Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Quandary · 2026-07-21T19:48:47-0400

garlin said:
If you were to use Hasleo's currently saved WinPE (from its staging folder), it wouldn't be allowed to boot on any PC which has a SVN (in the UEFI) of 8.0 or higher. Which is any PC updated since April 2026.

But your USB drive has the updated boot file (SVN 9.0). Either because it was updated outside of Hasleo, or used a different (newer) version of the WinPE. The best solution is always see if there's a newer version of the WinPE to download. And if there isn't, to create the recovery USB using the normal methods, and then copy a newer boot file over the finished drive.

The USB had Ventoy on it before. The Hasleo was used to create the USB and it did a format first. It build the WinPE components from the Widows Recovery environment. It was not updated outside of Hasleo. The script was run after that, so I guess it gets the SVN from the WinRE.

garlin · 2026-07-21T19:57:19-0400

Quandary said:
The USB had Ventoy on it before. The Hasleo was used to create the USB and it did a format first. It build the WinPE components from the Widows Recovery environment. It was not updated outside of Hasleo. The script was run after that, so I guess it gets the SVN from the WinRE.

Do you happen to know where Hasleo keeps its copy of the WinRE files? I only have the option for WinPE in the Hasleo I installed for test purposes.

Phil_C · 2026-07-21T20:05:39-0400

Here is the result of the new Check script:
*
EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.352, SVN 9.0

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

SkuSiPolicy.p7b is CURRENT.
\\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
Version: 3.0.0.16

Macrium Folders
---------------
Windows Boot Manager [Production PCA 2011] is BANNED.
c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.352, SVN 9.0

Bootable Media
--------------
USB Drive J:
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
J:\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.352, SVN 9.0

STATUS REPORT
-------------
Registry: "UEFICA2023Status" = Updated

SUCCESS: UPDATES ARE FINISHED.
UEFI CA 2023 certs are present, PCA 2011 cert is revoked.
*
Everything works The rescue USB boots prpoperly into Macrium.

But why does the script show BANNED in Macrium Folders? I forced Macrium to build a new WIM.

Scott · 2026-07-21T20:18:24-0400

Phil_C said:
UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

Since it been revoked, it's now banned.

Phil_C said:
Windows Boot Manager [Production PCA 2011] is BANNED.

This is what matters

Phil_C said:
USB Drive J:
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

starchase · 2026-07-21T20:20:08-0400

Here is my HP Spectre with Macrium Reflect USB which works on all my PC.

PS C:\Users\thele> powershell -nop -ep bypass -f C:\TEMP\Check_UEFI-CA2023_2026-07-21.ps1 -BootMedia
Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

BIOS Firmware
-------------
Hewlett-Packard HP Spectre x360 Convertible 13
Version: F.54
Date: 2019-12-26
This BIOS may be damaged by updating Secure Boot certs.

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
MosbyKey [2025.12.17]
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

Macrium Folders
---------------
Windows Boot Manager [Production PCA 2011] is BANNED.

Hasleo Folders
--------------
Windows Boot Manager [Windows UEFI CA 2023] is BANNED.

Bootable Media
--------------
USB Drive D: "MACRIUMRESC"
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

USB Drive F: "Spectre"
F:\EFI\Microsoft\Boot\boot.stl is MISSING.

STATUS REPORT
-------------
Registry: "UEFICA2023Status" = Updated
Registry: "ConfidenceLevel" = Temporarily Paused

WARNING: This BIOS may be damaged by updating Secure Boot certs.
Please check your PC vendor for a future BIOS update.

PS C:\Users\thele>

Phil_C · 2026-07-21T20:28:41-0400

Scott said:
Since it been revoked, it's now banned.

This is what matters

Duh! I guess I should pay attention to what I'm reading. PCA 2011 is banned. Of course it is!
Thanks.

garlin · 2026-07-21T20:31:23-0400

starchase said:
Here is my HP Spectre with Macrium Reflect USB which works on all my PC.

-------------
Hewlett-Packard HP Spectre x360 Convertible 13
Version: F.54
Date: 2019-12-26
This BIOS may be damaged by updating Secure Boot certs.

starchase said:
STATUS REPORT
-------------
Registry: "UEFICA2023Status" = Updated
Registry: "ConfidenceLevel" = Temporarily Paused

WARNING: This BIOS may be damaged by updating Secure Boot certs.
Please check your PC vendor for a future BIOS update.

I gotta fix this bug, it's confusing you have a HP BIOS which is missing a specific version string ("SBKPFV3") with your BIOS is in danger of bricking (it's not).

garlin · 2026-07-21T20:32:51-0400

Phil_C said:
Macrium Folders
---------------
Windows Boot Manager [Production PCA 2011] is BANNED.
c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.352, SVN 9.0

I'm just reporting what's in the staging folder. Presumably these files are used when they build a new WIM.

Phil_C said:
Bootable Media
--------------
USB Drive J:
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
J:\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.352, SVN 9.0

Phil_C said:
But why does the script show BANNED in Macrium Folders? I forced Macrium to build a new WIM.

What happens if you rebuild the USB right now? Do you end up with the same results?

garlin · 2026-07-21T20:45:31-0400

@starchase, can you run two commands for me?

Code:

Get-ItemPropertyValue 'HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing' -Name 'ConfidenceLevel'
Get-ItemPropertyValue 'HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing' -Name 'BucketHash'

BucketHash is "generic" value assigned to everyone with the exact same HP model/BIOS as you, so there's no personal data associated with this value.

I need to cross-index your BucketHash against the published Confidence files to see if MS categorized this PC as "maybe HP is working an official update for this model". It might not be true, but according to the process detailed by MS, that's supposed to be what's going on.

Phil_C · 2026-07-21T20:46:53-0400

garlin said:
I'm just reporting what's in the staging folder. Presumably these files are used when they build a new WIM.

What happens if you rebuild the USB right now? Do you end up with the same results?

Yes, same results, except I have to run your Update script again for the USB boot drive. The Macrium folders still have the banned PCA 2011.

BTW, when I run your Update script for the USB, I get this in bright red:

*
The regular expression pattern *LENOVO*M700* is not valid.
At [path to script] \Update_UEFI-CA2023.ps1:1749 char:5
+ '*LENOVO*M700*' { $Unsafe_Model = $true }
+ ~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (*LENOVO*M700*:String) [], RuntimeException
+ FullyQualifiedErrorId : InvalidRegularExpression
*

The script still completes and updates the USB.

garlin · 2026-07-21T21:10:04-0400

Phil_C said:
The regular expression pattern *LENOVO*M700* is not valid.
At [path to script] \Update_UEFI-CA2023.ps1:1749 char:5
+ '*LENOVO*M700*' { $Unsafe_Model = $true }
+ ~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (*LENOVO*M700*:String) [], RuntimeException
+ FullyQualifiedErrorId : InvalidRegularExpression
*

The script still completes and updates the USB.

Yeah, someone already flagged that bug on my GitHub. Forgot to copy a fix from the check script.

Klaver7 · 2026-07-21T21:34:28-0400

Ok Asus Plus Gaming b650

Code:

powershell -nop -ep bypass -f E:\Z_c2023\Check_UEFI-CA2023.ps1 -BootMedia
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 9.0

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    SkuSiPolicy.p7b is CURRENT.

Macrium Folders
---------------
    Windows Boot Manager [Production PCA 2011] is BANNED.

Bootable Media
--------------
    USB Drive F: "ATUFMAC0726"
        Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.


STATUS REPORT
-------------
    Registry: "UEFICA2023Status" = Updated

    SUCCESS: UPDATES ARE FINISHED.
    UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

PS C:\Users\jwdav>

Then I run this:

mountvol s: /s
copy s:\EFI\Boot\bootx64.efi c:\boot\macrium\WinREFiles\media\EFI\Boot\bootx64.efi
copy S:\EFI\Microsoft\Boot\bootmgfw.efi c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi

mountvol s: /d

Then Rufus to USB, been working all along, btw. bootable USB was done after july update

Macrium FREE

andyc56 · 2026-07-21T21:52:23-0400

garlin said:
Fine. Be that way :)

This is pretty cool! I'm still a bit fuzzy on all this, so please bear with me. I created a new Macrium Rescue .ISO file, using Macrium Reflect Free, then burned it to USB using Rufus. Then I ran:

Code:

.\Check_UEFI-CA2023.ps1 -Verbose -BootMedia

I got this result:

Code:

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        \\.\HarddiskVolume3\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

Macrium Folders
---------------
    Windows Boot Manager [Production PCA 2011] is UNTRUSTED.
        c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

Bootable Media
--------------
    USB Drive F: "RESCUE"
        Windows Boot Manager [Production PCA 2011] is UNTRUSTED.
            F:\EFI\Microsoft\Boot\bootmgfw.efi
            File Version: 28000.352, SVN 9.0

The resulting USB stick wouldn't boot - which is as I expected. Then I ran:

Code:

.\Update_UEFI-CA2023.ps1 -BootMedia

and I got this:

Code:

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        \\.\HarddiskVolume3\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

Macrium Folders
---------------
    Windows Boot Manager [Production PCA 2011] is UNTRUSTED.
        c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

Bootable Media
--------------
    USB Drive F: "RESCUE"
        Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
            F:\EFI\Microsoft\Boot\bootmgfw.efi
            File Version: 28000.352, SVN 9.0

This USB stick booted fine into the Macrium recovery environment, also as I expected. Here's what's bugging me though. Is bootmgfw.efi the same thing as the Windows Boot Manager? If so, I find it puzzling that all 3 are the same, yet allowed in some contexts, but untrusted in others. There's clearly something missing in my understanding, but I don't know what it is.

Phil_C · 2026-07-21T22:00:32-0400

Klaver7 said:
PS C:\Users\jwdav>[/CODE]

Then I run this:

mountvol s: /s
copy s:\EFI\Boot\bootx64.efi c:\boot\macrium\WinREFiles\media\EFI\Boot\bootx64.efi
copy S:\EFI\Microsoft\Boot\bootmgfw.efi c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi

mountvol s: /d

Then Rufus to USB, been working all along, btw. bootable USB was done after july update

Macrium FREE

This works nicely. On Reflect X also. Now the Check script shows the Macrium folders as Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

garlin · 2026-07-21T22:01:24-0400

Can you post the entire section before we get to the EFI Files and Boot media? The script is supposed to report a signing cert as UNTRUSTED if the underlying KEK doesn't exist for a specific DB cert.

Someone pointed out the original scripts would rank a DB cert BANNED, when technically it was UNTRUSTED. It's a minor technicality (both states indicate it shouldn't be allowed), but the script needs to be very specific on it.

A BANNED cert is supposed to be a properly trusted DB cert (with underlying KEK) which is explicitly added to the DBX at the same time (which bans it).

An UNTRUSTED cert is any DB cert which doesn't have a supporting KEK cert (KEK CA 2011 for PCA 2011, or KEK CA 2023 for UEFI CA 2023) to complete the "chain of trust".

garlin · 2026-07-21T22:06:32-0400

Klaver7 said:
Then I run this:

mountvol s: /s
copy s:\EFI\Boot\bootx64.efi c:\boot\macrium\WinREFiles\media\EFI\Boot\bootx64.efi
copy S:\EFI\Microsoft\Boot\bootmgfw.efi c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi

mountvol s: /d

Then Rufus to USB, been working all along, btw. bootable USB was done after july update

Actually that's backwards. You're copying from the EFI to the staging folder.

The correct direction is copying from \Windows\Boot\EFI_EX to the staging folder. Because it normally goes Boot\EFI_EX -> EFI volume.

Code:

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi c:\boot\macrium\WinREFiles\media\EFI\Boot\bootx64.efi
copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi

It's the same files in the end, but you should always think of copying from the "clean" folder where only Windows Update touches the files, instead of copying from the EFI volume where anything could have overwritten the boot files.

Klaver7 · 2026-07-21T22:13:47-0400

I check the SHA-256 on both and they match.

garlin · 2026-07-21T22:18:51-0400

Klaver7 said:
I check the SHA-256 on both and they match.

It's like your school's teacher in chemistry class. You're instructed to always pour chemicals out from a clean reagent bottle, and never pour anything back into the bottle. Any leftover chemical is thrown away so it never contaminates the reagent bottle.

Copy from \Windows\Boot\EFI_EX because it's the master version. The only thing that changes this folder is Windows Update.

KevTech · 2026-07-21T22:30:36-0400

Quandary said:
The script says BANNED for Windows Boot Manager in the \bin\WADK. What are the impacts and can/should it be updated?

What version of Hasleo do you have?

As of version 5.8.2.2 I don't think it is using this location anymore to build rescue media with 2023 cert.

At least it did not use that location anymore when I built mine.

I posted about it.

Hasleo Backup Suite

I want to add a Hasleo boot menu but I'm not sure about the drivers to be injected into WinPE. Automatic driver injection is ticked. What about 'Enable support for UEFI CA 2023? To enable this, I would have to tick 'Download WinPE components'. The Secure Boot on my laptop currently has all...

www.elevenforum.com

garlin · 2026-07-21T22:58:52-0400

I believe you're correct.

Version 5.8.2.2 (6/26/2026)

Improved creation of bootable media that supports the UEFI CA 2023 certificate

Fixed an issue that caused system restore to fail

Fixed an issue where file backup could not list drives under Windows ARM64

Fixed an issue that caused backup of MacOS files/folders shared via Samba to fail

Fixed an issue that caused "Smart Backup" to not work properly

Fixed other minor bugs

Added a version check to skip Hasleo version 5.8.2.2 or later.

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

My Computer

My Computer

My Computers

My Computers

My Computers

My Computers

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer