Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

anchamp65 · 2026-06-16T17:08:29-0400

garlin said:
Someone at MS just submitted KEK files for (7) Surface models. It's mid-June 2026! Sometimes the factory takes forever to make a new sausage.

And Surface is their hardware brand
Hilarious !!!

lilyb88 · 2026-06-16T17:56:01-0400

Hello,

Running an old Dell XPS 8700. Right now, it's Windows 10, but will be upgrading eventually to Windows 11 for compatibility with my main computer. Had some real problems when Microsoft released the Secure Boot update task back in early December (froze the system on every boot until I did a fresh install). Then, when it started running every 11 hours; well, the system files kept getting shredded. I finally disabled the task and started looking at your Powershell scripts. No joy with these, I'm afraid. I get a partial update, but not KEK or PK. I had a couple of questions.
1) I have disabled the Microsoft task. When I run the Update_UEFI-CA2023.ps1 script, it just hangs -- actually the system freezes and I have to do a hard shutdown. I'm pretty sure this is for a different reason (see question #2), but I wanted to double-check that your script would not have issues with the Microsoft Secure-Boot task being disabled in Task Scheduler.

2) The freeze/hang issue has been documented in other forums as being caused by the old NVIDIA graphics cards that these systems came with. Apparently, they are 'signed' with 2011 certificates. I still have to remove the card and test your script again, but wondered if you had any thoughts on this?

Other than that, I agree with the others who have posted. While I have not been able to update, your script has not shredded the system files in the way that the Microsoft task has. And while my system did 'freeze', there was no damage to the system files upon restart after the hard shutdown.

Again, any thoughts on the above would be appreciated.

garlin · 2026-06-16T18:29:49-0400

lilyb88 said:
1) I have disabled the Microsoft task. When I run the Update_UEFI-CA2023.ps1 script, it just hangs -- actually the system freezes and I have to do a hard shutdown. I'm pretty sure this is for a different reason (see question #2), but I wanted to double-check that your script would not have issues with the Microsoft Secure-Boot task being disabled in Task Scheduler.

For applying the certs and updating the boot manager, my script doesn't need the Secure Boot task. But for enabling the SBAT and UEFI lock on SkuSkiSpolicy, it calls the task since those are reserved security operations that only the task can do.

lilyb88 said:
2) The freeze/hang issue has been documented in other forums as being caused by the old NVIDIA graphics cards that these systems came with. Apparently, they are 'signed' with 2011 certificates. I still have to remove the card and test your script again, but wondered if you had any thoughts on this?

You're probably hitting the very serious bug with your GPU having an older signed ROM, and it's not authorized once CA 2011 is banned. This is a known issue in the NVIDIA community, you will find lots of threads on this exact problem.

There's no real good answer, except to hope someone has figured out how to hack your GPU's ROM to re-sign them. Or you will have to swap out the GPU (unless you're stuck with integrated graphics). It's one of those problems where nobody thought about this possibility 15 years ago.

Everyone was thinking about the motherboard's security, and not considering it for GPU's. If you can't find a workaround from the NVIDIA forums, you're screwed and need to leave Secure Boot disabled. It's not ideal, but you have to balance which is more important to you, running this PC or having less system protection.

lilyb88 · 2026-06-16T18:59:43-0400

garlin said:
For applying the certs and updating the boot manager, my script doesn't need the Secure Boot task. But for enabling the SBAT and UEFI lock on SkuSkiSpolicy, it calls the task since those are reserved security operations that only the task can do.

You're probably hitting the very serious bug with your GPU having an older signed ROM, and it's not authorized once CA 2011 is banned. This is a known issue in the NVIDIA community, you will find lots of threads on this exact problem.

There's no real good answer, except to hope someone has figured out how to hack your GPU's ROM to re-sign them. Or you will have to swap out the GPU (unless you're stuck with integrated graphics). It's one of those problems where nobody thought about this possibility 15 years ago.

Everyone was thinking about the motherboard's security, and not considering it for GPU's. If you can't find a workaround from the NVIDIA forums, you're screwed and need to leave Secure Boot disabled. It's not ideal, but you have to balance which is more important to you, running this PC or having less system protection.

Thanks for the quick response. Good to know about the SBAT and "UEFI lock". As it turns out, I can run quite comfortably on the Intel i7's graphic, so I'll be trying to maintain the Secure Boot, but remove the graphics card. After I've done that, I'll give your script a go again with the Microsoft task enabled.

Now that I am retired, I hate to throw out stuff that still works, when I have time to keep it humming. I plan to turn the XPS into my 'graphics' machine for creating genealogical pictures and watching my old movies. So, ultimately, it needn't be internet secure, and I can consider going back to the legacy boot instead of UEFI if need be; or consider spending the money on a supported graphics card.

It's all good. Thanks again.

riverofwind · 2026-06-16T23:58:08-0400

@garlin Thx for the quick response, for leaving the system in custom mode do I have to leave secure boot disabled? And then once I run the script and it applies the replacement certs, I reboot and turn secure boot back on right?

garlin · 2026-06-17T00:01:26-0400

Standard Mode will use the factory defaults, you can't make manual changes and keep it in Standard Mode. Leave it in Custom mode.

You can temporarily leave Secure Boot disabled and restart Windows, so you can run the update & check scripts. If you see the extra certs properly recognized, then you can re-enable Secure Boot. Remember: you can always disable Secure Boot if Windows doesn't boot.

Quandary · 2026-06-17T10:49:52-0400

Successfully removed old certs and SecureBootSVN shows 9.0 for all 3 entries. Running Update -BootMedia reports "No Updates are Required". However Windows complains when booting from the USB with the message "Secure boot version check failed... Current version 7.0, minimum allowed 9.0".

The USB will boot if Secure Boot is turned off in the BIOS, but this is not ideal. Can anything be done to get the USB updated? The same situation happens with some .ISO files on a Ventory USB.

Dirtyflash · 2026-06-17T11:17:34-0400

Quandary said:
Can anything be done to get the USB updated?

Absolutely, been discussed in great depth, easy fix. I'm sure @garlin will show you how.

Asus272 · 2026-06-17T11:22:29-0400

I also have a Dell 8700 it doesn't have TPM 2.0 or 1.2. It has PTT (Platform Trust Technology). I'm leaving mine on Windows 10 and will use it as a local server on my WiFi but not connected to the internet.

garlin · 2026-06-17T11:23:55-0400

Quandary said:
Successfully removed old certs and SecureBootSVN shows 9.0 for all 3 entries. Running Update -BootMedia reports "No Updates are Required". However Windows complains when booting from the USB with the message "Secure boot version check failed... Current version 7.0, minimum allowed 9.0".

The USB will boot if Secure Boot is turned off in the BIOS, but this is not ideal. Can anything be done to get the USB updated? The same situation happens with some .ISO files on a Ventory USB.

Run the update script:

Code:

Update-UEFI.bat -BootMedia

The Secure Boot task will handle updating the boot manager after any Monthly Update for Windows itself. But MS doesn't do anything for USB boot media which may have been created before the boot manager was switched. It's just a matter of swapping out the boot file(s) again.

It's annoying that you have to do this, but get used to it. MS is protecting you from security holes.

botus · 2026-06-17T13:05:06-0400

botus said:
me or you?

new one is dated 2026.06.08 (earlier) and has no extras ?

I'm going to have to bail for today - thanks again for your support

Hi garlin

I'm still lost on this verbose check ?

anchamp65 · 2026-06-17T13:12:52-0400

botus said:
Hi garlin

I'm still lost on this verbose check ?

Hi
Have you ever used cmd.exe, powershell or terminal ?
Just want to know what you are familiar with...

garlin · 2026-06-17T13:25:42-0400

botus said:
Hi garlin

I'm still lost on this verbose check ?

The verbose mode is triggered by adding "-Verbose" to the end of whatever you used to run the check script in the first place.

Either:
.\Check_UEFI-CA2023.ps1 -Verbose
.\Check-UEFI.bat -Verbose

Both the GitHub and post #1 version of the ZIP file should have the full set of both .ps1 and .bat scripts.

anchamp65 · 2026-06-17T14:05:43-0400

garlin said:
The verbose mode is triggered by adding "-Verbose" to the end of whatever you used to run the check script in the first place.

Either:
.\Check_UEFI-CA2023.ps1 -Verbose
.\Check-UEFI.bat -Verbose

Both the GitHub and post #1 version of the ZIP file should have the full set of both .ps1 and .bat scripts.

I think he just double clicked on the bat from explorer and never used cmd or powershell windows on his own
That's what I was trying to figure out with my post

@botus you don't have to feel like an idiot, you just have different knowledge...

lilyb88 · 2026-06-17T15:23:58-0400

Asus272 said:
I also have a Dell 8700 it doesn't have TPM 2.0 or 1.2. It has PTT (Platform Trust Technology). I'm leaving mine on Windows 10 and will use it as a local server on my WiFi but not connected to the internet.

Hey there Asus272; like-minded people putting their old tech to good use.
Dell XPS 8700 does not have TPM but I do have the UEFI secure boot enabled on mine.

Not to go too far on this (since this is a thread for the garlin scripts), did you run into the freezing issues due to the Microsoft Secure-Boot Certificate update task? or have you successfully installed the new 2023 certificates somehow?

garlin · 2026-06-17T15:39:21-0400

Normally, the Secure Boot task shouldn't crash (or freeze) your system because it takes a reboot for the applied changes to take effect. When the certs are applied, extra signed bytes are appended to the existing byte values in the UEFI's NVRAM memory. And the other changes are simple file copies.

It could be:
- You have a defective BIOS chip, and making changes triggers some HW problems. But another identical system doesn't share this problem.

- You have an older BIOS chip, and the extra data is overflowing the limited memory available to store this data. Supposedly this a known problem on some Acer models, but the same engineering problem could be repeated on other PC's using the same chip design.

Most of the time if the cert append fails, Windows returns some error code indicating authentication failure (cert mismatch), or unknown reason. But I haven't any other stories of the update causing a crash while Windows is running. Might be useful to search online if this a documented thing, or you're an unfortunate isolated incident.

Quandary · 2026-06-17T15:48:27-0400

garlin said:
Run the update script:

Code:

Update-UEFI.bat -BootMedia

The Secure Boot task will handle updating the boot manager after any Monthly Update for Windows itself. But MS doesn't do anything for USB boot media which may have been created before the boot manager was switched. It's just a matter of swapping out the boot file(s) again.

It's annoying that you have to do this, but get used to it. MS is protecting you from security holes.

Thanks. I thought that I had done that, but it works now.

How about the updating of .iso boot images on my Ventoy usb?

garlin · 2026-06-17T16:05:04-0400

There are two major points in handling Windows ISO images:

1. Every W10 22H2 or W11 install image has two sets of boot files in the image.
"\Windows\Boot\EFI" contains the legacy CA 2011 boot files, and "\Windows\Boot\EFI_EX" contains the newer CA 2023 boot files.

During install time, Setup will check the current cert status and pick the appropriate folder to copy from. You should use the latest possible image (from MCT or UUP dump), because if you re-install a PC that already finished the CA 2023 migration, your image might have outdated files are blocked by the SVN security restriction.

The SVN is a value provided to indicate what is the lowest version of boot manager allowed to boot. Using an old install image will result in an older boot manager getting copied, and it fails the SVN check. So having an up-to-date image is a must. You can, of course, temporarily disable Secure Boot while installing Windows and choose to deal with updating Windows before re-enabling Secure Boot.

Neither Ventoy or Rufus will advise that your ISO image might be out of date. June 2026 was the last time the boot manager changed. So you should have at least a June image for now. MS might roll out a future boot manager, and you'll have to jump ahead again.

2. When creating any bootable USB media, it must pass Secure Boot checks. This is separate from what's contained in the install image. You can end with various combinations where the boot media passes Secure Boot, but the contained ISO is out of date. Or you have a current ISO, but the boot media fails the check.

We're in a new world where have to keep up, and hopefully some of this awareness gets rolled into Ventoy or other tools. Until then, you can use the check and update scripts in the short term.

neldog · 2026-06-17T16:23:23-0400

garlin said:
We're in a new world where have to keep up, and hopefully some of this awareness gets rolled into Ventoy or other tools. Until then, you can use the check and update scripts in the short term.

Yes, indeed we are... After each Monthly Update I put in my two USB sticks and first run the PowerShell; Check_UEFI-CA2023 -BootMedia scrip, and if it fails, I run the Update script. It's a new second step routine. I'm sure, kind of, that this will just be a temporary needed action.

botus · 2026-06-17T17:05:03-0400

anchamp65 said:
I think he just double clicked on the bat from explorer and never used cmd or powershell windows on his own
That's what I was trying to figure out with my post

@botus you don't have to feel like an idiot, you just have different knowledge...

exactly - thanks for mind reading

then her car broke down and I had to go rescue.....

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Active member

My Computer My Computer

At a glance

New member

Attachments

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Rancho Seldom Siesta

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer