Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

bmead · Saturday at 5:14 PM

Add me as a satisfied customer. I had some doubts that this would work for me on an older HP workstation since HP stated there would be no additional Bios updates for the HP Z640.
It didn't exactly work the first time, because I cleared the keys and Windows didn't recognize that secure boot was on after running the update and then enabling secure boot. I had to reset the keys to factory defaults which deleted all the new certs and I had to start over. I then disabled secure boot again, ran the update, enabled secure boot again and had the certs. I did revoke the old certs and copied the SKUSiPolicy.P7b.
All is good.

Thanks a bunch.

fernando BARBA · 2026-07-20T05:16:48-0400

please allow me an off-topic post!!:

,

fernando

Phil_C · 2026-07-20T15:25:30-0400

And here we go again. I built new Macrium Reflect WinRE USB boot drives and updated to SVN 9.0 on my two Lenovo laptops. This has always worked in the past.

Now, only my newer machine (Reflect X) will boot from the Macrium USB. The older one (Reflect Free) WILL NOT.

I have tried everything, including copying the boot files manually. The Garlin scripts report all is OK. But trying to boot from the USB ends up on the blue Recovery screen every time. I don't know what else to try.

garlin · 2026-07-20T15:30:08-0400

Do you use the SkuSipolicy? July 2026's Monthly Update updated the SkuSiPolicy, but otherwise did not change any Secure Boot items.

On the laptop that doesn't work, run the check script with the matching USB recovery drive plugged in.

Code:

Check-UEFI.bat -BootMedia

Phil_C · 2026-07-20T16:09:08-0400

garlin said:
Do you use the SkuSipolicy? July 2026's Monthly Update updated the SkuSiPolicy, but otherwise did not change any Secure Boot items.

On the laptop that doesn't work, run the check script with the matching USB recovery drive plugged in.

Code:

Check-UEFI.bat -BootMedia

It looks good to me, but still no boot.
*
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
MosbyKey [2025.10.14]
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

SkuSiPolicy.p7b is CURRENT.

Bootable Media
--------------
USB Drive J: "KINGSTON"
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

STATUS REPORT
-------------
Registry: "UEFICA2023Status" = Updated

SUCCESS: UPDATES ARE FINISHED.
UEFI CA 2023 certs are present, PCA 2011 cert is revoked.
*

garlin · 2026-07-20T16:20:45-0400

Phil_C said:
SkuSiPolicy.p7b is CURRENT.

"CURRENT" means your EFI volume's SkuSiPolicy file matches what is provided by the last Monthly Update you installed. But the SkuSiPolicy could still be blocking winload.efi because of a version mismatch with the WinPE or WinRE boot image.

Can you run this script, with the Macrium drive mounted?

Code:

powershell -ep bypass -f \your\folder\BlockedOrNot.ps1

The script compares the SkuSiPolicy against the boot.wim's actual contents, to see if your WIM's winload.efi is allowed or not. If it's not allowed, then your source WinPE or WinRE is outdated.

Phil_C · 2026-07-20T16:42:46-0400

@garlin

OK, this must mean something:

*
WARNING: \\.\HarddiskVolume2\EFI\Microsoft\Boot\SkuSiPolicy.p7b has an invalid or unsupported binary CI policy format
version value: 0x0000000B. If you are sure that you are dealing with a binary code integrity policy, there is a high
likelihood that Microsoft updated the binary file format to support new schema elements and that this code will likely
need to be updated.
Policy File: "\\.\HarddiskVolume2\EFI\Microsoft\Boot\SkuSiPolicy.p7b" is ENFORCED
Version: 3.0.0.16

Filename FileVersion Status
-------- ----------- ------
J:\sources\boot.wim 26100.8235 BLOCKED BY 'FILEATTRIB_F_0041'
C:\Windows\System32\winload.efi 26100.8875 ALLOWED
\harddisk1\partition4\Recovery\WindowsRE\Winre.wim 26100.8875 ALLOWED
*

Does the problem WinRE WIM get created by Macrium when building the USB? How would I correct this?

garlin · 2026-07-20T17:10:00-0400

Phil_C said:
Filename FileVersion Status
-------- ----------- ------
J:\sources\boot.wim 26100.8235 BLOCKED BY 'FILEATTRIB_F_0041'
C:\Windows\System32\winload.efi 26100.8875 ALLOWED
\harddisk1\partition4\Recovery\WindowsRE\Winre.wim 26100.8875 ALLOWED

Does the problem WinRE WIM get created by Macrium when building the USB? How would I correct this?

That's what I suspected. July 2026's CU updated the SkuSiPolicy to 3.0.0.16

Think of the Secure Boot-related security features like a clock, where the clock hands can only move forward. If MS fixes a known security hole in the boot files, it doesn't want attackers using an older copy of the file in its place.

