script to update the EFI partition?
There is no option in the BIOS to enter a "Setup" mode.
The only options under Secure Boot Configuration are:
Select a Secure Boot certificate:
Microsoft Only
Microsoft & 3rd party CA
None
Which one should I choose prior to running the update script?
Also the Check script throws the following errors that are not written into the log with the -verbose and -log option:

You cannot call a method on a null-valued expression.
At C:\Buzz\SecureBoot\SecureBoot-CA-2023-Updates\Check_UEFI-CA2023.ps1:1007 char:9
+ $BIOS_Date = $BIOS.ReleaseDate.ToString('yyyy-MM-dd')
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull

and:

Get-SecureBootUEFI : Variable is currently undefined: 0xC0000100
At C:\Buzz\SecureBoot\SecureBoot-CA-2023-Updates\Check_UEFI-CA2023.ps1:1115 char:62
+ ... gnatures: {1}' -f $Tab4, (Get-SecureBootUEFI -Name dbxDefault | Get-U ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (Microsoft.Secur...BootUefiCommand:GetSecureBootUefiCommand) [G
et-SecureBootUEFI], StatusException
+ FullyQualifiedErrorId : GetFWVarFailed,Microsoft.SecureBoot.Commands.GetSecureBootUefiCommand

Any advice will be gratefully received!

Regards
SaliesBuzz

garlin · Mar 10, 2026

antspants said:
I seem to have a DB cert in my DBX list. Is that worth worrying about?

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 7.0

This means you (or someone else like a vendor) has decided to ban the Microsoft UEFI CA 2011, which is used by Linux. Technically that's not required because modern Linux distros use the SBAT file mechanism in place of DBX, and most of them have moved to Microsoft UEFI CA 2023 any way.

garlin · Mar 10, 2026

SaliesBuzz said:
I have an old Surface Pro 4 that I have managed to install Windows 11 25H2 on.
The BIOS is the default Microsoft BIOS that will not be updated.

From the UEFI menu, you set the Secure Boot keys to "None" or "Delete All Secure Boot keys", in order to enter Setup Mode.

The update script detects Setup Mode and uses the MS GitHub files to replace the Surface PK with Windows OEM Devices PK (also provided by MS). You may need this interim version of the check and update scripts. I haven't officially pushed all the changes back into the official script yet.

Nebulon Ranger · Mar 10, 2026

One more question, that I'm posting here since the other thread hasn't seen activity in four months;

According to the secure boot objects repo, DBXupdateSVN.bin should be from early September 2025, yet mine appears to be from July 2025. Will this cause problems come revocation time, and is there a way to get up to date manually (or should I just wait for Windows Update to handle it)?

kanenas · Mar 10, 2026

I believe I've successfully did this.
After updating the computer with the latest BIOS (that had the vendor's 2023 certificate), I run garlin's scripts and got this at the end:

----------------------

.\Check_UEFI-CA2023.ps1 -Audit -Log

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 7.0

EFI Files
---------
Disk 1: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

Disk 1: SkuSiPolicy.p7b (for VBS) is CURRENT.

AUDIT REPORT
============

STATUS REPORT
-------------
Registry: UEFICA2023Status = Updated

SUCCESS: NO UPDATES ARE REQUIRED.

Log file saved as "C:\_To Do\_Secure Boot\SecureBoot-CA-2023-Updates\2026-03-10 B660M-HDV Check-UEFI.log"

PS C:\_To Do\_Secure Boot\SecureBoot-CA-2023-Updates>

-------------------

Smooth operation all around.

Thank you very much garlin for your efforts and help.

garlin · Mar 10, 2026

Nebulon Ranger said:
According to the secure boot objects repo, DBXupdateSVN.bin should be from early September 2025, yet mine appears to be from July 2025. Will this cause problems come revocation time, and is there a way to get up to date manually (or should I just wait for Windows Update to handle it)?

If your Windows has been receiving monthly updates, C:\Windows\System32\SecureBootUpdates will contain the latest versions of the GitHub files. DBXUpdateSVN.bin got bumped in Oct 2025 from SVN 5.0 to 7.0.

My update script has an option to check the MS GitHub for a newer version of both DBXUpdate.bin & DBXUpdateSVN.bin.

Code:

Update_UEFI-CA2023.ps1 -Revoke -Latest

The script doesn't base its check on the filesizes or timestamps, it compares the actual contents and decides if the GitHub files have updates which your current UEFI is missing (431 EFI signature hashes in DBX, and SVN 7.0). If there's no changes, it will skip over them.

You can re-run "-Revoke -Latest" at any time to force a comparison against the GitHub files.

Only DBXUpdate.bin & DBXUpdateSVN.bin are expected to change over the time, as the other cert .bin files are static. The Confidence Bucket and KEK databases are for the Secure Boot task's internal use, and don't matter after you've completed all the Secure Boot steps.

Nebulon Ranger · Mar 10, 2026

garlin said:
If your Windows has been receiving monthly updates, C:\Windows\System32\SecureBootUpdates will contain the latest versions of the GitHub files. DBXUpdateSVN.bin got bumped in Oct 2025 from SVN 5.0 to 7.0.

My update script has an option to check the MS GitHub for a newer version of both DBXUpdate.bin & DBXUpdateSVN.bin.

Code:

Update_UEFI-CA2023.ps1 -Revoke -Latest

The script doesn't base its check on the filesizes or timestamps, it compares the actual contents and decides if the GitHub files have updates which your current UEFI is missing (431 EFI signature hashes in DBX, and SVN 7.0). If there's no changes, it will skip over them.

You can re-run "-Revoke -Latest" at any time to force a comparison against the GitHub files.

Only DBXUpdate.bin & DBXUpdateSVN.bin are expected to change over the time, as the other cert .bin files are static. The Confidence Bucket and KEK databases are for the Secure Boot task's internal use, and don't matter after you've completed all the Secure Boot steps.

powershell -nop -ep bypass -f C:\Users\dark\Downloads\SecureBoot-CA-2023-Updates\Update_UEFI-CA2023.ps1 -Revoke -Latest
"dbxupdate.bin" is not a newer version of file.
Successfully appended "DBXUpdate2024.bin" to UEFI DBX

Hm. It's not listing DBXUpdateSVN at all, and confirming DBXUpdate is older (? The wording is a bit confusing here). Though, my DBXUpdate.bin is dated 24 October 2025, so that suggests it's at least recent. I don't use BitLocker, so I just quit out after it asked me for a mount point.

Notably, I have SVN 7.0 listed now that I've run that command, and no more updates required.

garlin · Mar 10, 2026

DBXUpdate.bin = bans specific EFI boot files by adding their unique signature hashes
DBXUpdate2024.bin = adds PCA 2011 to the DBX (revocation), sets SVN initially to 2.0
DBXUpdateSVN.bin = bumps SVN up to 7.0

The BitLocker bug is fixed in the work-in-progress version, scroll back up to post #770.

Nebulon Ranger · Mar 10, 2026

garlin said:
DBXUpdate.bin = bans specific EFI boot files by adding their unique signature hashes
DBXUpdate2024.bin = adds PCA 2011 to the DBX (revocation), sets SVN initially to 2.0
DBXUpdateSVN.bin = bumps SVN up to 7.0

The BitLocker bug is fixed in the work-in-progress version, scroll back up to post #770.

Might have another error in the Update script;

PowerShell 7.5.4
PS C:\Users\dark> powershell -nop -ep bypass -f C:\Users\dark\Downloads\SecureBoot-CA-2023-Updates\Update_UEFI-CA2023.ps1 -Revoke -Latest
At C:\Users\dark\Downloads\SecureBoot-CA-2023-Updates\Update_UEFI-CA2023.ps1:664 char:107
+ ... SiPolicy.p7b (for VBS) is missing [OPTIONAL]`n" -f ('{0}.' -f $index+
+ ~
You must provide a value expression following the '+' operator.
At C:\Users\dark\Downloads\SecureBoot-CA-2023-Updates\Update_UEFI-CA2023.ps1:664 char:107
+ ... SiPolicy.p7b (for VBS) is missing [OPTIONAL]`n" -f ('{0}.' -f $index+
+ ~
Missing closing ')' in expression.
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : ExpectedValueExpression

All this being said, my last Windows Update was the February Patch Tuesday update, so I shoooould still be fine? I mean I'm already running the 2023 bootmgr anyway.

garlin · Mar 10, 2026

Sorry, that was a typo on line 664.

Nebulon Ranger · Mar 10, 2026

garlin said:
Sorry, that was a typo on line 664.

No problem, at least it's fixed now.

PS C:\Users\dark> powershell -nop -ep bypass -f C:\Users\dark\Downloads\SecureBoot-CA-2023-Updates\Update_UEFI-CA2023.ps1 -Revoke -Latest
"dbxupdate.bin" is not a newer version of file.
"DBXUpdateSVN.bin" is not a newer version of file.

SUCCESS: NO UPDATES ARE REQUIRED.

This looks a lot better; looks like I had the latest SVN bin all along (duh! It added 7.0 to the DBX!). I should be all set, barring any Microsoft weirdness.

For posterity, DBX now looks like this according to the check script:

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 7.0
EFI_CERT_SHA256_GUID Signatures: 489

garlin · Mar 10, 2026

The total count of SHA256_GUID signatures can vary, starting from a minimum of 431 (installed by MS) and any non-duplicated factory defaults. In the old days, vendors started out by adding new DBX EFI signatures but that role is now done by MS exclusively.

SaliesBuzz · Mar 10, 2026

garlin said:
From the UEFI menu, you set the Secure Boot keys to "None" or "Delete All Secure Boot keys", in order to enter Setup Mode.

The update script detects Setup Mode and uses the MS GitHub files to replace the Surface PK with Windows OEM Devices PK (also provided by MS). You may need this interim version of the check and update scripts. I haven't officially pushed all the changes back into the official script yet.

I have set the keys to none in the Microsoft BIOS. It booted with a Red Padlock at the top of the screen.
There is no Bitlocker set, though, the system has a yellow cross against the C: drive which Bitlocker in Windows reports as "waiting for activation"
I have run the update script you posted and it does not run throwing the following errors:
"
At C:\Buzz\SecureBoot\SecureBoot-CA-2023-Updates\Update_UEFI-CA2023.ps1:664 char:107
+ ... SiPolicy.p7b (for VBS) is missing [OPTIONAL]`n" -f ('{0}.' -f $index+
+ ~
You must provide a value expression following the '+' operator.
At C:\Buzz\SecureBoot\SecureBoot-CA-2023-Updates\Update_UEFI-CA2023.ps1:664 char:107
+ ... SiPolicy.p7b (for VBS) is missing [OPTIONAL]`n" -f ('{0}.' -f $index+
+ ~
Missing closing ')' in expression.
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : ExpectedValueExpression"

Any advice as to what to try next would be much appreciated.
Regards
SaliesBuzz

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Like a rolling drone.

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer