Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

t2s50 · 2026-07-21T06:21:57-0400

x_1 said:
And what about the system image captured before applying the patch if a restore becomes necessary?

Doesn't that defeat the purpose of taking snapshots?

You can temporarily disable secure boot in firmware in a rescue situation.

With 'updated' rescue media and 'outdated' image you can restore an image with secure boot enabled, but have to disable secure boot to boot the restored ('outdated') image.
(But improbable combination: Who would bother with updating the rescue media while not taking a fresh image?)

With 'outdated' rescue media and 'outdated' image you have to disable secure boot for restoring the image and keep it disabled to boot the restored image.

With 'updated' rescue media and 'updated' image there's no problem...

garlin · 2026-07-21T10:12:27-0400

When you have a SkuSiPolicy mismatch, the normal workaround is to disable Secure Boot. You might have to reboot twice.

Two reboots because:
1. After Windows notices that Secure Boot is disabled, it clears a possible "UEFI lock" on the SkuSiPolicy being in effect from the BIOS settings.

2. Second reboot allows the cleared state (no UEFI lock) to be in effect. Without the second reboot, Windows might get confused if Secure Boot was re-enabled since the future SkuSiPolicy won't match what version the UEFI lock thinks it should be.

At this point, if you restored from an older backup then your "correct" version of the SkuSiPolicy is whatever version is in the restored "C:\Windows\System32\SecureUpdates" folder.

Code:

mountvol S: /s
copy C:\Windows\System32\SecureBootUpdates\SkuSiPolicy.p7b S:\EFI\Microsoft\Boot
mountvol S: /d

You could just leave it alone and run Windows Update to bring your older image to the latest files (so your winload.efi matches again). But that depends on why you're restoring from a backup (maybe the last Monthly Update was unstable for you).

x_1 · 2026-07-21T12:11:30-0400

I was wondering if it wouldn't be better to sacrifice security for disaster recovery, while obviously maintaining certificate revocation.
Does the two reboots flush away the (Firmware) SVN?

Disable SkuSiPolicy enforcement.

- Disable Secure Boot mode, and restart Windows.

- Run the commands:

Code:

mountvol S: /s
del S:\EFI\Microsoft\Boot\SkuSiPolicy.p7b
mountvol S: /d

- Shutdown Windows. Re-enable Secure Boot and reboot.

garlin · 2026-07-21T12:21:37-0400

x_1 said:
I was wondering if it wouldn't be better to sacrifice security for disaster recovery, while obviously maintaining certificate revocation.
Does the two reboots flush away the (Firmware) SVN?

By design, SVN's are persistent. Once they're installed, you cannot clear them without manually deleting the exact entries (which is not easy, because they're only identified by very long hash ID names and some BIOS setup menus don't show you the entire name), or by clearing the entire DBX variable.

The SVN belongs to a different security mechanism than SkuSiPolicy. SVN is for boot manager, SkuSiPolicy is for winload.efi

x_1 · 2026-07-21T12:34:21-0400

so, if I removed the skusipolicy.p7b file regardless of the SVN embedded in the firmware and i needed to use an image to restore the system, would there still be the risk of obsolete media or winload.efi mismatch??

anchamp65 · 2026-07-21T13:04:41-0400

Scott said:
I don't see a reason why this wouldn't work for Macrium X users as well.

EDIT: Or, if your WinRE is current, assign your recovery partition a drive letter and point it to
View attachment 177241
I just tested this and it also worked.

Macrium X...

I tried the recovery partition copy of the wimre.wim and it did not work for me, I still needed to patch the USB drive using bcdboot. Maybe related to the fact that my OS build is 26200.8894 and Windows RE version is 10.0.26100.8875. But dism does say the winre.wim was modified on 2026-07-15, so I would assume MS would have updated it to match my CA 2023 state which is all updated.

Note: I decided not to mess with SkuSiPolicy.p7b, as suggested by Garlin, since I'm using an imaging software and due to the fact that my computers never leave home. So my risk level is reduced.

I will try the UUPDump scenario later today or tomorrow...

garlin · 2026-07-21T16:07:40-0400

x_1 said:
so, if I removed the skusipolicy.p7b file regardless of the SVN embedded in the firmware and i needed to use an image to restore the system, would there still be the risk of obsolete media or winload.efi mismatch??

If there is no SkuSiPolicy.p7b file on the EFI volume, you can avoid problems with an outdated winload.efi.

garlin · 2026-07-21T16:29:27-0400

ATTENTION: Macrium and Hasleo users!!

Do you want to share feedback on an upcoming version of the check script? If you use the -BootMedia option, the script will now check the Macrium and Hasleo staging folders, where they keep a cached copy of your WinRE or WinRE files, and check if they're using the right boot file.

