Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Celery:​

Yes, there are more ways to solve it.
But you don't have to write it to me, I'm technically proficient, write it to iFX_Legacy

fernando BARBA said:

ok, garlin, i will try as you advise and report the results
thank you very much for your help,
fernando

Click to expand...

Use O&O 10 Shutup Secure Boot Status tab to verify your 2023 Secure Boot certificates were installed and you're good to go.

@Celery, you have Rufus to simplify all of that.

But not everyone's using the "CA 2023" option, or realizing the key point: if the boot manager changes after a Monthly Update (like in June 2026), then you need to run MCT or UUP dump to get a newer image which matches the last time the boot manager (and SVN) changed.

Technically you could just copy the bare minimum files, but if there are security changes for Windows, you should get all of them.

@iFX_Legacy
Since my post in which I gave you detailed advice was deleted, I'll simplify it again.
The solution to your problem with SVN 7 is the current installation media with June Windows 11 25H2 26200.8655 or 26200.8737, because June Windows 11 has efi files with SVN 9.
= bootmgfw_EX.efi must be SVN 9 (install.wim/boot.wim)

NormanF said:

Use O&O 10 Shutup Secure Boot Status tab to verify your 2023 Secure Boot certificates were installed and you're good to go.

Click to expand...

O&O doesn't inform you about SVN, after the CA 2023 certs have been installed.
If you like the product so much, why don't you make a feedback suggestion to add this feature?



A PC can be updated to CA 2023, and yet fail the SVN test because of a mismatch over boot manager versions.

Users won't begin to experience issues with SVN until the CA 2011 revocation has been done. Which not everyone has elected to revoke, since MS hasn't made it mandatory yet.

garlin said:

O&O doesn't inform you about SVN, after the CA 2023 certs have been installed.
If you like the product so much, why don't you make a feedback suggestion to add this feature?

View attachment 175251

A PC can be updated to CA 2023, and yet fail the SVN test because of a mismatch over boot manager versions.

Users won't begin to experience issues with SVN until the CA 2011 revocation has been done. Which not everyone has elected to revoke, since MS hasn't made it mandatory yet.

Click to expand...

SVN isn't exposed to the end user. Microsoft is going to revoke the old certificates eventually and for the moment, while I have the 2023 installed, they haven't been activated yet.

There are reasons SVN isn't visible:

Why Microsoft hides SVN​

Three reasons:

A. Prevent rollback tampering​

If users could see or modify SVN, attackers could too.

B. OEM variability​

Different firmware vendors implement SVN differently.

C. Avoid support nightmares​

Imagine millions of users asking why their SVN is “wrong.”

Microsoft avoids this by hiding it.

Windows Security doesn't display it. Run this command as Admin:

FirmwareSVN <-- UEFI's current value
BootManagerSVN <-- boot manager's current value
StagedSVN <-- latest possible value from \Windows\System32\SecureBootUpdates\DBXUpdateSVN.bin, if you haven't applied revocation or recent Secure Boot updates

To check the boot file on an USB device:

Monika1491 said:

@iFX_Legacy
Since my post in which I gave you detailed advice was deleted, I'll simplify it again.
The solution to your problem with SVN 7 is the current installation media with June Windows 11 25H2 26200.8655 or 26200.8737, because June Windows 11 has efi files with SVN 9.
= bootmgfw_EX.efi must be SVN 9 (install.wim/boot.wim)

Click to expand...

Im saw the post before I went to bed and noticed it was gone today. Im assuming because it was linking to an unofficial site for iso images?

Im a little weary about scripts and using unknown downloads. Your overall diagnosis makes sense though.

Rufua simplifies all.those other operations, unless theres a reason I shouldn't use that... can I manually add the latest cumulative update to the last official.microsoft iso and then just use rufus?

I searched Google but it seems some of the articles referencing how to manually do this are a bit out of date... can you guide me through that?

Thank you again for your help.

garlin said:

@Celery, you have Rufus to simplify all of that.

But not everyone's using the "CA 2023" option, or realizing the key point: if the boot manager changes after a Monthly Update (like in June 2026), then you need to run MCT or UUP dump to get a newer image which matches the last time the boot manager (and SVN) changed.

Technically you could just copy the bare minimum files, but if there are security changes for Windows, you should get all of them.

Click to expand...

Thank you so much...this makes sense.

So does this mean that using the rufus check box for CA 2023 incorporates the certs but doesnt fix the SVN issue?

How does one do this? Im assuming this is the same solution as Monika mentioned? Injectinging the latest cumulative update into Microsoft iso? I haven't used MCT ot UUP dump before.

iFX_Legacy said:

Thank you so much...this makes sense.

So does this mean that using the rufus check box for CA 2023 incorporates the certs but doesnt fix the SVN issue?

How does one do this? Im assuming this is the same solution as Monika mentioned? Injectinging the latest cumulative update into Microsoft iso? I haven't used MCT ot UUP dump before.

Click to expand...

I would still use Rufus for everything except 2023 certs, simpler then command line or registry fixes.
Then use Garlin's check with -bootmedia and -noskip so it checks all install images
Then use Garlin's update with -bootmedia
And rerun check with -bootmedia and -noskip to see if they all got fixed

I would try this first...

I would test it myself, but no time to do all this today or this week-end...

iFX_Legacy said:

Thank you so much...this makes sense.

So does this mean that using the rufus check box for CA 2023 incorporates the certs but doesnt fix the SVN issue?

How does one do this? Im assuming this is the same solution as Monika mentioned? Injectinging the latest cumulative update into Microsoft iso? I haven't used MCT ot UUP dump before.

Click to expand...

There are two separate problems to solve:

1. The install image has a specific build number, usually representing the last Monthly Update that was integrated into the image. Some users take a base image, and manually apply the updates. Other users use MCT to get the latest monthly image, or have UUP dump create one. When you pick a specific build from UUP dump, it's applying a specific set of update files.

Rule of thumb is use the latest build as possible (unless you're concerned about recent bugs in the latest builds, and want to pick one or two builds behind for stability reasons).

Each install image will have some version of the boot manager and its matching SVN.

2. The install media needs a boot file which both passes the Secure Boot cert checks, and if the SVN is invoked, also has a boot file SVN equal or higher than the UEFI's SVN. If you use a tool like Rufus to write a different (newer) ISO to USB, it pulls from whatever current version you have available.

3. Because SVN represents a minimally allowed version, you can create an up-to-date USB which has SVN 9.0 files and boot it on another system, which BIOS hasn't been updated to SVN 9.0. Say it's stuck on UEFI SVN 7.0. 9 > 7.

What you can't do is build a SVN 7.0 USB, and boot that off a PC that has SVN 9.0 in the UEFI.

garlin said:

...it pulls from whatever current version you have available...

Click to expand...

So if it's built on a computer that has all latest boot loaders, therefore signed with 2023 CA and also SVN 9.0 compliant, the resulting ISO will have the correct boot loaders, correct ?

But would a tool like Rufus or Ventoy also make sure the files that the installation will copy on the computer on which Windows is being installed are also with the latest boot loader ?

That's why I suggested noskip, update bootmedia, check again still with noskip

@anchamp65

Example

A) Starting Windows 11 installation
Verifying boot file (e.g. bootx64.efi)
Copying files to C from install.wim
Copying files to EFI partition from C
restart

B) Starting installed Windows
Verifying bootmgfw.efi on EFI partition = must have valid certificate and must have valid SVN
OOBE etc.

iFX_Legacy has no problem with A (*1), does not need to solve BootMedia files.
iFX_Legacy has problem with B = has old version of bootmgfw_ex.efi in install.wim copied to EFI partition.
= must use either current install.wim with bootmgfw_ex.efi (SVN 9) (recommended) (or solve bootmgfw.efi (SVN 9) on EFI partition).

*1
Options:
1) bootx64.efi is SVN 9
2) SVN is not checked in bootx64.efi (AI tells me so)
3) It is not loading bootx64.efi, but the efi from Rufus

garlin said:

The cert file isn't a BIOS firmware image, you cannot use it with the ASUS flash tool.

1. Disable Secure Boot.
2. Delete all keys.
3. Restart Windows. Run the update script, it should recognize you are in Setup Mode (no certs).
4. Run the check script again. You should see KEK CA 2023 listed.
5. Re-enable Secure Boot.

Click to expand...

------------------------------------------------------------------------------
hello, garlin,
following your advise (and after disabling the CSM; otherwise i couldn´t get the setup mode), this is what i got:

PS C:\windows\system32> C:\Users\fbm\Desktop\Check_UEFI-CA2023.ps1 -Verbose

Windows 10 21H2 (19044.7417)

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

BIOS Firmware
-------------
ASUSTeK COMPUTER INC. M32CD_A_F_K20CD_K31CD
Version: 1102
Date: 2018-04-12

Factory Default UEFI PK Cert
----------------------------
ASUSTeK MotherBoard PK Certificate

UEFI PK Cert
------------
Windows OEM Devices PK

Factory Default UEFI KEK Certs
------------------------------
Microsoft Corporation KEK CA 2011
Canonical Ltd. Master Certificate Authority
ASUSTeK MotherBoard KEK Certificate

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Canonical Ltd. Master Certificate Authority
ASUSTeK MotherBoard SW Key Certificate
ASUSTeK Notebook SW Key Certificate

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
(NONE)
EFI_CERT_SHA256_GUID Signatures: 77

UEFI DBX Certs
--------------
(NONE)
Windows BootMgr SVN is MISSING.
EFI_CERT_SHA256_GUID Signatures: 431

UEFI Variables
--------------
SBAT (Linux only): sbat,1,2024010900 / shim,4 / grub,3 / grub.debian,4

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\\.\HarddiskVolume6\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.342, SVN 9.0

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.


