Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well, Garlin is the last word on this subject, and I would not want to speak for him. But it looks pretty good to me.

I'll see, but Garlin is indeed the undisputed expert on the subject. Thanks anyway. Best regards.

Thierry 83200 said:

Hello,
After running Garlin's latest script, here's what I get. Am I on the right track, or have I missed something? Regards

Click to expand...

As others have said, @garlin is the man, but given what I see in your display, that's what you're supposed to see if everything is updated. I get the same report on all my machines that I've fully updated.

You're all correct that @Thierry 83200's PC is done, including with revocation.

1. The easiest way to know if you're finished:

2. SkuSiPolicy.p7b is only mentioned if VBS is enabled. The policy file doesn't matter when VBS isn't enabled.

Thank you all so much, you're doing a wonderful job and it's fortunate that there are still people like you whose skills far exceed the average. Best regards.

Hi garlin, thanks for the scripts - and I have to say, you sticking will those struggling to complete, offering support and tweaks to help out is incredible - a very rare thing in today's messed up world - thank you very much

grabbed the latest package - late on the 15th - two machines with asus motherboards appear to be happy-ish - one is on win 11, the other on win 10 but not offered Win 11 update - yet all certs and all bios setup seems to be the same as the similar era machine (and yes all stuff on and hardware OK)

but now for the real fun - an old asus laptop is saying a new UEFI CA 2023 cert is there but its un-trusted - do it manually, but if I remember someone locked down the bios security and I can't get at things.... so that's looking difficult

and a Dell inspiron desktop 3688 is doing exactly the same - I've started to understand what I'm trying to do and got brave enough to delete all keys in bios and did as stated, found new cert in efi but wont play ball - if I go round again I end up in a loop

clear keys and it won't boot in secure boot - loops into a dell hardware test feature - cancel that back into bios and try to boot same loop - go back in bios turn off secure boot - windows boots happily and again round the houses - I see the update script switches to trusted but - try to do bios next steps manually and cert ends up not trusted again

an observation I noticed this month - BOTH those last two machines (I guess before d day and the old certs expire) were both booting and doing stuff in secure boot happily - with Windows security showing all green - then after June MS patch Tuesday updates both the same machines now show the yellow warning here




and this info when you check out the offending yellow item



after looping around I have update status back to square one

revoke script and or delete all keys in BIOS achieved nothing (as far as I understood stuff)
can't add new certs manually on the dell - I end up back here



any ideas or next steps appreciated

botus said:

but now for the real fun - an old asus laptop is saying a new UEFI CA 2023 cert is there but its un-trusted - do it manually, but if I remember someone locked down the bios security and I can't get at things.... so that's looking difficult

and a Dell inspiron desktop 3688 is doing exactly the same - I've started to understand what I'm trying to do and got brave enough to delete all keys in bios and did as stated, found new cert in efi but wont play ball - if I go round again I end up in a loop

Click to expand...

Before the June 2026 update, Security Center gave you a green checkmark for simply enabling Secure Boot mode.

MS previously announced that in June, the message would change to reflect that your PC isn't compliant. The reason is MS allowed the PC vendors a grace period of a few months to release last-minute BIOS updates.

Not sure about the Acer, but I have higher confidence that Dell is using a more conventional BIOS. Let's work on it.

1. Disable Secure Boot mode.
2. Reset to Secure Boot factory defaults (we want a known good starting point).
3. Check if we're in Custom mode, if not switch back to Custom mode.
4. Delete all keys.
5. Restart Windows. Run the update script.
6. Assuming the update script completed without errors, you should be able re-enable Secure Boot.

garlin said:

3. Check if we're in Custom mode, if not switch back to Custom mode.

Click to expand...

Custom mode... in bios ? there is an allow you to play mode tick box top left within secure boot features of the BIOS (not sure it ever said custom) but I see their instructions use the word custom (copy below) - and it says if you just reboot - it reloads dell defaults - so tick play mode, do your thing - reboot - immediately go back in BIOS secure boot features, and untick play mode - done it three times earlier been going in circles

Perform the following steps:​

1. Press F2 to enter the BIOS
2. Select Secure Boot
3. Select Expert Key Management
4. Check that the checkbox titled Enable Custom Mode
5. Click the Reset All Key button
6. Click Apply button
7. Click Exit button (click OK to save if prompted)
8. On the next boot, press F2 to enter BIOS
9. Select Secure Boot
10. Select Expert Key Management
11. Clear the checkbox titled Enable Custom Mode
12. Click Apply button
13. Click Exit button (click OK to save if prompted)

from here

to here



and back when after win reboots OK - you reboot the PC again and re-enable secure boot - PC will now boot in secure boot happily but

you get untrusted

on the revoke bit - I'm confused how to apply (although I think it does ) if you just run this in the powershell window and reboot

Update_UEFI-CA2023.ps1 -Revoke


Code:


Successfully appended "dbxupdate.bin" to UEFI DBX.<br>Successfully appended "DBXUpdate2024.bin" to UEFI DBX.<br>Successfully appended "DBXUpdateSVN.bin" (SVN 7.0) to UEFI DBX.<br>Deployed SkuSiPolicy.p7b (for VBS).<br><br>REQUIRED ACTION<br>---------------<br>Restart Windows, for UEFI updates to take effect.

it competes instantaneously you paste the code ?


BIOS type 2

The overriding problem is I don't see the KEK CA 2023 applied (which is the most important cert in this migration). Without the KEK CA 2023 in place, having a CA 2023 boot manager is untrusted.

Can you run the check script using -Verbose added to the command line?

garlin said:

The overriding problem is I don't see the KEK CA 2023 applied (which is the most important cert in this migration). Without the KEK CA 2023 in place, having a CA 2023 boot manager is untrusted.

Can you run the check script using -Verbose added to the command line?

Click to expand...

thanks - but like the revoke bit - I need help to know how / where to add that extra (verbose or revoke) instruction

I was going to write an idiots experience - but life is in the way...

the scripts ending file extension .PS1 to me don't run ? but your bat files call them up and then .PS1 scripts run -

and what does the Clear-UEFI_Lock.bat - do - not tried as I have not seen any instructions as to why we have it ?
it could be I'm a dangerous idiot that part knows...

thanks for putting up with us !

Here's a simpler way (batch file calls the .ps1 for you):

garlin said:

Here's a simpler way (batch file calls the .ps1 for you):

Code:

Check-UEFI.bat -Verbose

Click to expand...

sorry - nope does not compute (in my head) where is that new .bat file ?

You downloaded the ZIP file from post #1? Includes the PS scripts and the matching batch files for them.

If your shell is PS instead of CMD, you need to a ".\" in front of the filename.

sorry - there is clearly a gap in my knowledge - I got your package 14 june 2026 - unless you updated it just now adding a new .bat file and the date is still saying the 14th - I'm out of my depth - I have no idea how to run what is written (by you) in post #2411

Oops, my mistake. I didn't actually upload the final ZIP file to GitHub. There was an error message saying the upload failed.

Should work now: SecureBoot-CA-2023-Updates.v2026.06.08.zip

garlin said:

Oops, my mistake. I didn't actually upload the final ZIP file to GitHub. There was an error message saying the upload failed.

Should work now: SecureBoot-CA-2023-Updates.v2026.06.08.zip

Click to expand...

me or you?

new one is dated 2026.06.08 (earlier) and has no extras ?

I'm going to have to bail for today - thanks again for your support