Code:

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

Macrium Folders
---------------
    Windows Boot Manager [Production PCA 2011] is BANNED.
        C:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

    Boot File [Production PCA 2011] is BANNED.
        C:\boot\macrium\\WA11KFiles\media\EFI\Boot\bootx64.efi
        File Version: 22621.1702, SVN 1.0

Hasleo Folders
--------------
    Windows Boot Manager [Windows UEFI CA 2023] is BANNED.
        C:\Program Files\Hasleo\Hasleo Backup Suite\bin\WADK\Boot\EFI_EX\bootmgfw.efi
        File Version: 26100.30227, SVN 7.0

Bootable Media
--------------
    USB Drive D: "HASLEOBS"
        Boot File [Production PCA 2011] is BANNED.
            D:\EFI\Boot\bootx64.efi
            File Version: 22621.1702, SVN 1.0

        D:\EFI\Microsoft\Boot\boot.stl [230881+501473] is WRONG VERSION.

Macrium - Checks for both WinPE & WinRE folders.

Hasleo - I have the free edition installed, which only does WinPE. If you know where licensed Hasleo keeps the cache folder for its copy of WinRE then let me know the full folder pathname, and I'll add that to the script. I'm looking for where bootmgfw.efi is hidden.

Anibor_11 · 2026-07-21T16:44:46-0400

garlin said:
Hasleo - I have the free edition installed, which only does WinPE. If you know where licensed Hasleo keeps the cache folder for its copy of WinRE then let me know the full folder pathname, and I'll add that to the script. I'm looking for where bootmgfw.efi is hidden.

I´m not sure the free edition only creates a WinPE. I think it does if the "Download Windows components" option is checked. If not, it creates a WinRE. Also, the ISO created with this option not checked is large, 1 GB+, which is more common of a WinRE.

anchamp65 · 2026-07-21T16:45:09-0400

garlin said:
ATTENTION: Macrium and Hasleo users!!

Do you want to share feedback on an upcoming version of the check script? If you use the -BootMedia option, the script will now check the Macrium and Hasleo staging folders, where they keep a cached copy of your WinRE or WinRE files, and check if they're using the right boot file.

Macirum X

Code:

Macrium Folders
---------------
    Windows Boot Manager [Production PCA 2011] is BANNED.

Script did not work initialy because I don't store the PE/RE files for Macrium on the system drive.
I don't want them in my image when I make a backup image...
I change the script to use my location (E:\) and then the script worked.
If you use the following regkey you can get the volume where Macrium stores the files:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Macrium\RescuePE\InstallDir (REG_SZ)

anchamp65 · 2026-07-21T16:49:22-0400

side question...
I didn't know about UUPDump.net
How safe is this ?
It seems to get the files directly from Windows repos

Any one of you been using it for a while and can confirm it's reliable ? probably is...

wabbit · 2026-07-21T16:54:22-0400

@garlin

The script seems to work for me. I have Macrium X. I ran -Verbose -BootMedia and got the SVN version 9 everywhere. At this time, I am not enforcing the SkuSiPolicy.

garlin · 2026-07-21T16:59:30-0400

anchamp65 said:
Script did not work initialy because I don't store the PE/RE files for Macrium on the system drive.
I don't want them in my image when I make a backup image...
I change the script to use my location (E:\) and then the script worked.
If you use the following regkey you can get the volume where Macrium stores the files:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Macrium\RescuePE\InstallDir (REG_SZ)

Fine. Be that way :)

anchamp65 · 2026-07-21T17:09:24-0400

garlin said:
Fine. Be that way :)

That one works !
Thanks

anchamp65 · 2026-07-21T17:21:33-0400

Scott said:
Here's how I did it:

1. Downloaded a new winre.wim file from build 26200.8875 via UUPdump. Saved it to C:\temp
2. Directed Macrium to use it under Advanced, and built my usb.
3. Once built, I ran @garlin script
.\Update_UEFI-CA2023.ps1 -bootmedia
4. I then ran his
powershell -ep bypass -f D:\Scripts\BlockedOrNot.ps1
script and everything matched.

I don't see a reason why this wouldn't work for Macrium X users as well.

Right-click on winre.wim, Save Link As...and name it winre.wim

https://uupdump.net/getfile.php?id=84f92676-c50f-47ba-8877-9cb3aded078f&file=winre.wim

I initially missed that you had patched your boot media in step 3... my bad...
I guess the only thing that getting the winre.wim from UUPDump.net or recovery partition fixes is the SkuSiPolicy.p7b, correct ?

anchamp65 · 2026-07-21T17:27:30-0400

@garlin
Are you also planning on integrating the Hasleo and Macrium to your update script ?
If so, your scripts are REALLY getting indispensable !!!

I know I'm repeating myself, but your work on all the secure boot related things is Soooooooooo Appreciated !!!!!!!!!!!!!!!!!!!!

PS: And I mean it even if you don't include Hasleo and Macrium in the update script

gunrunnerjohn · 2026-07-21T17:38:57-0400

Worked for me with the free version of Hasleo.

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computers