Solved garlin's PowerShell scripts for updating Secure Boot CA 2023


Dirtyflash said:
There was no need to update the Mosby USB stick as it never boots the device, rather it only appends and amends the UEFI in the NVRAM.
Click to expand...
Okay, good to know. I wasn't sure if I even needed to bother.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 25H2
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo T490 (2020 Hardware)
    CPU
    i7-8565U
    Motherboard
    20N20028US
    Memory
    16GB
    Graphics Card(s)
    Intel UHD Graphics 620
    Sound Card
    Realtec Audio
    Monitor(s) Displays
    ASUS VE248
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung SSD 970 PRO 512GB NVMe
    Internet Speed
    Frontier fiber 1GB
    Browser
    Chrome, Firefox, Edge
    Antivirus
    Norton 360 Deluxe Plus
    Other Info
    Supported hardware, upgraded from Windows 10 Pro to Windows 11 Pro version 24H2 on 06/01/2025 using the Windows 11 ISO file. Used the enablement package to upgrade to version 25H2 on 10/07/2025. Secure boot enabled. Secure Boot CA 2023 updated.
  • Operating System
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Lenovo ThinkCentre M83 (2014 Hardware)
    CPU
    i7-4770 (with SSE4.2, and POPCNT)
    Motherboard
    10AL000GUS
    Memory
    16GB
    Graphics card(s)
    Intel HD Graphics 4600
    Sound Card
    Realtec High Definition Audio
    Monitor(s) Displays
    ASUS VE248
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung SSD 860 PRO 1TB SATA
    Internet Speed
    Frontier fiber 1GB
    Browser
    Chrome, Firefox, Edge
    Antivirus
    Norton 360 Deluxe Plus
    Other Info
    Unsupported hardware, upgraded from Windows 10 Pro (TPM 1.2 & unsupported CPU, but does have SSE4.2, and POPCNT) to Windows 11 Pro version 24H2 on 06/15/2025. Added Registry Key HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup – AllowUpgradesWithUnsupportedTPMOrCPU=1 to allow installation using the Windows 11 ISO file. Used the enablement package to upgrade to version 25H2 on 10/08/2025. Secure boot enabled. Secure Boot CA 2023 updated.
hottroc said:
Sorry that went over my head a little. So please just tell me what I should do? Or nothing? And would this be any factor in my boot problems? Thank you for your help btw, really appreciate your efforts.
Click to expand...
That means you didn't revoke the CA 2011 certs yet. Which would be a good thing, since it could have been a potential blocker to booting. But if you're still have boot problems, it means the reason lies somewhere else.
 

My Computer

System One

  • OS
    Windows 7
jabbado said:
UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Click to expand...
jabbado said:
REQUIRED ACTION
===============

Run the command:
Update_UEFI-CA2023.ps1 -Revoke

Finish the UEFI steps to manually add the [KEK CA 2023] cert, if the script provided instructions.[/CODE]
Click to expand...
You have an unsupported BIOS.

The manual steps (from the README_UEFI.TXT) are to look in your BIOS menu, for an option to manually add a KEK key.

If you find this option, it will provide a list of drive devices and you search the device(s) until you find an \EFI folder. Under the EFI folder will be a "Certs" subfolder. In that folder is a KEK CA 2023 file to import.

Presuming that step goes well, restart Windows. Now run the update script again. If you don't have a KEK manual enrollment option, we need to proceed to deleting all keys first from the BIOS menu. Then restart Windows, and run the update script again.
 

My Computer

System One

  • OS
    Windows 7
garlin said:
If you find this option, it will provide a list of drive devices and you search the device(s) until you find an \EFI folder. Under the EFI folder will be a "Certs" subfolder. In that folder is a KEK CA 2023 file to import.
Click to expand...
Thank you for helping.
Yes the bios has options to enroll keys. But as I mentioned in my OP, there are no files in the 'certs' folder for some reason.
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    Laptop
Try running the update script again, without the -Revoke option. The script should report it's copying the cert files to \EFI\Certs.

After the script is done copying, confirm the .der & .crt files are present on the EFI volume:
Code: 
mountvol S: /s
dir S:\EFI\Certs
mountvol S: /d
 

My Computer

System One

  • OS
    Windows 7
Ok now I'm confused. After mounting the efi partition the certs are there. In the bios I can browse to the cert folder but it shows empty.

bios_secureboot.webp

Those top options can't be changed. But what does "Installed and Locked" mean?
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    Laptop
I believe you want "User Customized Security", otherwise it's locked to the factory defaults.
 

