Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

XxXxX · 2026-08-03T11:06:07-0400

i found this on reddit it has some good information and links for nvidia gpu's
https://www.reddit.com/r/nvidia/comments/1n1jroi/psa_secure_boot_2026_june_cert_expiry_can_block

best of luck Steve ..

garlin · 2026-08-03T11:42:50-0400

I've read that thread before, but I still think something's wrong.

Microsoft UEFI CA 2011 & Microsoft UEFI CA 2023 are strictly reserved for 3rd-parties (HW partners or Linux distros). Many users get confused because both certs have "Microsoft" in the name.

Windows Production CA 2011 & Windows UEFI CA 2023 are limited to Windows releases. OEM's don't get a copy of these certs, nor can they get binaries signed with them. MS wants to ban PCA 2011 to stop Black Lotus. There is no known security vulnerability for Microsoft UEFI CA 2011 which requires a similar ban.

If nobody's saying their option ROM's are signed by the Windows cert, then the Microsoft cert is still valid. An user could certainly download the MS UEFI CA 2011 cert and manually add it to their DBX list (thus banning it). I suspect in a large number of cases, these non-technical users don't have an accurate method for determining their current Secure Boot state, and using piecemeal instructions that don't explain the whole picture.

https://go.microsoft.com/fwlink/p/?linkid=321194

anchamp65 · 2026-08-03T11:46:33-0400

nikki605 said:
Doesn't look good.

use ".\Check-UEFI.bat"

Bree · 2026-08-03T11:53:36-0400

nikki605 said:
Doesn't look good.

Just open File Explorer, find Check-UEFI.bat and double-click on it. Say 'Yes' to the UAC prompt and it will run, doing all the rest for you....

Capricornus · 2026-08-03T12:21:25-0400

garlin said:
I've read that thread before, but I still think something's wrong.

Microsoft UEFI CA 2011 & Microsoft UEFI CA 2023 are strictly reserved for 3rd-parties (HW partners or Linux distros). Many users get confused because both certs have "Microsoft" in the name.

Windows Production CA 2011 & Windows UEFI CA 2023 are limited to Windows releases. OEM's don't get a copy of these certs, nor can they get binaries signed with them. MS wants to ban PCA 2011 to stop Black Lotus. There is no known security vulnerability for Microsoft UEFI CA 2011 which requires a similar ban.

If nobody's saying their option ROM's are signed by the Windows cert, then the Microsoft cert is still valid. An user could certainly download the MS UEFI CA 2011 cert and manually add it to their DBX list (thus banning it). I suspect in a large number of cases, these non-technical users don't have an accurate method for determining their current Secure Boot state, and using piecemeal instructions that don't explain the whole picture.

https://go.microsoft.com/fwlink/p/?linkid=321194

Garlin, Do I understand your post properly, as in:
The graphics card firmware can only be signed with the Microsoft UEFI CA 2011 or 2023, but NOT windows PCA 2011. And it is the windows PCA 2011 that will be revoked in Oct 2026.
Hence, that would mean it might be worthwhile to test in Oct 2026 if those computers with older graphics cards and only the Microsoft CA 2011, could still work or not. Or am I completey wrong on this topic? I am just trying to get my head around all of it.

And today I got an answer from one of the computer firms I buy stuff from: I asked them if they have graphic cards wit hte 2023 cert. They could NOT give me an answer. Either the person was non-technical or there is no info on such cards. AS this company sells to businesses, and not just consumers, I assume they have enough technical knowledge to answer my question. Therefore, I assume the cards may not be a problem, but I may be totally and utterly wrong.

Monika1491 · 2026-08-03T13:00:01-0400

Capricornus said:
And it is the windows PCA 2011 that will be revoked in Oct 2026.

It will not be revoked, it will only expire.

Capricornus · 2026-08-03T13:08:25-0400

Monika1491 said:
It will not be revoked, it will only expire.

This is not correct. In this article Microsoft clearly talks about revoking windows PCA 2011:

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 | Microsoft Support

How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932

support.microsoft.com

Monika1491 · 2026-08-03T13:15:09-0400

Probably the heat, it's 40 here, I thought you meant CA 2011 :-(

Capricornus · 2026-08-03T14:11:28-0400

On reading this article https://techcommunity.microsoft.com...re-boot-certificates-expiring-in-2026/4530725, it is clear that the microsoft CA 2011 has expired at the end of june 2026, but has NOT been revoked. It is being replaced with the Microsoft Option ROM CA 2023 on new graphics card.
To me, it means that, as long as you use older graphics cards, signed with the microsoft CA 2011, you can still work with it. As it has not been revoked, it continues to be present in the DB, and can work properly with those graphic cards. I truly hope this is the case, but I am not 100% certain.

garlin · 2026-08-03T15:03:22-0400

UPDATE: 2026-08-03

1. Refactor existing -BootMedia code into new script Check_BootMedia.ps1
2. Add winload.efi compliance checking to Check_BootMedia.ps1
3. Temporarily suspend BitLocker protection after copying KEK CA 2023 cert to the EFI volume
4. Add support for MCT-created SWM files when checking winload.efi compliance

This release is a major change for users who depend on the -BootMedia feature to check their Media Creation Tool-created USB drives, or Macrium and Hasleo recovery USB drives.

When the boot media check was first introduced, it simply confirmed whether you had a CA 2023-signed boot file in place.

But in an environment where users have applied the CA 2011 revocation, Windows can enable additional security protections like the minimum SVN level and enforcing SkuSiPolicy when VBS is enabled. While Check_UEFI-CA2023.ps1 has those important checks in place for your system drive, the existing methods could not identify the same conditions on boot media.

I decided to remove the boot media checks from Check_UEFI-CA2023.ps1, and create a new script Check_BootMedia.ps1. The new script supports an Audit mode, where it runs the checks as if Secure Boot and VBS are enabled. The major change is the script will download and extract three helper tools (wimlib-imagex, 7z.exe, offlinreg) into your temp folder for future use. These apps are not permanently installed to Windows, the bare minimum files are copied to AppData\Local\Temp and won't interfere with other apps, or other versions of the same apps.

If you delete the helper apps, the script will re-download them to the temp folder the next time it runs.

With these new tools, it's now possible to temporarily extract the boot manager and winload.efi files from any WIM or ESD file. If you can't extract a copy of those files, it's difficult to determine exactly what version you have and whether it's allowed or banned in your current environment.

boot.wim files are identified as WinPE or WinRE-based images. For all WIM, ESD, or SWM images, the correct UBR (actual build version) is reported.
New boot media are expected to include a copy of boot.stl. This file was always available, but the June 2026 Monthly Update recommends it be present on all boot media. The file is a Certificate Trust List to be used for security enforcement.
For Macrium and Hasleo users, Check_BootMedia.ps1 will report on boot files stored in your program's cache folders where it keeps the source WinRE or WinPE files.
For MCT users, the new script can report on the split WIM (SWM) files that appear to be proprietary to MCT.

MCT's unique version of SWM cannot be read by 3rd-party tools, so a temporary WIM is exported from the USB's SWM. The temporary WIM is processed, before it's removed so you don't lose any disk space. But the conversion process is slow, takes about 5-6 GB of C: drive space, and you will have to wait a few minutes.

Be patient. I had no idea why MCT creates SWM files that cannot be read by other tools. If you convert the MCT ISO (not the USB) to SWM, using DISM tools, that converted file can be read without issues. If you used Rufus to create a boot drive using the MCT ISO, this challenge can also be avoided.

Code:

Secure Boot: ON
Virtualization Based Security: OFF

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 9.0

Macrium v8.0.7783
-----------------
    WinRE Boot Manager [Production PCA 2011] is BANNED.
    WinPE Boot File [Production PCA 2011] is BANNED.

Bootable Media
--------------

USB Drive D: "ESD-USB"
    Boot File [Windows UEFI CA 2023] is ALLOWED.

    boot.wim:2 (WinPE 26100.8875)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        winload.efi is ALLOWED.

    Please wait while install SWM is analyzed.

    install.swm:1 (W11 25H2 26200.8875)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        winload.efi is ALLOWED.

        Skipping over the next 6 images.

    boot.stl is CURRENT.

DVD Drive E: "CCCOMA_X64FRE_EN-US_DV9"
    Boot File [Production PCA 2011] is BANNED.

    boot.wim:2 (WinPE 19041.2965)
        Boot Manager [Production PCA 2011] is BANNED.
        winload.efi is ALLOWED.

    install.wim:1 (W10 22H2 19045.2965)
        Boot Manager [Production PCA 2011] is BANNED.
        winload.efi is ALLOWED.

        Skipping over the next 10 images.

starchase · 2026-08-03T15:30:34-0400

Running the 2 versions of the Check_BootMedia scripts (.ps1 and .bat) gives me 2 slightly different results:

This is with \Check_BootMedia.ps1:
PS C:\Program Files\PowerShell-7.6.4-win-x64> powershell -nop -ep bypass -f C:\temp\newscripts\Check_BootMedia.ps1
Secure Boot: ON
Virtualization Based Security: OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0

Macrium v8.0.7783
-----------------
WinRE Boot Manager [Production PCA 2011] is BANNED.
WinPE Boot File [Production PCA 2011] is BANNED.

PS C:\Program Files\PowerShell-7.6.4-win-x64>

This is with the .bat:
Secure Boot: ON
Virtualization Based Security: OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0

Macrium v8.0.7783
-----------------
WinRE Boot Manager [Production PCA 2011] is BANNED.
WinPE Boot File [Production PCA 2011] is BANNED.

Bootable Media
--------------

USB Drive D: "HASLEOBS"
Boot File [Windows UEFI CA 2023] is ALLOWED.

boot.wim:1 (WinRE 26100.1)
Boot Manager [Windows UEFI CA 2023] is ALLOWED.
winload.efi is ALLOWED.

boot.stl is CURRENT.

PS C:\TEMP\newscripts>

Only the .bat reports the Boot Media I have plugged in.

[for some reason the Spoiler function didn't work on this post!!!]

TheVisitor · 2026-08-03T15:32:07-0400

Sorry I have no idea what all this means on the bootmedia script: I have not done anything yet to fix winre on Macrium because I don't fully understand the procedure:

bootmedia check
PS C:\Windows\System32> powershell -nop -ep bypass -f C:\temp16\check_bootmedia.ps1 -verbose -audit
Windows 11 25H2 (26200.8973)

Secure Boot: ON
Virtualization Based Security: ON

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0

EFI Files
---------
SkuSiPolicy.p7b is CURRENT.
\\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
Version: 3.0.0.16

FileRule MinimumFileVersion MaximumFileVersion
-------- ------------------ ------------------
ID_FILEATTRIB_F_0042 0.0.0.0 10.0.14393.9309
ID_FILEATTRIB_F_0044 10.0.14400.0 10.0.17763.8979
ID_FILEATTRIB_F_0040 10.0.18000.0 10.0.19041.7519
ID_FILEATTRIB_F_0049 10.0.19100.0 10.0.20348.5359
ID_FILEATTRIB_F_0047 10.0.20400.0 10.0.22621.7349
ID_FILEATTRIB_F_0041 10.0.23000.0 10.0.26100.8835
ID_FILEATTRIB_F_0043 10.0.26100.32000 10.0.26100.33099
ID_FILEATTRIB_F_0048 10.0.26172.0 10.0.26172.33099
ID_FILEATTRIB_F_0046 10.0.27000.0 10.0.28000.2489
ID_FILEATTRIB_F_0045 10.0.29426.0 65535.65535.65535.65535

Macrium v8.0.7690
-----------------
WinPE Boot File [Production PCA 2011] is BANNED.
c:\boot\macrium\\WA11KFiles\media\EFI\Boot\bootx64.efi
File Version: 22621.1702, SVN 1.0

