Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

garlin · Jun 9, 2026

Please re-download the update script. I just realized I submitted the old May version instead of the June 8 version.
GitHub and the ZIP file have been refreshed.

Run the update script in -Revoke mode.

The update script by itself will never perform a revoke action, because not everyone wants that. I'll probably have to add a check that if you're already revoked, to auto-apply new revocation updates.

Ed Tittel · Jun 9, 2026

Just ran mine on a couple of test machines (one Lenovo, one ASUS). Both remain completely clean and up-to-date. Used yesterday's (06/08/2026) script versions.
--Ed--

Asus272 · Jun 9, 2026

AUDIT REPORT
============
1. [Microsoft Option ROM UEFI CA 2023] is missing from UEFI DB
2. [Production PCA 2011] is missing from UEFI DBX
3. DBX Updates are missing from UEFI DBX
4. SecureBootUpdates SVN is higher than UEFI DBX

[OPTIONAL] SkuSiPolicy.p7b (for VBS) is missing from EFI

REQUIRED ACTION
===============

Mine was on version 8.0 before todays Microsoft Security Update KB5094126 now it's on 9 but not in UEFI DBX.

Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.342, SVN 9.0

Klaver7 · Jun 9, 2026

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.342, SVN 9.0

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

SkuSiPolicy.p7b is CURRENT.
\\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
Version: 3.0.0.15

STATUS REPORT
-------------
Registry: "UEFICA2023Status" = Updated

SUCCESS: UPDATES ARE FINISHED.
UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

Ok we are back to "normal"

Klaver7 · Jun 9, 2026

Asus272 said:
AUDIT REPORT
============
1. [Microsoft Option ROM UEFI CA 2023] is missing from UEFI DB
2. [Production PCA 2011] is missing from UEFI DBX
3. DBX Updates are missing from UEFI DBX
4. SecureBootUpdates SVN is higher than UEFI DBX

[OPTIONAL] SkuSiPolicy.p7b (for VBS) is missing from EFI

REQUIRED ACTION
===============

Mine was on version 8.0 before todays Microsoft Security Update KB5094126 now it's on 9 but not in UEFI DBX.

Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.342, SVN 9.0

You dont have this:

Code:

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 9.0
    EFI_CERT_SHA256_GUID Signatures: 448

Warre1 · Jun 9, 2026

todays updates updated svn. had to update usb.

thanks for great feature garlin!

garlin · Jun 9, 2026

From the MS GitHub, SVN has been bumped to 9.0 and 11 new EFI signatures were added to DBX.

TheVisitor · Jun 9, 2026

After today's update I'm getting this error. I've just redownloaded the update from github , re-ran this script still get this:

SkuSiPolicy.p7b Version: 3.0.0.14 is WRONG VERSION.
\\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
Version: 3.0.0.14

SkuSiPolicy.p7b is WRONG VERSION.

REQUIRED ACTION
===============

[OPTIONAL] To update SkuSiPolicy.p7b, run the command:
Update_UEFI-CA2023.ps1 -SkuSiPolicy

PS C:\WINDOWS\system32> Update_UEFI-CA2023.ps1 -SkuSiPolicy
Update_UEFI-CA2023.ps1 : The term 'Update_UEFI-CA2023.ps1' is not recognized as the name of a cmdlet, function, script
file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct
and try again.
At line:1 char:2
+ Update_UEFI-CA2023.ps1 -SkuSiPolicy
+ ~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Update_UEFI-CA2023.ps1:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException

garlin · Jun 9, 2026

You probably need the full path for Update_UEFI-CA2023.ps1:

Code:

\your\download_folder\Update_UEFI-CA2023.ps1 -Revoke -SkuSiPolicy

TheVisitor · Jun 9, 2026

@garlin thanks, that fixed it.

anchamp65 · Jun 9, 2026

Ran June update and also got this

UEFI DBX Certs
--------------
Microsoft Windows PCA 2010
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 8.0

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

[OPTIONAL] SkuSiPolicy.p7b (for VBS) is MISSING.

REQUIRED ACTION
===============
To update the DBX SVN, run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

@garlin
Shouldn't MS update it itself from now on and not require us to run your update script every time ?

UPDATE: Just rebooted twice to see if MS would do it on its own. I'll wait a day or two and see if scheduled task once triggered will do it. For now registry AvailableUpdates still shows "0x0".

garlin · Jun 9, 2026

anchamp65 said:
Shouldn't MS update it itself from now on and not require us to run your update script every time ?

UPDATE: Just rebooted twice to see if MS would do it on its own. I'll wait a day or two and see if scheduled task once triggered will do it. For now registry AvailableUpdates still shows "0x0".

The Secure Boot tasks runs every 12 hours, so it should update everything within 24 hrs of installing June 2026 Monthly.

My update script is still useful if you rather not sit around, waiting for it.

DarkShadowMD · Jun 9, 2026

Well I just ran the scripts, I'm updated to SVN 9.0, and my USB is too.
I can feel safe.
These scripts are godsend!!

hvoqasimo · Jun 10, 2026

After running June update got SecureBootSVN 9.0 updated

S C:\Users\asimo> get-SecureBootSVN
FirmwareSVN : 9.0
BootManagerSVN : 9.0
StagedSVN : 9.0
ComplianceStatus : Compliant (Boot Manager SVN meets staged SVN)
BootManagerPath : \\.\HarddiskVolume2\EFI\Microsoft\Boot\bootmgfw.efi

hvoqasimo · Jun 10, 2026

hvoqasimo said:
After running June update got SecureBootSVN 9.0 updated

S C:\Users\asimo> get-SecureBootSVN
FirmwareSVN : 9.0
BootManagerSVN : 9.0
StagedSVN : 9.0
ComplianceStatus : Compliant (Boot Manager SVN meets staged SVN)
BootManagerPath : \\.\HarddiskVolume2\EFI\Microsoft\Boot\bootmgfw.efi

This has also been updated.

a--- 10-6-2026 07:35 17252 dbxupdateLegacy.bin
-a--- 10-6-2026 07:35 3432 DBXUpdateSVN.bin
-a--- 10-6-2026 07:35 3524 DBXUpdateSVNLegacy.bin
-a--- 10-6-2026 07:35 912202 KEKUpdateCombined.bin
-a--- 15-9-2025 21:45 45 SbatLevel.txt
-a--- 10-6-2026 07:35 16088 SKUSiPolicy.P7b

JamesSmith · Jun 10, 2026

garlin said:
The Secure Boot tasks runs every 12 hours, so it should update everything within 24 hrs of installing June 2026 Monthly.

My update script is still useful if you rather not sit around, waiting for it.

Thanks for testing this. I have my PC with the June update. I am now waiting 24 hours to see if MS updates SVN and SkuSiPolicy.

garlin · Jun 10, 2026

hvoqasimo said:
This has also been updated.

-a--- 10-6-2026 07:35 17252 dbxupdateLegacy.bin
-a--- 10-6-2026 07:35 3432 DBXUpdateSVN.bin
-a--- 10-6-2026 07:35 3524 DBXUpdateSVNLegacy.bin
-a--- 10-6-2026 07:35 912202 KEKUpdateCombined.bin
-a--- 15-9-2025 21:45 45 SbatLevel.txt
-a--- 10-6-2026 07:35 16088 SKUSiPolicy.P7b

DBXUpdate got 11 more EFI signatures
DBXUpdateSVN moved from 8.0 to 9.0
KEKUpdateCombined.bin contains all of the OEM-signed KEK CA 2023 files in one blob, it grows as OEM's submit more signed KEK's.
SkuSiPolicy.p7b moved from 3.0.0.14 to 3.0.0.15

ConfidenceLevelData.cab should shift more BucketID's from category "More Data Needed" to "High Confidence". This is pretty much near the end of the line; if you're not in the High Confidence by now, your PC will probably never been supported for automatic updates. It's time for manual intervention.

hvoqasimo · Jun 10, 2026

garlin said:
DBXUpdate got 11 more EFI signatures
DBXUpdateSVN moved from 8.0 to 9.0
KEKUpdateCombined.bin contains all of the OEM-signed KEK CA 2023 files in one blob, it grows as OEM's submit more signed KEK's.
SkuSiPolicy.p7b moved from 3.0.0.14 to 3.0.0.15

ConfidenceLevelData.cab should shift more BucketID's from category "More Data Needed" to "High Confidence". This is pretty much near the end of the line; if you're not in the High Confidence by now, your PC will probably never been supported for automatic updates. It's time for manual intervention.

Thank you @garlin for all your support, I'm on category ""High Confidence" from previous update in May

garlin · Jun 10, 2026

Here's the key takeaway:

Confidence level is only intended for folks who don't self-update their certs. It's how Windows decides whether the Secure Boot task updates your PC or not. After you've have updated the certs, this reported value is entirely irrelevant.

It's not based on your current PC status, but a pre-determined conclusion that MS arrived on by gathering telemetry for similar model PC's.

An updated PC can still report as "More Data Needed" because MS doesn't have enough data to convince itself it's safe. So I tell people to just ignore Confidence level unless you're holding out hope that your OEM might ship a late KEK update. Some vendors still are (Acer is supposed to be releasing a batch of BIOS updates in June).

If you don't understand what "confidence" refers to, then you're going to draw the wrong conclusions. This is why my scripts never bother to report the Confidence Level. I see a ton of scripts refer to it, like it's some magic value.

It's not, it's just the go ahead signal for automatic updates. Once your certs are updated by whatever means, you should ignore any references to Confidence and Buckets. Your confidence level is only determined by looking up your PC's signature in the Monthly Update's released CAB file.

ryan190123 · Jun 10, 2026

-TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
I dont have this task? thoughts?

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Peaceful Citizen

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computers

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer