Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Phirevixen · Wednesday at 2:48 PM

Why is it that after every Windows Update I get this SBAT 1796 Event Error even though I am good to go according to the script?

garlin · Wednesday at 3:42 PM

Phirevixen said:
Why is it that after every Windows Update I get this SBAT 1796 Event Error even though I am good to go according to the script?

It's been reported that HP's BIOS doesn't like having the SBAT written to, unlike other vendors' BIOS. The Secure Boot task can't write the SBAT unless Secure Boot mode is enabled. Other than that, I think it's a HP bug that's annoying but doesn't impact your Secure Boot functionality.

DarkShadowMD · Wednesday at 4:38 PM

Yeh, just ignore it, doesn't even prevent linux USBs from booting, I've tested on my HP myself.

garlin · Wednesday at 5:14 PM

Current Linux distros should be good with the SBAT provided by Windows. But the last time MS tried pushing out SBAT, it annoyed a lot of people.

Microsoft shares temp fix for Linux boot issues on dual-boot systems
“Something has gone seriously wrong,” dual-boot systems warn after Microsoft update

Warre1 · Wednesday at 5:57 PM

Latest Linux Mint USB booted in weekend normally.

fernando BARBA · 2026-06-25T13:40:45-0400

hello from Spain,
looking for advice about updating the MS certs in my "old" ASUS from 2016--------
here is the result of the Check_UEFI-CA2023.psi -Verbose script:

Windows 10 21H2 (19044.7417)

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

BIOS Firmware
-------------
ASUSTeK COMPUTER INC. M32CD_A_F_K20CD_K31CD
Version: 1102
Date: 2018-04-12

Factory Default UEFI PK Cert
----------------------------
ASUSTeK MotherBoard PK Certificate

UEFI PK Cert
------------
ASUSTeK MotherBoard PK Certificate
[KEK CA 2023] Update is available from ASUS or Microsoft.

Factory Default UEFI KEK Certs
------------------------------
Microsoft Corporation KEK CA 2011
Canonical Ltd. Master Certificate Authority
ASUSTeK MotherBoard KEK Certificate

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Canonical Ltd. Master Certificate Authority
ASUSTeK MotherBoard KEK Certificate

Factory Default UEFI DB Certs
-----------------------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Canonical Ltd. Master Certificate Authority
ASUSTeK MotherBoard SW Key Certificate
ASUSTeK Notebook SW Key Certificate

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023
Canonical Ltd. Master Certificate Authority
ASUSTeK MotherBoard SW Key Certificate
ASUSTeK Notebook SW Key Certificate

Factory Default UEFI DBX Certs
------------------------------
(NONE)
EFI_CERT_SHA256_GUID Signatures: 77

UEFI DBX Certs
--------------
(NONE)
Windows BootMgr SVN is MISSING.
EFI_CERT_SHA256_GUID Signatures: 339

UEFI Variables
--------------
SBAT (Linux only): sbat,1,2024010900 / shim,4 / grub,3 / grub.debian,4

EFI Files
---------
Boot File [Windows UEFI CA 2023] is UNTRUSTED
\\.\HarddiskVolume6\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.342, SVN 9.0

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

REQUIRED ACTION
===============

Run the command:
Update_UEFI-CA2023.ps1 -Revoke

Finish the UEFI steps to manually add the [KEK CA 2023] cert, if the script provided instructions.

-i am constantly receiving TPM-WMI 1795 errors; it keeps trying to apply the KEK 2023 but refuses it due to "firmware unknown"
-the desktop works just fine, very fine indeed after i installed the Windows 10 Enterprise IoT LTSC and a new SSD hard disk; for my needs is more than enough...
-any advice would be much appreciated,
fernando

garlin · 2026-06-25T13:53:25-0400

fernando BARBA said:
UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Canonical Ltd. Master Certificate Authority
ASUSTeK MotherBoard KEK Certificate

The last BIOS update was 2018, it's an unsupported PC because it's too old.

fernando BARBA said:
-i am constantly receiving TPM-WMI 1795 errors; it keeps trying to apply the KEK 2023 but refuses it due to "firmware unknown"
-the desktop works just fine, very fine indeed after i installed the Windows 10 Enterprise IoT LTSC and a new SSD hard disk; for my needs is more than enough...
-any advice would be much appreciated,

1. Check the Secure Boot menus in the BIOS setup. Do you have an option to switch from Standard to User (or Custom) mode?
2. Do you have the option for manual Secure Boot key enrollment?
3. If not, do you have the option to Delete All Keys?

The first step would be to manually add the missing KEK CA 2023 key if you have a menu option for manual KEK key enrollment. On some BIOS'es, you may have to create an Admin password before unlocking the advanced Secure Boot menus.

Please report what options do you see in your BIOS setup menus.

fernando BARBA · 2026-06-25T14:15:42-0400

garlin said:
The last BIOS update was 2018, it's an unsupported PC because it's too old.

1. Check the Secure Boot menus in the BIOS setup. Do you have an option to switch from Standard to User (or Custom) mode?
2. Do you have the option for manual Secure Boot key enrollment?
3. If not, do you have the option to Delete All Keys?

The first step would be to manually add the missing KEK CA 2023 key if you have a menu option for manual KEK key enrollment. On some BIOS'es, you may have to create an Admin password before unlocking the advanced Secure Boot menus.

Please report what options do you see in your BIOS setup menus.

**********
-if for user mode, you mean deleting all secureboot keys, i´m pretty sure i can make it
-i have tried, through a USB flash drive and the ASUS EZ Flash facility, to "insert" into the BIOS the microsoft corporation kek 2k ca 2023.crt and it resulted in a little disaster (see photo); i reset the CMOS battery and reinstalled the last BIOS version and, happily, everything went back to normal
-so, should i try the Update_UEFI-CA2023.ps1 script previous deleting of the secureboot keys and after, if indicated, try to manually add the KEK CA 2023?
i hope you understand what i mean; i am not an skilled "software" man...,
fernando

garlin · 2026-06-25T14:19:05-0400

The cert file isn't a BIOS firmware image, you cannot use it with the ASUS flash tool.

1. Disable Secure Boot.
2. Delete all keys.
3. Restart Windows. Run the update script, it should recognize you are in Setup Mode (no certs).
4. Run the check script again. You should see KEK CA 2023 listed.
5. Re-enable Secure Boot.

fernando BARBA · 2026-06-25T14:23:51-0400

ok, garlin, i will try as you advise and report the results
thank you very much for your help,
fernando

viatorastrorum · 2026-06-25T16:58:32-0400

garlin said:
1. Keep the BIOS in Custom mode.
2. Delete All Keys.
3. Restart Windows. Run the update script without the -Revoke option (just to simplify it). It should recognize the UEFI is in Setup Mode (no certs).
4. Run the check script, assuming you see a KEK CA 2023 listed; then you can re-run the update script with a revoke.

I came here to thank you for your infinite patience

with us users who aren't tech-savvy when it comes to updating the 2023 certificates through the BIOS. Thanks, man.

iFX_Legacy · 2026-06-25T22:55:41-0400

Id like to thank Garlin for maintaining this nifty little tool.

Im having a little issue now, I have updated the certs and verified that they are updated and also updated my usb windows 11 25h2 install drive. Trying to reinstall windows im hitting a problem where it goes through the initial install phase where you select language, version and drive and after it copies the files on reboot im getting a secure boot validation error where its saying minimum expected version is 9.0 and 7.0 is detected. The shouldn't be the expected behaviour since the certs are all updated. Or am I missing something? Have I missed a step?

Short of disabling secure boot, is there a proper fix for this? Im assuming id have to disable secure boot, install windows fresh, run the script again, then re-enable secure boot... is there a way that I can install windows fresh without all that and maintaining secure boot enabled through this process?

I appreciate your insights

garlin · 2026-06-25T23:25:00-0400

iFX_Legacy said:
Id like to thank Garlin for maintaining this nifty little tool.

Thanks.

iFX_Legacy said:
Im having a little issue now, I have updated the certs and verified thag they are updated and also updated my usb windows 11 install drivem. Trying to reinstall windows im hitting a problem where it goes through the initial install phase and on reboot im getting a secure boot validation error where its saying minimum expected version is 9.0 and 7.0 is detected. Short of disabling secure boot, is there a proper fix for this? Im assuming id have to disable secure boot, install windows fresh, run the script again, then re-enable secure boot... is there a way that I can install windows fresh without all that and maintaining secure boot enabled?

Whenever the Windows boot manager is patched for a security hole, it's replaced by a newer file version and the DBX SVN is bumped at the same time. This security feature guarantees that you cannot go back, and use an older version of the boot manager (which has a known security issue).

The simple fix is to update the USB boot drive's boot manager with a later version that matches the current SVN. You can run the update script with the bootable USB drive plugged in:

Code:

Update-UEFI.bat -BootMedia

The last few instances of when the SVN was changed:

- Oct 2025 (SVN 7.0)

- April 2026 (SVN 8.0)

- June 2026 (SVN 9.0)

To check if your USB media is out of date:

Code:

Check-UEFI.bat -BootMedia

Just remember: there is no fixed schedule for when the boot manager gets updated. It gets replaced whenever a new security bug is reported. So you have to get used to periodically updating the boot file on all of your USB media (Windows ISO or recovery USB). This is the new "normal" so you're better protected from new low-level threats.

iFX_Legacy · 2026-06-25T23:47:15-0400

garlin said:
The simple fix is to update the USB boot drive's boot manager with a later version that matches the current SVN. You can run the update script with the bootable USB drive plugged in:

Code:

Update-UEFI.bat -BootMedia

The last few instances of when the SVN was changed:

- Oct 2025 (SVN 7.0)
- April 2026 (SVN 8.0)
- June 2026 (SVN 9.0)

To check if your USB media is out of date:

Code:

Check-UEFI.bat -BootMedia

Just remember: there is no fixed schedule for when the boot manager gets updated. It gets replaced whenever a new security bug is reported. So you have to get used to periodically updating the boot file on all of your USB media (Windows ISO or recovery USB). This is the new "normal" so you're better protected from new low-level threats.

Hi,

Thanks for the quick reply. DEfinitely good to know that information, if its the new norm, we will deal with it I guess...

I ran those scripts on my other pc with my windows USB install drive. This is what came up.

Code:

Bootable Media
--------------
    USB Drive G: "CCCOMA_X64FRE_EN-GB_DV9"
        Boot File [Windows UEFI CA 2023] is ALLOWED.

        boot.wim:2    Boot Manager [Windows UEFI CA 2023] is PRESENT.
        install.wim:1 Boot Manager [Windows UEFI CA 2023] is PRESENT.
            Skipping checks on next 10 install.wim images.

    USB Drive H: "RUFUS_BOOT"
        Boot File [Microsoft Corporation UEFI CA 2011] is ALLOWED.


REQUIRED ACTION
===============
To REVOKE the [PCA 2011] cert, run the commands:

    manage-bde -Protectors -Disable C: -RebootCount 1
    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x280 /f
    powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

PS C:\zy> .\Update-UEFI.bat -BootMedia
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows

Skipping Third-Party boot media on USB Drive H: "RUFUS_BOOT"
SUCCESS: NO UPDATES ARE REQUIRED.

Just to try and clarify whats happening. I can enable secure boot, and boot to the usb windows installer, after I chose all configuration options and allow the file copy to my SSD to happen, its on the reboot where everything goes south and I get the version error. Is this something to do with the bootable drive, or an issue with the system based on what I copied and pasted above?

Thanks again for your help

garlin · 2026-06-26T00:42:04-0400

In this case, both Rufus and Ventoy choose to use their own boot files, and recreating the USB drive again with the use CA 2023 option should replace the older file.

Unlike Media Creation Tool or the Windows ADK process, Rufus and Ventoy do chain booting, they first boot into their own loader, which mounts the ISO volume and calls the normal Windows boot manager in sequence.

I recent changed the update script to skip drives using a non-MS boot file, because I din’t want to incorrectly guess what type of USB tool created the drive.

iFX_Legacy · 2026-06-26T00:53:47-0400

garlin said:
In this case, both Rufus and Ventoy choose to use their own boot files, and recreating the USB drive again with the use CA 2023 option should replace the older file.

Unlike Media Creation Tool or the Windows ADK process, Rufus and Ventoy do chain booting, they first boot into their own loader, which mounts the ISO volume and calls the normal Windows boot manager in sequence.

I recent changed the update script to skip drives using a non-MS boot file, because I din’t want to incorrectly guess what type of USB tool created the drive.

Interesting, that might be the problem...

I am using the CA 2023 option in rufus, I can try it again to confirm. I have the following checked off as user experience options in rufus

- Remove 4 gb+ ram, secure boot and tpm 2.0
- Remove requirement for online microsoft account
- Create local account with user name _____
- disable data collection
- QoL improvements
-Use windows ca 2023 signed bootloaders

I use rufus because I need the tpm bypass for this system as its a gigabyte ga-x99-ud5 with i7-6900k.

Is there a way around this?

botus · 2026-06-26T03:27:39-0400

garlin said:
It's been reported that HP's BIOS doesn't like having the SBAT written to, unlike other vendors' BIOS. The Secure Boot task can't write the SBAT unless Secure Boot mode is enabled. Other than that, I think it's a HP bug that's annoying but doesn't impact your Secure Boot functionality.

my mum's HP machine got a new bios offered late Jan 2026 - actual date was 19/Dec/2025 and they just released another claiming they released it in April (but they didn't) its now on F.52 Rev A 29/Apr/2026

Monika1491 · 2026-06-26T05:28:35-0400

iFX_Legacy said:
Interesting, that might be the problem...

I am using the CA 2023 option in rufus, I can try it again to confirm. I have the following checked off as user experience options in rufus

- Remove 4 gb+ ram, secure boot and tpm 2.0
- Remove requirement for online microsoft account
- Create local account with user name _____
- disable data collection
- QoL improvements
-Use windows ca 2023 signed bootloaders

I use rufus because I need the tpm bypass for this system as its a gigabyte ga-x99-ud5 with i7-6900k.

Is there a way around this?

Bypass

When selecting languages: Shift + F10 = CMD
regedit
HKLM\SYSTEM\Setup\
New key LabConfig
In the LabConfig key, new DWORD values:
BypassCPUCheck 1
BypassRAMCheck 1
BypassTPMCheck 1
BypassSecureBootCheck 1
BypassStorageCheck 1
BypassDiskCheck 1

Local account

HideOnlineAccountScreens method
in OOBE when selecting language SHIFT + F10 (cmd) and:
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE /v HideOnlineAccountScreens /t REG_DWORD /d 1 /f
If the device is without internet then:
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE /v HideWirelessSetupInOOBE /t REG_DWORD /d 1 /f

BypassNRO method
when the internet is disconnected and when selecting language in OOBE (or if it is impossible to continue) SHIFT + F10 (cmd) and:
OOBE\BypassNRO
or
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE /v BypassNRO /t REG_DWORD /d 1 /f
shutdown /r /t 0

Celery · 2026-06-26T08:56:10-0400

Monika1491 said:
Bypass

When selecting languages: Shift + F10 = CMD
regedit
HKLM\SYSTEM\Setup\
New key LabConfig
In the LabConfig key, new DWORD values:
BypassCPUCheck 1
BypassRAMCheck 1
BypassTPMCheck 1
BypassSecureBootCheck 1
BypassStorageCheck 1
BypassDiskCheck 1

You can bypass the Windows 11 system requirements check during a clean installation as follows.

Create a .reg file with the following content:

Code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\Setup\LabConfig]
"BypassTPMCheck"=dword:00000001
"BypassSecureBootCheck"=dword:00000001
"BypassRAMCheck"=dword:00000001

- Copy this file to your Windows 11 installation USB flash drive.
- Boot from a Windows 11 installation USB flash drive.
- When you reach the "Select setup option" screen, press Shift + F10 to open Command Prompt. On some laptops, you may need to press Shift + Fn + F10.
- Type regedit and press Enter to open the Registry Editor.
- In Registry Editor, click File > Import, locate your .reg file on the USB flash drive, and select it.
- Close the Registry Editor and the Command Prompt.

Monika1491 said:
Local account

HideOnlineAccountScreens method
in OOBE when selecting language SHIFT + F10 (cmd) and:
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE /v HideOnlineAccountScreens /t REG_DWORD /d 1 /f
If the device is without internet then:
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE /v HideWirelessSetupInOOBE /t REG_DWORD /d 1 /f

BypassNRO method
when the internet is disconnected and when selecting language in OOBE (or if it is impossible to continue) SHIFT + F10 (cmd) and:
OOBE\BypassNRO
or
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE /v BypassNRO /t REG_DWORD /d 1 /f
shutdown /r /t 0

If you want to set up a local account, run the start ms-cxh:localonly command on the "Want to add a second keyboard layout?" screen. It works regardless of whether you're connected to the internet.

Clean Install Windows 11

This tutorial will show you step by step on how to clean install Windows 11 at boot on your PC with or without an Internet connection and setup with a local account or Microsoft account. Windows 11 has all the power and security of Windows 10 with a redesigned and refreshed look. It also comes...

www.elevenforum.com

gunrunnerjohn · 2026-06-26T09:53:43-0400

garlin said:
To check if your USB media is out of date:

Code:

Check-UEFI.bat -BootMedia

Just remember: there is no fixed schedule for when the boot manager gets updated. It gets replaced whenever a new security bug is reported. So you have to get used to periodically updating the boot file on all of your USB media (Windows ISO or recovery USB). This is the new "normal" so you're better protected from new low-level threats.

Thanks for the reminder, my Acronis and Windows Recovery disk were indeed out of date!

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Peaceful Citizen

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

Attachments

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Member

Attachments

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computers