Every time a new bootmgfw.efi or winload.efi is pushed out, either the SVN or SkuSiPolicy (respectively) gets bumped up. So what you need to do is recreate the Macrium drive again from the local system's WinRE. Hopefully one of the other Macrium experts can jump in and offer any tips.

anchamp65 · 2026-07-20T17:42:22-0400

garlin said:
Hopefully one of the other Macrium experts can jump in and offer any tips.

@Phil_C
You need to purge the locally stored WinPE / WinRE files by Macrium.
I can only guide you for v10 but if I remember correctly it's the same for v8.

Go to Windows Settings / Apps
Locate Macrium and start the "Uninstall" option in the 3 dots on the right.
Confirm admin access
Choose only the folloing option and click "OK", it take car of both PE & RE

That will purge local copies of WinPE / WinRE that Macrium stored
Then you can rebuild the Macrium USB or ISO image

EDIT: alternatively, when you start the Build Rescue and go into advanced settings, the tab "Rescue Media Volume" tells you where Macrium stores and uses WinPE / WinRE. On the selected volume you will find at the root a folder called "boot" which has a subfolder named "Macrium". If you delete the Macrium subfolder it does the same as the uninstall option from above.

Phil_C · 2026-07-20T18:00:43-0400

anchamp65 said:
@Phil_C
You need to purge the locally stored WinPE / WinRE files by Macrium.
I can only guide you for v10 but if I remember correctly it's the same for v8.

Go to Windows Settings / Apps

Locate Macrium and start the "Uninstall" option in the 3 dots on the right.

Confirm admin access

Choose only the folloing option and click "OK", it take car of both PE & RE

View attachment 177167

That will purge local copies of WinPE / WinRE that Macrium stored
Then you can rebuild the Macrium USB or ISO image

EDIT: alternatively, when you start the Build Rescue and go into advanced settings, the tab "Rescue Media Volume" tells you where Macrium stores and uses WinPE / WinRE. On the selected volume you will find at the root a folder called "boot" which has a subfolder named "Macrium". If you delete the Macrium subfolder it does the same as the uninstall option from above.

This worked. Many thanks to you and @garlin.

I'm curious, though. I could not find WinRE files anywhere on my Windows drive. Where does Macrium find them in order to build the USB? The Recovery partition on my SSD?

garlin · 2026-07-20T18:47:05-0400

WinRE.wim can be found in one of two different places (depending on whether WinRE is enabled):

1. When WinRE is enabled, it's copied to your system's active Recovery partition.

Now if you've cloned a disk, done manual re-partitioning, or ran out of disk space on the original Recovery partition (and Windows created a replacement), you might have extra partitions which are marked as Recovery. But the important volume is where Windows thinks is the active WinRE, not the other dead versions that may be floating around.

2. When WinRE is disabled, it's stored as a protected file under C:\Windows\System32\Recovery, on the Windows volume.

The process of enabling/disabling WinRE through reagentc will either transfer the WinRE.wim file to the active Recovery volume, or pull it back to the Windows folder. In some cases, something wrong happens and you lose that file (it's missing from both Windows and the Recovery volume). For those cases, you will have to locate a replacement copy of WinRE.wim from an install source.

Macrium will try to cache a copy of its contents, mostly because it wants to merge it with possibly required storage drivers, so your final boot.wim can always read the disks on a target system. And it wants to add the Macrium-specific tools to the image.

Phil_C · 2026-07-20T18:57:04-0400

WinRE is enabled on both of my systems, so I could not find it in the Windows folder. And Macrium cached an older version. All is good now.

Thanks again.

andyc56 · 2026-07-20T19:25:08-0400

Phil_C said:
I'm curious, though. I could not find WinRE files anywhere on my Windows drive. Where does Macrium find them in order to build the USB? The Recovery partition on my SSD?

I have Macrium Reflect Free, and it looks like it's storing these files under the directory c:\boot\macrium on my machine. Here's the folder structure I see:

After I did the procedure outlined by anchamp65, I looked in the c:\boot folder and everything was gone. Then, after I created a rescue ISO (which took longer than usual), the directory structure above appeared again. If I were to venture a guess, this problem could come up again if the files in the directories above become outdated.

One procedure you can do is when invoking the dialog for creating a rescue ISO, pressing and holding Ctrl will cause a "down button" to appear on the "Build" button of the dialog as below.

When you click it, you'll see the "Force WIM Rebuild" option. Choosing that has worked for me without having to do the uninstall procedure, and I've verified that it updates various files under c:\boot\macrium after saving the ISO.

anchamp65 · 2026-07-20T19:27:24-0400

Phil_C said:
WinRE is enabled on both of my systems, so I could not find it in the Windows folder. And Macrium cached an older version. All is good now.

Thanks again.

I placed a ticket on Macrium support about 2 months ago, they are aware of the the files not being always at the latest version the moment MS updates them. On Garlin's suggestion, I suggested that they use Get-SecureBootSVN powershell command to check if the rescue media needs to be updated and let the user know that he needs to update it.

As for the WinRE files, I only use WinRE for Macrium rescue media and the files are in the subfolers:
"<rescue_media_volume>\boot\macrium\WinREFiles"
Where "<rescue_media_volume>" is where you configure Macrium to store the files.

Bree · 2026-07-20T19:39:00-0400

anchamp65 said:
You need to purge the locally stored WinPE / WinRE files by Macrium.
I can only guide you for v10 but if I remember correctly it's the same for v8.

Go to Windows Settings / Apps

Locate Macrium and start the "Uninstall" option in the 3 dots on the right.

Confirm admin access

Choose only the folloing option and click "OK", it take car of both PE & RE

I can confirm that it's exactly the same for Reflect v8, Free or Home. In fact some things never change, it was the same for v7 too...

Bree · 2026-07-20T19:47:11-0400

andyc56 said:
One procedure you can do is when invoking the dialog for creating a rescue ISO, pressing and holding Ctrl will cause a "down button" to appear on the "Build" button of the dialog as below.

That too is a feature that has been available since at least Reflect v7......

anchamp65 · 2026-07-20T21:22:59-0400

Bree said:
I can confirm that it's exactly the same for Reflect v8, Free or Home. In fact some things never change, it was the same for v7 too...

Been using it since version 5 or 6 but can't say I remember all the differences... or what has not changed...

Phil_C · 2026-07-20T21:49:33-0400

andyc56 said:
One procedure you can do is when invoking the dialog for creating a rescue ISO, pressing and holding Ctrl will cause a "down button" to appear on the "Build" button of the dialog as below.

View attachment 177183

When you click it, you'll see the "Force WIM Rebuild" option. Choosing that has worked for me without having to do the uninstall procedure, and I've verified that it updates various files under c:\boot\macrium after saving the ISO.

I like the Ctrl>Magic Down Arrow.

Scott · 2026-07-21T03:58:37-0400

garlin said:
The script compares the SkuSiPolicy against the boot.wim's actual contents, to see if your WIM's winload.efi is allowed or not.
If it's not allowed, then your source WinPE or WinRE is outdated.

This was the case for me, Macrium using an outdated WinRE. I was going crazy trying to make my
Macrium boot media bootable with Secure Boot enabled. Tried WinRE, WinPE, neither worked.

But I figured it out. I can now boot my Macrium 8.1 WinRE media with Secure Boot enabled!

Code:

C:\Windows\System32>powershell -ep bypass -f D:\Scripts\BlockedOrNot.ps1
Windows 11 25H2 (26200.8894)
VBS: ON

Policy File: "\\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b", Version 3.0.0.16

Filename                        FileVersion Status
--------                        ----------- ------
J:\sources\boot.wim             26100.8875  ALLOWED
C:\Windows\System32\winload.efi 26100.8875  ALLOWED
Disk 0 Partition 4 Winre.wim    26100.8875  ALLOWED

C:\Windows\System32>

Here's how I did it:

1. Downloaded a new winre.wim file from build 26200.8875 via UUPdump. Saved it to C:\temp
2. Directed Macrium to use it under Advanced, and built my usb.

3. Once built, I ran @garlin script
.\Update_UEFI-CA2023.ps1 -bootmedia
4. I then ran his
powershell -ep bypass -f D:\Scripts\BlockedOrNot.ps1
script and everything matched.

I don't see a reason why this wouldn't work for Macrium X users as well.

Right-click on winre.wim, Save Link As...and name it winre.wim

https://uupdump.net/getfile.php?id=84f92676-c50f-47ba-8877-9cb3aded078f&file=winre.wim

EDIT: Or, if your WinRE is current, assign your recovery partition a drive letter and point it to

I just tested this and it also worked.

x_1 · 2026-07-21T04:23:13-0400

garlin said:
Every time a new bootmgfw.efi or winload.efi is pushed out, either the SVN or SkuSiPolicy (respectively) gets bumped up. So what you need to do is recreate the Macrium drive again from the local system's WinRE.

And what about the system image captured before applying the patch if a restore becomes necessary?

Doesn't that defeat the purpose of taking snapshots?

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer

My Computers

My Computers

My Computer

My Computers

My Computers

My Computer