REQUIRED ACTION
===============
To REVOKE the [PCA 2011] cert, run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x282 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

-i think the "Windows BootMgr SVN is MISSING" line in UEFI DBX Certs is because the 2011 certs are not revoked; am i right?
if it´s not an issue, i rather leave them until Microsoft to revoke them
fernando

fernando BARBA said:

-i think the "Windows BootMgr SVN is MISSING" line in UEFI DBX Certs is because the 2011 certs are not revoked; am i right?
if it´s not an issue, i rather leave them until Microsoft to revoke them

Click to expand...

Your BIOS has the CA 2023 certs installed, but has not revoked CA 2011. You can wait for Windows to revoke it later this year (no date has been announced). Otherwise this PC is done.

garlin said:

Your BIOS has the CA 2023 certs installed, but has not revoked CA 2011. You can wait for Windows to revoke it later this year (no date has been announced). Otherwise this PC is done.

Click to expand...

thank you very much for your advice and greetings from Spain ,
fernando

Hope your World Cup team does well today.

garlin said:

Hope your World Cup team does well today.

Click to expand...

ok, maybe we "see" in the final...

iFX_Legacy said:

Rufua simplifies all.those other operations, unless theres a reason I shouldn't use that... can I manually add the latest cumulative update to the last official.microsoft iso and then just use rufus?

I searched Google but it seems some of the articles referencing how to manually do this are a bit out of date... can you guide me through that?

Click to expand...

Yes, you can manually add the latest cumulative update to the latest iso file and then use Rufus.

Use AI to get information instead of Google.

Notes:

1)
It is best to download the June official original MVS iso (26200.8655) from Microsoft (Not the one from Microsoft's public website.).
SVN 9 already has that. A trusted unofficial source is also suitable.

2)
MCT/ESD is also suitable.
ESD is usually up to date on Thursday, two days after the release of CU (B).
This month, however, Microsoft released an ESD with an unofficial CU (CU B = revision 8655, ESD = revision 8653). If that doesn't bother you, create ISO using MCT.
I haven't verified that SVN 9 is there, but I'm guessing it is.

3)
If you are not able to find out information on how to update wim using dism, do not do it, it is not suitable for you.
The ready-made script (W10UI) is more suitable for you, but you wrote that you do not want to use it.

garlin said:

There are two separate problems to solve:

1. The install image has a specific build number, usually representing the last Monthly Update that was integrated into the image. Some users take a base image, and manually apply the updates. Other users use MCT to get the latest monthly image, or have UUP dump create one. When you pick a specific build from UUP dump, it's applying a specific set of update files.

Rule of thumb is use the latest build as possible (unless you're concerned about recent bugs in the latest builds, and want to pick one or two builds behind for stability reasons).

Each install image will have some version of the boot manager and its matching SVN.

2. The install media needs a boot file which both passes the Secure Boot cert checks, and if the SVN is invoked, also has a boot file SVN equal or higher than the UEFI's SVN. If you use a tool like Rufus to write a different (newer) ISO to USB, it pulls from whatever current version you have available.

3. Because SVN represents a minimally allowed version, you can create an up-to-date USB which has SVN 9.0 files and boot it on another system, which BIOS hasn't been updated to SVN 9.0. Say it's stuck on UEFI SVN 7.0. 9 > 7.

What you can't do is build a SVN 7.0 USB, and boot that off a PC that has SVN 9.0 in the UEFI

Click to expand...

Thank you so much for your explanation, I understand this I think., My issue seems to be that the even though I have the CA 2023 certs and your update-UEFI.bat scripr updated my windows 11 bootmedia drive to SVN 9.0, and my system firmware is SVN 9.0, the actual windows boot manager SVN on my drive is still SVN 7.0, thus once my USB bootmedia finishes copying the files and the system reboots, thats why the error comes at that point now. vs perviously I wouldnt be able to even boot to the bootmedia because it was using SVN 9.0.

Can anyone be kind enough to walk me through updating my windows iso file using dism? I have downloaded the following files from the windows update catalog, under kb5094126, 2 files actually pop up.

windows11.0-kb5094126-x64_1b7fae967f9781d27e8ee3f848fba51b7cd62e88.msu (SHA1: G3+uln+XgdJ+juP4SPulG3zWLog=) (SHA256: eh6exfIVlp+oOjOX6y4u7hghyMvJvpWZMPZMvOjY8Kc=)
windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu (SHA1: lTRJZyBz+PuZuttMxtXXhJucg+g=) (SHA256: gZYyYQoQGvEccpB/sT/wW1+0IiwOJj7poDvMHR1fJqQ=)

unsure really what the kb5043080 is, monika had only mentioned that I need kb5094126.

I'd really preder not to use third party sites to get the prepackaged updated iso file if its something I can build out myself, assuming its not a difficult process.

lastly, once this updated iso is built, i'm assuming i can simply feed it back through rufus and I should be good to go? at least for now ?

thanks again for all your patience and assistance.