Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

man00 · Mar 21, 2026

garlin said:
Your PC's last BIOS was Dec 2019, which is too old to support Secure Boot CA 2023 and Dell never signed a KEK update for this BIOS.

This version of the BIOS also doesn't take the .der or .crt-formatted certs, so manual enrollment of the KEK CA 2023 won't work. A number of other folks have the same issue with their older-generation Dells.

1. BitLocker is OFF for you, so we don't need to disable or suspend it.

2. We need to put the BIOS into Setup Mode (clear all certs), so the update script can install a new set of replacement MS certs. Please read this Dell article, and determine which BIOS version you have (looking at the screen layout).

How To Update Secure Boot Active Database from BIOS

3. Follow the Dell instructions. Make sure Secure Boot mode is disabled, before booting into Windows.

4. Run the check script; if it recognizes you're in Setup Mode then we can proceed.

5. Run the update script, it should replace the Dell PK with a Windows OEM Devices PK (from MS). Once that gets added, the rest of the CA 2023 certs should be installed in turn.

6. Run the check script. You should see the KEK CA 2023 now.

Dell doesn't mention Secure Boot mode is disabled or setup mode

garlin · Mar 21, 2026

Disabling Secure Boot mode is recommended when clearing the certs and overwriting them, because if something goes wrong – you still want Windows to always boot.

gunrunnerjohn · Mar 21, 2026

I have to say once more, I'm awed by the amount of work you have put into this issue, just want you to know that it's noticed and appreciated!

man00 · Mar 21, 2026

gunrunnerjohn said:
I have to say once more, I'm awed by the amount of work you have put into this issue, just want you to know that it's noticed and appreciated!

View attachment 166484

Yeah I agree, even if most of this is way over my head

LeeElectrode · Mar 21, 2026

man00 said:
Dell doesn't mention Secure Boot mode is disabled or setup mode
View attachment 166475

In the Bios above there is also and option to "Delete All Keys". I did not do that. I'm not that brave at this point. However, once I "Perform the following steps: the Dell Precision M4800 laptop boots to the error: "Operating system loader signature not found in secure database ('db')" and I have to go back into the bios and disable Secure Boot for it to boot back to windows. Once in Windows I can run the Update_UEFI-CA2023.ps1 script, reboot into Bios, enable Secure Boot and the Laptop will boot to windows once again however Check_UEFI-CA2023.ps1 does not show the KEK CA2023 and instructs me to the Manual installation of [KEK 2K CA 2023] and subsequently fails to add the "Microsoft Corporation KEK 2K CA 2023.crt or .der certificates. So right now I'm in stuck in a looping pattern. Interesting enough if I just go into the bios and Enable Custom Mode then disable it without Resetting any Keys the same pattern will prevail. Am I a lost cause?

garlin · Mar 21, 2026

Custom mode allows you edit the Secure Boot keys. Otherwise in normal mode, they're locked to prevent tampering.

The problem is a certain set of BIOS'es don't allow the KEK to be easily appended (to add CA 2023) because of security restrictions. So "Delete All Keys" removes the built-in protection mechanism, and allows us to install a MS-provided replacement designed for this purpose.

While deleting keys isn't the best choice, sometimes it's only option for these legacy PC's.

Since the script doesn't know which of the two options you'll have to follow, it optimistically suggests the manual key enrollment first. We don't have a database of known good PC's, and known problem PC's, other than PC's with BIOS'es older than 2020 have the most challenges.

cool59 · Mar 21, 2026

Hey friends

!
After months of anguish over being unable to install Kek CA 2k 2023 in secure boot, today I decided to venture into the BIOS of my Dell XPS 13 9360 (2016 with the last BIOS update in 2022).
First, with Secure Boot enabled, and in custom mode, I deleted all the certificates.
After making sure I was in custom mode using the respective script, I ran the update sript and apparently everything was fine, with the certificates listed in the check script.
However, like other users, when I turned secure boot back on, the PC wouldn't boot.
I tried several times and succeeded in a somewhat strange way:
I discovered that if I left custom mode enabled (instead of turning it back to standard mode) when finish, the pc booted
without problems with secure boot enabled, and the registry editor says the update is complete, with the necessary certificates, as you can see in the screenshot.I don't know if there's any problem with leaving custom mode enabled... but I'm tempted to leave it that way.
Thanks for any opinions on this matter.
@garlin, thank you very much for all your efforts.

garlin · Mar 21, 2026

cool59 said:
I tried several times and succeeded in a somewhat strange way:
I discovered that if I left custom mode enabled (instead of turning it back to standard mode) when finish, the pc booted
without problems with secure boot enabled, and the registry editor says the update is complete, with the necessary certificates, as you can see in the screenshot.I don't know if there's any problem with leaving custom mode enabled... but I'm tempted to leave it that way.

Custom mode may be required for some outdated PC's, as you're not getting a signed KEK from the vendor. So the replacement certs from MS aren't considered the factory certs, but functionally do the same thing.

Right now, you have all of the CA 2023 certs but did not start revocation (which is still optional for now). But Windows will have no unexpected issues when MS flips that switch later this year.

cool59 said:
@garlin, thank you very much for all your efforts.

Great that you figured it out!

garlin · Mar 21, 2026

I'll add a note in the README_UEFI.TXT, suggesting users leave the UEFI in Custom mode if they used Setup Mode (cleared all keys).
Thanks for the helpful reminder!

Dirtyflash · Mar 21, 2026

cool59 said:
Hey friends !
After months of anguish over being unable to install Kek CA 2k 2023 in secure boot, today I decided to venture into the BIOS of my Dell XPS 13 9360 (2016 with the last BIOS update in 2022).
First, with Secure Boot enabled, and in custom mode, I deleted all the certificates.
After making sure I was in custom mode using the respective script, I ran the update sript and apparently everything was fine, with the certificates listed in the check script.
However, like other users, when I turned secure boot back on, the PC wouldn't boot.
I tried several times and succeeded in a somewhat strange way:
I discovered that if I left custom mode enabled (instead of turning it back to standard mode) when finish, the pc booted
without problems with secure boot enabled, and the registry editor says the update is complete, with the necessary certificates, as you can see in the screenshot.I don't know if there's any problem with leaving custom mode enabled... but I'm tempted to leave it that way.
Thanks for any opinions on this matter.
@garlin, thank you very much for all your efforts.
View attachment 166512

It could be that in order to install the new certs / keys , you had to ' customize ' the installation process. In some instances on successful completion, the BIOS Secure Boot status will indicate ' Custom '. So in other words, that's exactly what you want. I'm guessing that attempting to put Secure Boot in ' Standard ' mode was resetting the certs / keys, thereby causing a bootloader mismatch.

garlin · Mar 21, 2026

My understanding is "Standard mode" means you must use the factory PK. Which limits you to only adding KEK's signed by the OEM's PK. This is very secure, but unfortunately you're now at the mercy of the OEM to provide a signed KEK.

"Custom mode" allows you to replace the factory PK with a custom PK. In our case, the "custom PK" is the reference set of Secure Boot keys provided by MS to their OEM partners. This works because MS both provided their PK, but also the KEK CA 2023 signed by the same PK. Therefore we have no security issues; unlike in "Standard mode" where the lack of a matching signed KEK blocks us.

Dirtyflash · Mar 21, 2026

garlin said:
My understanding is "Standard mode" means you must use the factory PK. Which limits you to only adding KEK's signed by the OEM's PK. This is very secure, but unfortunately you're now at the mercy of the OEM to provide a signed KEK.

"Custom mode" allows you to replace the factory PK with a custom PK. In our case, the "custom PK" is the reference set of Secure Boot keys provided by MS to their OEM partners. This works because MS both provided their PK, but also the KEK CA 2023 signed by the same PK. Therefore we have no security issues; unlike in "Standard mode" where the lack of a matching signed KEK blocks us.

That's a great explanation that you worded well, it helps others to see another part of the process and how it fits into the ' big picture ' .

LeeElectrode · Mar 21, 2026

cool59 said:
Hey friends !
After months of anguish over being unable to install Kek CA 2k 2023 in secure boot, today I decided to venture into the BIOS of my Dell XPS 13 9360 (2016 with the last BIOS update in 2022).
First, with Secure Boot enabled, and in custom mode, I deleted all the certificates.
After making sure I was in custom mode using the respective script, I ran the update sript and apparently everything was fine, with the certificates listed in the check script.
However, like other users, when I turned secure boot back on, the PC wouldn't boot.
I tried several times and succeeded in a somewhat strange way:
I discovered that if I left custom mode enabled (instead of turning it back to standard mode) when finish, the pc booted
without problems with secure boot enabled, and the registry editor says the update is complete, with the necessary certificates, as you can see in the screenshot.I don't know if there's any problem with leaving custom mode enabled... but I'm tempted to leave it that way.
Thanks for any opinions on this matter.
@garlin, thank you very much for all your efforts.
View attachment 166512

OMG! You're my Hero! It worked for me too! Here is the whole story...
Dell Precision M4800 laptop

Enter Bios
Enable Secure Boot
Under Expert Key Management check the box Enable Custom Mode
Delete (not reset) all Keys.
Save and exit and the PC should boot to windows.

....................................
Run Check_UEFI-CA2023.ps1

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

UEFI is in Setup Mode (NO CERTS)

EFI Files
---------
Disk 1: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 0
[Windows UEFI CA 2023] not in UEFI DB.

REQUIRED ACTION
===============

OPTION 1: To install [UEFI CA 2023] certs WITHOUT REVOKING the [PCA 2011] cert, run the command:

Update_UEFI-CA2023.ps1

OPTION 2: To install [UEFI CA 2023] certs and REVOKE the [PCA 2011] cert, run the command:

Update_UEFI-CA2023.ps1 -Revoke

......................................
PS C:\Users\LeeElectrode\Desktop\SecureBoot-CA-2023-Updates>

Run Update_UEFI-CA2023.ps1 -verbose

VERBOSE: Perform operation 'Enumerate CimInstances' with following parameters, ''namespaceName' = root\Microsoft\Windows\DeviceGuard,'className' = Win32_DeviceGuard'.
VERBOSE: Operation 'Enumerate CimInstances' complete.
Downloading "edk2-x64-secureboot-binaries.zip" from GitHub.
VERBOSE: Requested HTTP/1.1 GET with 0-byte payload
VERBOSE: Received HTTP/1.1 357605-byte response of content type application/octet-stream
VERBOSE: File Name: edk2-secureboot-binaries.zip
Successfully wrote "Default3PDb.bin" to UEFI db.
Successfully wrote "DefaultDbx.bin" to UEFI dbx.
Successfully wrote "DefaultKek.bin" to UEFI KEK.
Successfully wrote "DefaultPk.bin" to UEFI PK.
Downloading "WindowsOEMDevicesPK.der" from GitHub.
VERBOSE: Requested HTTP/1.1 GET with 0-byte payload
VERBOSE: Received HTTP/1.1 1531-byte response of content type application/octet-stream
VERBOSE: File Name: WindowsOEMDevicesPK.der
Copying "WindowsOEMDevicesPK.der" to EFI.

REQUIRED ACTION
---------------
Please follow the README_UEFI.TXT instructions, for installing the PK cert from BIOS.

Restart Windows, for UEFI updates to take effect.

PS C:\Users\LeeElectrode\Desktop\SecureBoot-CA-2023-Updates>

.............................................................
Restart Windows
Run Check_UEFI-CA2023.ps1

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
(NONE)

EFI Files
---------
Disk 1: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

REQUIRED ACTION
===============

To revoke the [PCA 2011] cert, run the commands, run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x280 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
.....................................
PS C:\Users\LeeElectrode\Desktop\SecureBoot-CA-2023-Updates> Add the above key.
PS C:\Users\LeeElectrode\Desktop\SecureBoot-CA-2023-Updates> reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x280 /f
>> powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
The operation completed successfully.

.....................................
PS C:\Users\LeeElectrode\Desktop\SecureBoot-CA-2023-Updates>
Run Check_UEFI-CA2023.ps1 -verbose

Windows 11 25H2 (26200.8037)

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

BIOS Firmware
-------------
Dell Inc. Precision M4800
Version: A26
Date: 2019-06-12

Factory Default UEFI PK Cert
----------------------------
(NONE)

UEFI PK Cert
------------
Windows OEM Devices PK

Factory Default UEFI KEK Certs
------------------------------
(NONE)

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
(NONE)

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
(NONE)
Get-SecureBootUEFI: C:\Users\LeeElectrode\Desktop\SecureBoot-CA-2023-Updates\Check_UEFI-CA2023.ps1:1115
Line |
1115 | … gnatures: {1}' -f $Tab4, (Get-SecureBootUEFI -Name dbxDefault | Get-U …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Variable is currently undefined: 0xC0000100

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 7.0
EFI_CERT_SHA256_GUID Signatures: 437

EFI Files
---------
Disk 1: Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
bootmgfw.efi File version: 26100.30227

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

STATUS REPORT
-------------
Registry: UEFICA2023Status = Updated

SUCCESS: NO UPDATES ARE REQUIRED.

PS Enable Custom Mode is still in effect.

garlin · Mar 21, 2026

You're all done.

LeeElectrode said:
Factory Default UEFI DBX Certs
------------------------------
(NONE)
Get-SecureBootUEFI: C:\Users\LeeElectrode\Desktop\SecureBoot-CA-2023-Updates\Check_UEFI-CA2023.ps1:1115
Line |
1115 | … gnatures: {1}' -f $Tab4, (Get-SecureBootUEFI -Name dbxDefault | Get-U …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Variable is currently undefined: 0xC0000100

Oops, one last place I forgot to handle the dreaded 0xC0000100 error ("can't read this value").

LeeElectrode · Mar 21, 2026

garlin said:
You're all done.

Oops, one last place I forgot to handle the dreaded 0xC0000100 error ("can't read this value").

Should I be concerned about the 0xC0000100 error? and is it Ok to leave Custom Mode Enabled?

garlin · Mar 21, 2026

Don't worry about that.

There's always a set of factory defaults hard-coded in the firmware ("Reset to Factory"), but not all BIOS'es have a PKdefault, KEKdefault, DBdefault, or DBXdefault variable. I need to ignore those errors, since we only care about reading the active keys.

Leave Custom Mode alone.

man00 · Mar 22, 2026

My problem was and still is I can not run those ps1 scripts I tried every way I know of and on two different computers.
I can run the batch files (Check-UEFI.bat) as admin

garlin · Mar 22, 2026

man00 said:
My problem was and still is I can not run those ps1 scripts I tried every way I know of and on two different computers.
I can run the batch files (Check-UEFI.bat) as admin

You probably have the default Execution Policy to prevent PS scripts from running.

There are two options, depending on how comfortable you are running PS scripts (not just the Secure Boot ones).

1. Change your Execution Policy to allow all scripts (even untrusted ones). My scripts are untrusted because I don't have a paid signing cert from a recognized Certificate Authority to sign my files. There are free signing certs available, but that requires everyone to download and install my personal cert.

Run command in Admin PowerShell:

Code:

Set-ExecutionPolicy Unrestricted -Scope LocalMachine -Force

2. Somewhat more annoying, but keeping yourself fully protected is using the PS command line to temporarily bypass the Execution Policy just for that one instance. Other scripts still cannot execute by themselves, outside of the one-time bypass.

For PS 5 users:

Code:

powershell -ep bypass -f \path\to\Check_UEFI-CA2023.ps1

For PS 7 users:

Code:

pwsh -ep bypass -f \path\to\Check_UEFI-CA2023.ps1

3. Run the batch scripts. All the batch scripts really do is confirm which version of PS you're using, and call PS with the same bypass commands.

Shinji92 · Mar 22, 2026

Would it work on my old dell e6430s laptop?

PurSpyk!! · Mar 22, 2026

Would this work on an old X99 based Asus motherboard?

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Member

My Computer

Well-known member

My Computer

Member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers