Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

\your\folder\with script\Update-UEFI.bat -BootMedia

PS C:\Temp> .\Update-UEFI.bat -BootMedia
PowerShell 7.6.0

Bcdboot - Bcd boot file creation and repair tool.

The bcdboot.exe command-line tool is used to copy critical boot files to the
system partition and to create a new system BCD store.

bcdboot <source> [/l <locale>] [/s <volume-letter> [/f <firmware>]] [/v]
                 [/vbcd] [/m [{OS Loader ID}]] [/addlast] [/p] [/c]
                 [/nofirmwaresync] [/description <description>]

  source     Specifies the location of the windows system root.

  /l         Specifies an optional locale parameter to use when
             initializing the BCD store. The default is US English.

  /s         Specifies an optional volume letter parameter to designate
             the target system partition where boot environment files are
             copied.  The default is the system partition identified by
             the firmware.

  /v         Enables verbose mode.

  /vbcd      Enables BCD logging.

  /m         If an OS loader GUID is provided, this option merges the
             given loader object with the system template to produce a
             bootable entry. Otherwise, only global objects are merged.

  /d         Specifies that the existing default windows boot entry
             should be preserved.

  /f         Used with the /s command, specifies the firmware type of the
             target system partition. Options for <firmware> are 'UEFI',
             'BIOS', or 'ALL'.

  /t         Used with the /s and /f commands, specifies a target directory
             under the system partition where the boot environment files
             are to be copied. By default, the boot environment files are
             copied to the root of the target system partition.

  /addlast   Specifies that the windows boot manager firmware entry
             should be added last. The default behavior is to add it
             first.

  /nofirmwaresync Disable synchronization with firmware.

  /bcdclean  Clean the BCD Store. By default, simply removes any duplicate
             entries in the BCD. Can be followed by 'full'. In this case,
             each entry is scanned. If the corresponding device for that entry
             does not exist, the entry is deleted.

  /p         Specifies that the windows boot manager firmware entry
             position should be preserved. If entry does not exist,
             new entry will be added in the first position.

  /c         Specifies that any existing objects described by the template
             should not be migrated.

  /imageroot Specifies an image root under from the boot files originate. The bcd store of this
             image needs to be constructed with paths relative to the root of the image.

  /bootex    Use the bootex binaries for servicing if necessary conditions are met.

  /offline   Forces boot file servicing to be handled in an offline manner. Boot
             file selection is forced based on presence of 'bootex' switch.

Examples: bcdboot c:\windows /l en-us
          bcdboot c:\windows /s h:
          bcdboot c:\windows /s h: /f UEFI
          bcdboot c:\windows /s h: /f UEFI /t Configuration\Boot
          bcdboot c:\windows /m {d58d10c6-df53-11dc-878f-00064f4f4e08}
          bcdboot c:\windows /d /addlast
          bcdboot c:\windows /p
          bcdboot C:\Images\ImageRoot\Files\Windows /f UEFI /imageroot C:\Images\ImageRoot\Files
SUCCESS: NO UPDATES ARE REQUIRED.

PS C:\Temp> ./Check_UEFI-CA2023.ps1 -Bootmedia
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 8.0

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    SkuSiPolicy.p7b is CURRENT.

Bootable Media
--------------
    USB Drive E: "ESD-ISO"
        Boot File [Windows UEFI CA 2023] is ALLOWED.

        boot.wim:2    Boot Manager [Windows UEFI CA 2023] is PRESENT.
        install.esd:1 Boot Manager [Windows UEFI CA 2023] is PRESENT.
            Skipping checks on next 6 install.esd images.
    USB Drive F:
        Boot File [Production PCA 2011] is BANNED


STATUS REPORT
-------------
    Registry: UEFICA2023Status = Updated

SUCCESS: UPDATES ARE FINISHED.  UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

cd C:\Users\nikki\downloads\or\different\folder     <-  Replace with actual folder name
.\Update-UEFI.bat -BootMedia

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011

UEFI DBX Certs
--------------
    (NONE)

EFI Files
---------
    Disk 4: Windows Boot Manager [Production PCA 2011] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 0
        [Windows UEFI CA 2023] not in UEFI DB.

    Disk 4: SkuSiPolicy.p7b (for VBS) is NOT PRESENT.


REQUIRED ACTION
===============

OPTION 1:  DO NOTHING.  Windows will apply the UEFI updates in 2026 (supported BIOS).

OPTION 2:  To install [UEFI CA 2023] certs WITHOUT REVOKING the [PCA 2011] cert, run the commands:

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f
    powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

OPTION 3:  To install [UEFI CA 2023] certs and REVOKE the [PCA 2011] cert, run the commands:

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5bc4 /f
    powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

To install SkuSiPolicy.p7b, run the command:
    Update_UEFI-CA2023.ps1 -SkuSiPolicy

DBXUpdate2024.bin

EnhancedKeyUsageList : {Code Signing (1.3.6.1.5.5.7.3.3)}
DnsNameList          : {Microsoft Windows UEFI Key Exchange Key}
SendAsTrustedIssuer  : False
Archived             : False
Extensions           : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid...}
FriendlyName         :
IssuerName           : System.Security.Cryptography.X509Certificates.X500DistinguishedName
NotAfter             : 5/12/2026 11:35:24 AM
NotBefore            : 5/15/2025 11:35:24 AM
HasPrivateKey        : False
PrivateKey           :
PublicKey            : System.Security.Cryptography.X509Certificates.PublicKey
RawData              : {48, 130, 5, 15...}
SerialNumber         : 330000000502BFCB15AC0D31B1000000000005
SubjectName          : System.Security.Cryptography.X509Certificates.X500DistinguishedName
SignatureAlgorithm   : System.Security.Cryptography.Oid
Thumbprint           : DBCACC3445D4BEFFE61EA7306AC4D1E884D3EBD8
Version              : 3
Handle               : 2847132220976
Issuer               : CN=Microsoft Corporation KEK 2K CA 2023, O=Microsoft Corporation, C=US
Subject              : CN=Microsoft Windows UEFI Key Exchange Key, O=Microsoft Corporation, L=Redmond, S=Washington, C=US


DBXUpdate2024Legacy.bin

EnhancedKeyUsageList : {1.3.6.1.4.1.311.79.1}
DnsNameList          : {Microsoft Windows UEFI Key Exchange Key}
SendAsTrustedIssuer  : False
Archived             : False
Extensions           : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid...}
FriendlyName         :
IssuerName           : System.Security.Cryptography.X509Certificates.X500DistinguishedName
NotAfter             : 5/15/2026 11:48:09 AM
NotBefore            : 5/15/2025 11:48:09 AM
HasPrivateKey        : False
PrivateKey           :
PublicKey            : System.Security.Cryptography.X509Certificates.PublicKey
RawData              : {48, 130, 5, 0...}
SerialNumber         : 330000003406BADC84D2FF683D000000000034
SubjectName          : System.Security.Cryptography.X509Certificates.X500DistinguishedName
SignatureAlgorithm   : System.Security.Cryptography.Oid
Thumbprint           : 2C181A475FB7E3D83A742D69B543D14BA0AC38AE
Version              : 3
Handle               : 2847132214064
Issuer               : CN=Microsoft Corporation KEK CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject              : CN=Microsoft Windows UEFI Key Exchange Key, O=Microsoft Corporation, L=Redmond, S=Washington, C=US