My Computer

System One

  • OS
    Windows 7
@garlin
I waited 24hrs to see if MS task Secure-Boot-Update would update the SVN to 9.0, it didn't
Task runs but always finishes with last run result 0x800706D9
As your check script suggest, I set the AvailableUpdates registry to 0x200 and ran the task again which terminated again with 0x800706D9
Rebooted any way, and it did bump SVN to 9.0
So it does do it's job, but always exits with 0x800706D9
That was on my Dell 3910.

Task has the same result on my Surface Pro 9 but I haven't set AvailableUpdates to 0x200 yet just to see if it will eventually do the SVN bump to 9.0

Any insight on the task result I'm getting... ?
 

My Computer

System One

  • OS
    Windows 11
garlin said:
You may have to create a BIOS password to unlock the advanced options.
Click to expand...
Did that and still can't see a way of enabling custom mode anywhere in the bios. Would I need to reset secureboot to factory settings?
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    Laptop
anchamp65 said:
So it does do it's job, but always exits with 0x800706D9
That was on my Dell 3910.

Task has the same result on my Surface Pro 9 but I haven't set AvailableUpdates to 0x200 yet just to see if it will eventually do the SVN bump to 9.0
Click to expand...
I don't work for MS, and can't tell you why Secure Boot isn't designed that way.

Error code 0x800706D9 is related to RPC not finding a correct endpoint. Meaning the task wanted to work with something else, and failed to.

There's always my update script. It just does the job without flinching: appends the current DBXUpdateSVN.bin's contents when something's missing from the DBX update file.
 

My Computer

System One

  • OS
    Windows 7
jabbado said:
Did that and still can't see a way of enabling custom mode anywhere in the bios. Would I need to reset secureboot to factory settings?
Click to expand...
No, that's not going to help. Are you allowed to use "Erase All Secure Boot Settings"? This should put it into Setup Mode (no certs).

If you can, chose that option. Restart Windows, and run the update script.
 

My Computer

System One

  • OS
    Windows 7
garlin said:
There's always my update script. It just does the job without flinching: appends the current DBXUpdateSVN.bin's contents when something's missing from the DBX update file.
Click to expand...
I know your script does it, and I fully trust your script !!!
I've used and still do on 5 other computers, 3 old laptops and 2 VMs, I never wait for MS on those

I'm just worried that in 12 or 18 months if you move on to something else, if I'm still relying on your script but you stop updating it and it no longer works, I'll be stuck...

That's what's driving my need to see MS do it itself on my Dell 3910 and SP9 Pro
 

My Computer

System One

  • OS
    Windows 11
anchamp65 said:
I know your script does it, and I fully trust your script !!!
I've used and still do on 5 other computers, 3 old laptops and 2 VMs, I never wait for MS on those

I'm just worried that in 12 or 18 months if you move on to something else, if I'm still relying on your script but you stop updating it and it no longer works, I'll be stuck...
Click to expand...
Assuming everyone's finished with Secure Boot certs, the only future changes will be unscheduled releases of the DBX EFI signatures and a new boot manager.

The update script is agnostic, it really doesn't care about what version is present on your PC or pushed out in the SecureBootUpdates folder. It performs a comparison of the DBX file contents and determines if any updates are needed.
​
- Does the DBXUpdate.bin contain EFI signatures missing in the current DBX?​
- Does the DBXUpdateSVN.bin contain a higher SVN?​
- Does the EFI boot manager not match the current version in \Windows\Boot\EFI_EX?​
- Do you have a SkuSiPolicy file on the EFI and does it match the SecureBootUpdates version?​

The only risk is MS does something stupid like changing the binary file formats for "Legacy" and non-Legacy versions. I have no idea why they decided it was necessary to use a proprietary, MS-only encoding scheme where they added extra header bytes. There's an existing UEFI standards spec already for the file format.

MS was nice enough to answer my posted question to them in short order, but unless they do something stupid again, the update scripts should function without my tweaking. In fact the update script was probably the 2nd easiest script to write because it's functionality is so limited. Most of it is safety logic to prevent the script from doing bad things.

In comparison, the check script has to accommodate all sorts of weird and random PC conditions.
 

My Computer

System One

  • OS
    Windows 7
You must log in or register to reply here.

Latest Support Threads

Latest Tutorials

Back
Top Bottom