Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

nikki605 · Apr 20, 2026

@garlin When I run your Check-UEFI.bat script file, how come I don't see the SkuSiPolicy.p7b status like I'm seeing in other members posts? I get the same result on both of my systems. This screen shot is from my Lenovo T490 laptop.

garlin · Apr 20, 2026

If your HW doesn't support Virtualization Based Security or it's disabled, then SkuSiPolicy is not needed.
On your PC, VBS is OFF.

Older PC's may not meet the HW requirements, or require older device drivers which fail the VBS security checks.

nikki605 · Apr 20, 2026

garlin said:
If your HW doesn't support Virtualization Based Security or it's disabled, then SkuSiPolicy is not needed.
On your PC, VBS is OFF.

Older PC's may not meet the HW requirements, or require older device drivers which fail the VBS security checks.

Got it, thanks! The T490 has VBS, but as you say, it is disabled. I'll have to check the M83 to see if it has VBS or not. If it's available, is there any benefit to enabling it on either system?

garlin · Apr 20, 2026

VBS increases kernel security by preventing certain non-authenticated processes from running. But on older PC's, it can be a performance hit.

From Windows Security Center, you can look in the Device Security tab and enable Core Isolation. Restart Windows.
If your PC complains about something, or feels sluggish, then disable it.

t2s50 · Apr 20, 2026

garlin said:
.....
This change is utterly baffling. DBXUpdate2024 is primarily used to add PCA 2011 to the DBX, and you get 3 starting SVN's. Those initial values are irrelevant because the update process says we immediately apply DBXUpdateSVN (and forever in the future) to bump it up.

I'm sorry, but I don't understand what MS is doing here.

There has to be a meaning that the *2024 files exist, and now there's the legacy 'line' of dbx updates in addition. What would be the meaning of a line with PCA2011 signed updates with latest SVNs? One would still need a non- expired KEK for updating the dbx- or is this preparation for the latest SVN and latest dbx for machines that can't be updated?

I assume the 2024 dbx update sets a base SVN level together with revoking the PCA2011 cert and the latest SVN (only) update is applied at a later time. Unfortunately I updated all my machines manually so I can't confirm it, but I don't think it was a question of several reboots to get the SVN update applied.
If I understand correctly the PCA2011 cert revocation is not yet automatically applied during MS updates, too? I'd think this would be a first step that should be done before applying the SVN updates? Then it would seem in a way logical yo apply a somewhat lower SVN level at the same time.

By the way: I think you mentioned 0x20 for AvailableUpdates for applying SkuSiPolicy.p7b. MS changed the documentation to manually copy the file in december, the way via registry key doesn't seem to work (Update_UEFI-CA2023.ps1 missing an option to install SkuSiPolicy.p7b (outside of a revoke) · Issue #3 · garlin-cant-code/SecureBoot-CA-2023-Updates):

And not relevant for scripting but for a short check the SkuSiPolicy.p7b version can be read with a hex editor:

elajji · Apr 20, 2026

garlin said:
Asus X99A is a really old PC. Before you do anything, please check your BIOS menu.
Do you have an UEFI option for Custom mode, and Delete All Keys?

Yes i can delete all keys inside bios under UEFI Section!
Thx :)

garlin · Apr 20, 2026

1. Check you don't have BitLocker or Windows Hello PIN enabled. Because updating the certs will make Windows ask for a recovery password for BitLocker or Windows Hello.

2. Delete all keys. Restart Windows.

3. Run the update script. Replace the folder path with the script's location.

Code:

powershell -ep bypass -f \your\folder\Update_UEFI-CA2023.ps1

garlin · Apr 20, 2026

rtorres said:
I didn't get any output after running that command:

PS C:\WINDOWS\system32> Get-Disk | Where-Object {$_.IsSystem -eq $true}
PS C:\WINDOWS\system32>

If you are interested, I have attached the ps1 file to this response.

Is the system volume on a Dynamic Disk?

Does this work?

Code:

(Get-CimInstance -Namespace "Root\CIMv2" -Query "SELECT * FROM Win32_DiskPartition" | where { $_.Type -eq 'GPT: System' }).DiskIndex

Nicolast · Apr 21, 2026

Hi,
Today I updated the Windows Boot Mgr SVN to 8.0 from 7.0 using the registry "trick"
I'm unable to boot from my USB drive with Ventoy 1.1.11 (latest version). Ventoy worked with Windows Boot Mgr SVN 7.0 after enrolling a key from the MoK Key Manager. I tried deleting the key and enrolling it again without success:

I've also tried Garlin's script to update the BootMedia

Unfortunately it doesn't work either, I get the following:

After removing the USB drive, the pc boots into Windows as it should.

Any idea how to solve this issue?
Thanks
Nicolast

garlin · Apr 21, 2026

Ventoy and non-Windows drives will use a MS-signed boot manager or a shim bootloader, but they're not restricted by the SVN.

SVN only applies to the Windows boot manager, as shims are restricted by the SBAT (their version of a SVN mechanism). When the SVN gets bumped, it doesn't change the signing certificate attached to the boot file. The signing cert is the authenticator, but the SVN or BAT is a versioning method.