What are all those FileAttrib files telling me.

garlin · 2026-08-03T15:43:42-0400

TheVisitor said:
SkuSiPolicy.p7b is CURRENT.
\\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
Version: 3.0.0.16

FileRule MinimumFileVersion MaximumFileVersion
-------- ------------------ ------------------
ID_FILEATTRIB_F_0042 0.0.0.0 10.0.14393.9309
ID_FILEATTRIB_F_0044 10.0.14400.0 10.0.17763.8979
ID_FILEATTRIB_F_0040 10.0.18000.0 10.0.19041.7519
ID_FILEATTRIB_F_0049 10.0.19100.0 10.0.20348.5359
ID_FILEATTRIB_F_0047 10.0.20400.0 10.0.22621.7349
ID_FILEATTRIB_F_0041 10.0.23000.0 10.0.26100.8835
ID_FILEATTRIB_F_0043 10.0.26100.32000 10.0.26100.33099
ID_FILEATTRIB_F_0048 10.0.26172.0 10.0.26172.33099
ID_FILEATTRIB_F_0046 10.0.27000.0 10.0.28000.2489
ID_FILEATTRIB_F_0045 10.0.29426.0 65535.65535.65535.65535

-Verbose will analyze the contents of the SkuSiPolicy file. Basically it's a set of rules that bans your winload.efi based on its file version.

For example versions 26100.32000 thru .33099 of winload.efi are forbidden. The script checks to see if your version fails into any one of the forbidden ranges. If it doesn't match any of the rules, then it's allowed by Windows.

You really don't need to bother with those numbers, but they're reported in case someone wants to see them.

TheVisitor said:
Macrium v8.0.7690
-----------------
WinPE Boot File [Production PCA 2011] is BANNED.
c:\boot\macrium\\WA11KFiles\media\EFI\Boot\bootx64.efi
File Version: 22621.1702, SVN 1.0

This reports your Macrium is staging a really ancient copy of the WinPE files. A problem with older Macrium 8 Free is they don't provide an more recent WinPE example for you. You probably want to choose WinRE instead. I believe if you clear the staging folders from the Macrium UI, it will delete the downloaded files to stop having to see this error. Or you can find a newer WinPE.

I'm not here to instruct everyone on how to fix/update their Macrium or Hasleo, but to point out reasons why it may be creating an outdated USB recovery drive (because its own source files are outdated). "User beware."

Warre1 · 2026-08-03T15:48:45-0400

how to update bootmedia with this new version?

garlin · 2026-08-03T16:01:14-0400

Warre1 said:
how to update bootmedia with this new version?

Run MCT and download a newer ISO.

26200.7840 is from February 2026. If you've installed the April or June 2026 CU's, and have revoked PCA 2011, then your current SVN level is higher than the boot manager available in this ISO. The "clock" has moved forward, and you're not allowed to travel backwards in time.

If you use the -Verbose option, the script will display the actual version numbers for comparison.

neldog · 2026-08-03T16:06:55-0400

This is what I got;

Code:

PowerShell 7.6.4
PS C:\Users\nelson\Desktop\Garlin v20260.80.03> .\Check_BootMedia.ps1
Secure Boot: ON
Virtualization Based Security: ON

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows PCA 2010
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 9.0

EFI Files
---------
    SkuSiPolicy.p7b is CURRENT.

Bootable Media
--------------

USB Drive D: "HASLEOBS"
    Boot File [Windows UEFI CA 2023] is ALLOWED.

    boot.wim:1 (WinPE 26100.1)
        Boot Manager [Windows UEFI CA 2023] is BANNED.
        winload.efi is BANNED.

    boot.stl is WRONG VERSION.


USB Drive E: "26200-8457"
    Boot File [Windows UEFI CA 2023] is ALLOWED.

    boot.wim:2 (WinPE 26100.8457)
        Boot Manager [Windows UEFI CA 2023] is BANNED.
        winload.efi is BANNED.

    Please wait while install SWM is analyzed.

    install.swm:1 (W11 25H2 26200.8457)
        Boot Manager [Windows UEFI CA 2023] is BANNED.
        winload.efi is BANNED.

        Skipping over the next 6 images.

    boot.stl is WRONG VERSION.

PS C:\Users\nelson\Desktop\Garlin v20260.80.03>

garlin · 2026-08-03T16:08:19-0400

starchase said:
Running the 2 versions of the Check_BootMedia scripts (.ps1 and .bat) gives me 2 slightly different results:

starchase said:
Macrium v8.0.7783
-----------------
WinRE Boot Manager [Production PCA 2011] is BANNED.
WinPE Boot File [Production PCA 2011] is BANNED.

starchase said:
Macrium v8.0.7783

-----------------
WinRE Boot Manager [Production PCA 2011] is BANNED.
WinPE Boot File [Production PCA 2011] is BANNED.

Bootable Media
--------------

USB Drive D: "HASLEOBS"
Boot File [Windows UEFI CA 2023] is ALLOWED.

boot.wim:1 (WinRE 26100.1)
Boot Manager [Windows UEFI CA 2023] is ALLOWED.
winload.efi is ALLOWED.

boot.stl is CURRENT.

That's strange. All the batch file does is run the PS script using "-ep bypass" and pass along any command-line arguments.

There is no -BootMedia option for this script, since that's obviously what it does. The only reason for skipping the drives is if the script didn't detect any at the time. I've never had a problem like this in testing. Let me know if the PS script always fails for you.

garlin · 2026-08-03T17:33:20-0400

neldog said:

This is what I got;

Code:

USB Drive D: "HASLEOBS"
    Boot File [Windows UEFI CA 2023] is ALLOWED.

    boot.wim:1 (WinPE 26100.1)
        Boot Manager [Windows UEFI CA 2023] is BANNED.
        winload.efi is BANNED.

    boot.stl is WRONG VERSION.


USB Drive E: "26200-8457"
    Boot File [Windows UEFI CA 2023] is ALLOWED.

    boot.wim:2 (WinPE 26100.8457)
        Boot Manager [Windows UEFI CA 2023] is BANNED.
        winload.efi is BANNED.

    Please wait while install SWM is analyzed.

    install.swm:1 (W11 25H2 26200.8457)
        Boot Manager [Windows UEFI CA 2023] is BANNED.
        winload.efi is BANNED.

        Skipping over the next 6 images.

    boot.stl is WRONG VERSION.

The rule on boot.stl is a bit hazy. MS writes on the June 2026 CU notes:

If you deploy dynamic updates such as this update to an existing Windows image, ensure the boot.stl file is included as part of the installation media. Failure to include the file might prevent devices from successfully starting from the installation media and can result in error code 0xc0430001.

The boot.stl file is used during Secure Boot validation and must match the Windows version and architecture of the image you are updating.

To ensure the boot.stl file is included as part of the installation media, do one of the following:

Use the Update WinPE script to update an existing Windows image. (Recommended)
Manually copy the boot.stl file from the device Windows\Boot\EFI folder to the corresponding folder on your installation media before deploying the update.

For information about how to apply Dynamic Update packages to existing Windows images, see Update Windows installation media with Dynamic Update.

Here's the catch, it's ridiculously expensive to determine if your boot.wim has the Dynamic Update. Dynamic Update is an optional feature that can be added to any WinPE which allows Windows Setup to find (if there's a working network connection) any missing Monthly Update files while it's performing a clean install or in-place upgrade.

The idea is rather than force you to check for missing updates right after the install/upgrade, Setup will do it while it's busy doing the install. A different set of files need to be present to handle this Dynamic updating. But you don't update the boot.wim by applying a MSU update, parts of the ISO folder have to be replaced.

"Update-UEFI.bat -BootMedia" will copy the boot.stl to any drive which is missing it, or doesn't have the latest version found in Windows\Boot\EFI.

Warre1 · 2026-08-03T18:43:11-0400

made recovery drive. boot.stl had to be updated

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Rancho Seldom Siesta

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computers

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer