Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Klaver7 · 2026-06-08T15:50:55-0400

Code:

Windows 11 25H2 (26200.8457)
VBS: ON

Policy File: "\\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b" is ENFORCED
Version: 3.0.0.14

Filename                                           FileVersion Status
--------                                           ----------- ------
C:\Windows\System32\winload.efi                    26100.8457  ALLOWED
\harddisk0\partition4\Recovery\WindowsRE\Winre.wim 26100.8455  ALLOWED

I can live with temp. disable Secure Boot in worst case scenario.

And thank you again for all your hard work and patience !

anchamp65 · 2026-06-08T17:32:58-0400

Klaver7 said:

Code:

mountvol z: /s
copy /y z:\EFI\Boot\bootx64.efi f:\EFI\Boot\bootx64.efi
copy /y z:\EFI\Microsoft\Boot\bootmgfw.efi f:\EFI\Microsoft\Boot\bootmgfw.efi
mountvol z: /d

And you do this to fix Macrium rescue media for which part, wrong cert or SkuSiPolicy ?

It's probably obvious for you and Garlin... LOL

anchamp65 · 2026-06-08T17:34:56-0400

Klaver7 said:
And thank you again for all your hard work and patience !

I so totally agree with you !!!
Thanks for all you work @garlin !!!

DarkShadowMD · 2026-06-08T17:36:32-0400

anchamp65 said:
And you do this to fix Macrium rescue media for which part, wrong cert or SkuSiPolicy ?

It's probably obvious for you and Garlin... LOL

That fix boot problems, ala "Security violation" and similar, in short, updates the boot manager so Secure Boot doesn't block it when it atempts to boot your rescue media.

anchamp65 · 2026-06-08T18:46:26-0400

DarkShadowMD said:
That fix boot problems, ala "Security violation" and similar, in short, updates the boot manager so Secure Boot doesn't block it when it atempts to boot your rescue media.

That I could figure out but, like I wrote, which part, certs or SkuSiPolicy ?

DarkShadowMD · 2026-06-08T18:50:06-0400

anchamp65 said:
That I could figure out but, like I wrote, which part, certs or SkuSiPolicy ?

Only Certs, SkuSiPolicy is updated for the OS only. Still I see what you are asking. Updating the boot files in the USB rescue media also helps to not trigger security violations when you also update SkuSiPolicy in your main OS drive. In short, you should be safe, by experience.

anchamp65 · 2026-06-08T22:41:47-0400

DarkShadowMD said:
Only Certs, SkuSiPolicy is updated for the OS only. Still I see what you are asking. Updating the boot files in the USB rescue media also helps to not trigger security violations when you also update SkuSiPolicy in your main OS drive. In short, you should be safe, by experience.

And reading your answer made me realize that I haven't yet fully absorbed all that Garlin explained...

Everytime Garlin mentioned about finding the good wim file or the good bootx64.efi, or the bootmgfw.efi it was never about SkuSiPolicy. It was always about having the properly signed files, so certificates.

So in retrospec, I understood the mecanics that Garlin explained, but I clearly don't master it yet

hottroc · 2026-06-09T12:32:53-0400

anchamp65 said:
One last attempt...

When you first come into the BIOS, you should be in EZ Mode and press F7 to go to Advanced Mode
Or you go directly to Advanced Mode if the BIOS is capable of remembering which mode you last went to
In any case, you need to be in EZ Mode and you can toggle between the 2 modes using F7

There are actually 2 "reset" BIOS available, and so far I think you have always used "Load Optimized Defaults" in Advanced Mode
The other is "Default" available while in EZ Mode

Load Optimized Defaults uses basic settings designed to get the most out of your installed hardware
Default is the actual factory defaults for the motherboard and that's the one you need to use

So try the Default from EZ Mode, it should be F5 like in the image lower I found on the web
You might have to reload the certs afterwards, but I think your getting pretty good at it by now...

If it's still not working, do these step and never booting into windows in between steps

Reflash BIOS

Power off

Clear CMOS and after that go directly into the BIOS

In BIOS EZ Mode, redo defaults (F5)

Now you can boot to Windows

Again, you might have to reload the certs afterwards

If either of these 2 technics work, you can then do the "Load Optimized Defaults" in Advanced Mode if you want
It won't impact what you did with "Default" (F5)

I really hope for you this will finally work...

View attachment 172766

Thanks for the reply and sorry for the delay, I've been away from home.

Unfortunately that suggestion made little difference.

HOWEVER I have discovered that I CAN boot with boot mode set to "UEFI boot" and hence Secure Boot enabled.... providing "Intel (VMX) Virtualization Technology" is Disabled. It seems to be one or the other. Currently I have virtualization enabled as it's probably more important to me than Secure Boot but ideally I'd like both. Would this be anything to do with the SkuSiPolicy thing or the UEFI Lock or is this just definitely a BIOS conflict that I will have to live with (Asus is unlikely to provide a later BIOS than I have)?

anchamp65 · 2026-06-09T12:40:04-0400

hottroc said:
Unfortunately that suggestion made little difference.

Sorry to ear that...

hottroc said:
Would this be anything to do with the SkuSiPolicy thing or the UEFI Lock or is this just definitely a BIOS conflict that I will have to live with (Asus is unlikely to provide a later BIOS than I have)?

I can't answer this, Garlin probably can
But you can check if SkuSiPolicy is applied on your computer with Garlin's check script
Here is the ouput of one of my computers that does not have SkuSiPolicy applied
So if you have the same line I colored in red, then you don't have SkuSiPolicy installed on that computer

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

[OPTIONAL] SkuSiPolicy.p7b (for VBS) is MISSING.

garlin · 2026-06-09T12:43:44-0400

Secure Boot certs will work on all PC's regardless of CPU technology, they're just signed arrays of bytes used to authenticate boot files. Some BIOS'es are reported to have known bugs when using custom keys (anything that's not a factory default).

Intel VMX wouldn't impact Secure Boot certs, but having VMX allows you to enable Virtualization Based Security (VBS). If you have VBS, then it will enforce a SkuSiPolicy if you have one deployed. You can try this first:

1. Disable Secure Boot mode.

2 . Restart Windows, check for an EFI copy of SkuSiPolicy.p7b and remove it:

Code:

mountvol S: /s
dir S:\EFI\Microsoft\Boot\SkuSiPolicy.p7b

del S:\EFI\Microsoft\Boot\SkuSiPolicy.p7b
mountvol S: /d

3. Shutdown Windows. Enable Secure Boot mode.

The only protection that SkuSiPolicy adds (right now) is to prevent a downgrade attack of the winload.efi, by banning specific (older) versions of the file. The idea is an attacker could substitute a file version which has a known security hole.

anchamp65 · 2026-06-09T13:05:35-0400

Yet another question for you @garlin

Code:

mountvol z: /s
copy /y z:\EFI\Boot\bootx64.efi f:\EFI\Boot\bootx64.efi
copy /y z:\EFI\Microsoft\Boot\bootmgfw.efi f:\EFI\Microsoft\Boot\bootmgfw.efi
mountvol z: /d

This copies both the boot manager efi file (bootmgfw.efi) and the arch specific boot efi file (bootx64.efi).
Your update script copies the boot manager from "$env:SystemRoot\Boot\EFI_EX\bootmgfw_EX.efi" just like in Klaver7's code
But you use "'bcdboot' -ArgumentList "$env:SystemRoot /s $DriveLetter /f UEFI /bootex" -NoNewWindow -Wait" for the arch specific boot efi file

Is bcdboot doing more then just copiing the file or if it does it in a more fail safe way of copiing the arch specific file ?

garlin · 2026-06-09T13:26:41-0400

There are two different USB boot drive types, depending on what's required: WinPE or WinRE.

WinPE mostly cares about the single boot file "\EFI\Boot\bootx64.efi".
WinRE distributes a boot folder "\EFI\Microsoft\Boot", containing the boot manager bootmgfw.efi.

In reality, they're the same executable file but renamed. For WinRE, the boot folder contains additional resources like fonts, and (non-SkuSiPolicy) policy files. If you update the boot folder, the proper way is to use bcdboot (since that's what bcdboot is designed to do). Technically you could just copy the minimum files to get the job done, but it's frowned on by IT admins.

When a bootable drive is built using WinRE (instead of WinPE), it's done for a specific reason. So you're supposed to have the right versions of the files available. All of the source files live under "\Windows\Boot\EFI" (CA 2011) or "\Windows\Boot\EFI_EX" (CA 2023).

One catch is if you're using bcdboot, it wants to update the BCD store entries and sometimes you don't want that. Which is why the MS docs instruct you to backup the BCD file on the target volume and restore it after running bcdboot. This copies the files without altering the original BCD settings.

anchamp65 · 2026-06-09T13:35:56-0400

garlin said:
There are two different USB boot drive types, depending on what's required: WinPE or WinRE..........................

Once more, thank you for explaining it !
Building my knowledge one post at a time

suatcini54 · 2026-06-09T13:37:52-0400

@garlin After I installed patch Tuesday, I ran CA 2023 check script and I got this on my fully secure boot updated PC:

garlin · 2026-06-09T13:42:35-0400

I haven't downloaded June 2026, but I suspect MS has patched boot manager again:

Code:

5089549.csv:"bootmgfw_EX.efi","10.0.28000.326","07-May-2026","03:36","3,034,464"
5089549.csv:"bootmgfw_EX.efi","10.0.28000.326","07-May-2026","03:33","3,010,440"
5094126.csv:"bootmgfw_EX.efi","10.0.28000.342","06-Jun-2026","14:48","3,080,072","263962E2CFC375D0B59E100BA1746249526E41B0","23571BD5D006FCAF59F7FE7F655DA96B75B09471402212A69417816E6CE08BF1"
5094126.csv:"bootmgfw_EX.efi","10.0.28000.342","06-Jun-2026","14:12","3,055,456","5595864C96590CEC906279E5C6045FFF895D2607","200D1E3A6A0DE342A5091654C0E62A434E38D467ADD78057B60A1FDBFC8EF101"

Run the update script, I bet it will replace the boot manager for you. Time to rebuild your USB drives again!!

garlin · 2026-06-09T13:52:06-0400

Reviewing June's CVE's it looks like they patched the boot manager across all supported W10/11 platforms.

I've commented before, there is no established schedule for replacing the boot manager file.

Whenever someone reports a security hole, MS has to fix it. You must replace both the boot manager and install a new DBX SVN number (guessing 9.0, because I haven't downloaded June 2026 yet) to prevent April 2026's boot manager file from being re-used. Because of MS's rules for Patch Tuesday, they cannot reveal ahead of time that they're fixing the security hole until the patch gets released to everyone in the world (at the same time).

The disclosure policy to make sure all non-MS customers are treated equally. No government or corporate client can get the update any earlier than anyone else, nor any ~~blackhat~~ security researcher who wants to reverse-engineer the security fixes to determine what was fixed.

suatcini54 · 2026-06-09T13:52:18-0400

garlin said:

I haven't downloaded June 2026, but I suspect MS has patched boot manager again:

Code:

5089549.csv:"bootmgfw_EX.efi","10.0.28000.326","07-May-2026","03:36","3,034,464"
5089549.csv:"bootmgfw_EX.efi","10.0.28000.326","07-May-2026","03:33","3,010,440"
5094126.csv:"bootmgfw_EX.efi","10.0.28000.342","06-Jun-2026","14:48","3,080,072","263962E2CFC375D0B59E100BA1746249526E41B0","23571BD5D006FCAF59F7FE7F655DA96B75B09471402212A69417816E6CE08BF1"
5094126.csv:"bootmgfw_EX.efi","10.0.28000.342","06-Jun-2026","14:12","3,055,456","5595864C96590CEC906279E5C6045FFF895D2607","200D1E3A6A0DE342A5091654C0E62A434E38D467ADD78057B60A1FDBFC8EF101"

Run the update script, I bet it will replace the boot manager for you. Time to rebuild your USB drives again!!

Thanks. Before doing anything else, I ran this command for Winload.efi and the result is surprising:

suatcini54 · 2026-06-09T14:18:43-0400

After updating my HP notebook PC and running the check script, I got a different result:

Klaver7 · 2026-06-09T14:30:52-0400

Updated June also, anybody ran the Update script and the outcome was ok ?
Man I get to redo my USB rescue media again, ho how much fun

btw. I got the same output as suatcini54 on the Check part.

Scott · 2026-06-09T14:39:13-0400

suatcini54 said:
After updating my HP notebook PC and running the check script, I got a different result:

This fixed mine.

Code:

mountvol S: /s

copy /y C:\Windows\System32\SecureBootUpdates\SKUSiPolicy.P7b S:\EFI\Microsoft\Boot\SkuSiPolicy.p7b

mountvol S: /d

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Member

My Computer

Member

My Computer

Member

My Computer

Peaceful Citizen

My Computers

Member

My Computer

Peaceful Citizen

My Computers

Member

My Computer

New member

My Computer

Member

My Computer

Well-known member

My Computer

Member

My Computer

Well-known member

My Computer

Member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Member

My Computer

Well-known member

My Computers