I'm guessing the update script may not understand what happens with a Ventoy drive (never tested it). The error message indicates a mismatch between the BCD data.

Try the recovery commands in this post:
Computer won't boot and have code 0xc000000f - Microsoft Q&A

Nicolast · Apr 21, 2026

garlin said:
Ventoy and non-Windows drives will use a MS-signed boot manager or a shim bootloader, but they're not restricted by the SVN.

SVN only applies to the Windows boot manager, as shims are restricted by the SBAT (their version of a SVN mechanism). When the SVN gets bumped, it doesn't change the signing certificate attached to the boot file. The signing cert is the authenticator, but the SVN or BAT is a versioning method.

I'm guessing the update script may not understand what happens with a Ventoy drive (never tested it). The error message indicates a mismatch between the BCD data.

Try the recovery commands in this post:
Computer won't boot and have code 0xc000000f - Microsoft Q&A

Thanks Garlin for your reply.
I managed to "fix" the error "Windows failed to start" by repairing the drive when pressing the update "button" in Ventoy.
I forgot to mention that the Windows ISO in Ventoy dates back from October 2025 with CA 2023 enabled using MS Powershell Script.
I'm updating Windows 10 iso to April 2026, then I'll use MS Powershell Script for CA 2023. I'll let you know if this works with Ventoy.

itsme1 · Apr 21, 2026

After updating SVN to version 8.0, I didn't get the expected SVN 8.0 error message with Ventoy. I'm using Ventoy with MBR and exFAT, default settings.

Download the previous version of Ventoy and update to that version. If that works, update to the latest version of Ventoy.

itsme1 · Apr 21, 2026

Edit previous post.: However, when the SVN is updated, some ISOs on the Ventoy USB drive must also be updated.

Nicolast · Apr 21, 2026

itsme1 said:
After updating SVN to version 8.0, I didn't get the expected SVN 8.0 error message with Ventoy. I'm using Ventoy with MBR and exFAT, default settings.

Download the previous version of Ventoy and update to that version. If that works, update to the latest version of Ventoy.

That didn't work for me.

itsme1 said:
Edit previous post.: However, when the SVN is updated, some ISOs on the Ventoy USB drive must also be updated.

I think that's what I've got to do. But it's a pain to update iso images each time there's a new svn version. I've canceled updating windows 10 iso with April 2026 update, taking several hours to update the iso for 11 indexes, I'll try tomorrow with only 1. Can't find trusted ready made windows 10 iso post October 2025.
I'll use Rufus instead, there's only one file to update (bootx64.efi) on the USB drive.
Thanks

garlin · Apr 21, 2026

One workaround is to temporarily disable Secure Boot during Windows installs. Then re-enable it when you're done.

It beats the game of trying to update your images every time a new boot manager drops.

neldog · Apr 21, 2026

How do we know when a new boot manager is installed?

garlin · Apr 21, 2026

neldog said:
How do we know when a new boot manager is installed?

When the boot manager file version or SVN changes.

This whole thing suffers from poor visibility. Details about bug fixes to the boot manager are hidden in CVE's (standard security notifications), but the average user doesn't read them or even know they exist. The KB release notes don't always advertise these changes.

Try figuring out this page for yourself.
Security Update Guide - Microsoft Security Response Center

There's no current Security Center feature where you can insert a boot drive, and it gives you a health check for it. It would be nice for Windows Update to do something like an onscreen message suggesting you check all of your removable media, whenever the boot manager changes.

For now, you can run the check script after every Patch Tuesday.

neldog · Apr 21, 2026

Thank you so much for your answer. I was fearing this was going to be the answer. This seems to make it somewhat difficult to keep the USB Image backup Boot Media up to date if I am reading this correctly - one is never going to know if the USB stick has the correct boot files. I guess the people with the paid Macrium X are okay but others that are using free programs, some of which are not getting updates to the software, are going to have to be updating their USB stick boot files all the time... and it may be hard to know when, so they will be doing it with every new windows update at the least.

neldog · Apr 21, 2026

garlin said:
For now, you can run the check script after every Patch Tuesday.

I found this out yesterday when I checked my USB stick for the fun of it and was banned. I ran your code to fix it.

Code:

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi D:\EFI\Boot\bootx64.efi

garlin · Apr 21, 2026

I'm not certain the paid Macrium users will have it any better, unless the backup vendors have some plan that resembles this:

1. When you first ask to create a recovery drive, it logs the current SVN number inside the backup software's config.

2. Every time the backup software wakes up to run, it checks the UEFI's SVN number again. If the SVN has changed from the recorded number, then inform the user that a new recovery drive is needed.

3. When the user creates a new recovery drive, log this SVN number to the software's config. Rinse and repeat.

Now because it requires new code, obviously your Macium 8 free users are stranded.

But in theory, a similar solution could be written as an outside script. You write the current SVN down into a file, and every day you check for changes. Every day, because we don't know if everyone installs their Monthly Update on the same day. When the SVN changes, alert the user and then keep nagging them until they run the script to acknowledge they've done the update.

Rinse and repeat.

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Rancho Seldom Siesta

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Rancho Seldom Siesta

My Computers My Computers

At a glance

At a glance

Rancho Seldom Siesta

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer