Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

TheVisitor · Aug 5, 2026

garlin said:
The SVN is another form of version number, which belongs to the file. It doesn't impact how Get-Volume determines what are removable (USB) drives.

Run this command as Admin:

Code:

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi "C:\Program Files\Hasleo\Hasleo Backup Suite\bin\WADK\Boot\EFI_EX\bootmgfw.efi"

Thanks, I'm confused as usual: C: has the bootmgfw_EX.efi then - in the Hasleo instruction you jut bootmgfw.efi which is what I have in Hasleo.
After pasting bootmgfw_EX.efi into Hasleo and running the scipt to check bootmedia check it still shows SVN 7.0. It seems something is not reading the new file or does it need a restart ? or do I have to edit out the _EX in the Hasleo file

garlin · Aug 5, 2026

TheVisitor said:
Thanks, I'm confused as usual: C: has the bootmgfw_EX.efi then - in the Hasleo instruction you jut bootmgfw.efi which is what I have in Hasleo.

You cannot use the filename by itself, to identify the file's SVN version.

Get-SecureBootSVN -BootManagerPath C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi
Get-SecureBootSVN -BootManagerPath "C:\Program Files\Hasleo\Hasleo Backup Suite\bin\WADK\Boot\EFI_EX\bootmgfw.efi"

TheVisitor said:
After pasting bootmgfw_EX.efi into Hasleo and running the scipt to check bootmedia check it still shows SVN 7.0. It seems something is not reading the new file or does it need a restart ? or do I have to edit out the _EX in the Hasleo file

Copying the \Windows\Boot\EFI_EX replaces the boot manager version stored in Hasleo's staging folder. So the next time you use Hasleo to create a boot drive, it will use this updated version instead of whatever was cached from before.

garlin · Aug 5, 2026

Quandary said:
2. These tests were done with the Ventoy USB only
PS C:\WINDOWS\system32> powershell -nop -ep bypass -f D:\Downloads\TestScript_A.ps1
Test Script A counts 2 drives
PS C:\WINDOWS\system32> powershell -nop -ep bypass -f D:\Downloads\TestScript_B.ps1
Test Script B counts 2 drives
PS C:\WINDOWS\system32> powershell -nop -ep bypass -f D:\Downloads\TestScript_C.ps1
Test Script C counts 2 drives

I understand the Ventoy results, it creates two distinct drive volumes. One for Ventoy, the other to hold your ISO data.

Quandary said:
3. These 3 tests were done with both the HBS USB & a Ventoy USB (seen by Explorer as 2 drives)
PS C:\WINDOWS\system32> powershell -nop -ep bypass -f D:\Downloads\TestScript_C.ps1
Test Script C counts 3 drives
PS C:\WINDOWS\system32> powershell -nop -ep bypass -f D:\Downloads\TestScript_B.ps1
Test Script B counts 3 drives
PS C:\WINDOWS\system32> powershell -nop -ep bypass -f D:\Downloads\TestScript_A.ps1
Test Script A counts 3 drives

Just confusing.

OK. I found another drive querying script in a PS Gallery, can you try this one?

TheVisitor · Aug 5, 2026

Not_smart test results:
PS C:\Windows\System32> powershell -nop -ep bypass -f C:\temp16\not_smart.ps1
Get-WmiObject : Not supported
At C:\temp16\not_smart.ps1:3 char:37
+ ... PredictData=Get-WmiObject -Class MSStorageDriver_FailurePredictData - ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [Get-WmiObject], ManagementException
+ FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand

Get-WmiObject : Not supported
At C:\temp16\not_smart.ps1:4 char:39
+ ... edictStatus=Get-WmiObject -Class MSStorageDriver_FailurePredictStatus ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [Get-WmiObject], ManagementException
+ FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand

DriveLetter Model MediaType InterfaceType
----------- ----- --------- -------------
C: WD Blue SN570 500GB Fixed hard disk media SCSI This disk is SSD
G: SanDisk Cruzer Glide USB Device Removable Media USB
E: WD My Passport 259F USB Device External hard disk media USB
HP ENVY 5530 series USB Device USB

garlin · Aug 5, 2026

OK. That's a start for me. Back to some refactoring of borrowed code. I have to rip out all the non-essential parts...

Quandary · Aug 5, 2026

@garlin As requested:

PS C:\WINDOWS\system32> powershell -nop -ep bypass -f "D:\Downloads\NOT_SMART.ps1"

DriveLetter Model MediaType InterfaceType
----------- ----- --------- -------------
F: USB Flash Disk USB Device Removable Media USB

PS C:\WINDOWS\system32> powershell -nop -ep bypass -f "D:\Downloads\NOT_SMART.ps1"

DriveLetter Model MediaType InterfaceType
----------- ----- --------- -------------
F: USB Flash Disk USB Device Removable Media USB
{G:, H:} USB DISK 3.0 USB Device Removable Media USB

garlin · Aug 5, 2026

~~So if you run it twice in a row, you get two different results?~~

I misread the reply. So the first one is with HSB, and the second one is with Ventoy?

anchamp65 · Aug 5, 2026

Hey @garlin, not sure if that can be interesting or not for you, but here it is...

I use Macrium 10.
If I run your lastest Check_BootMedia.ps1 from post #3046 and I have:

Macrium staging in E:\boot\macrium
Macrium ISO mounted as drive G:
USB drive with Macrium ISO writen with Rufus as drive H:

If I run your script Check_BootMedia.ps1 -verbose -audit, I get: (skipping all the stuff before it get's to Macrium to reduce size or post)

Code:

Macrium v10.0.8843
------------------
    WinRE Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        E:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

Now if I change 1 line in your script to force it to scan drives G: and H: (line 2295)

Code:

#        $RemovableDrives = Get-Volume | where { $_.DriveType -in 'CD-ROM','Removable' -and $_.DriveLetter -ne $null -and $_.OperationalStatus -eq 'OK' } | sort DriveLetter
        $RemovableDrives = Get-Volume | where { $_.DriveLetter -in "H","G" -and $_.OperationalStatus -eq 'OK' } | sort DriveLetter

I now get this:

Code:

Macrium v10.0.8843
------------------
    WinRE Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        E:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

Bootable Media
--------------

DVD Drive G: "Rescue"
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        G:\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

    boot.wim:1 (WinRE 26100.1)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
            \Windows\Boot\EFI_EX\bootmgfw_EX.efi
            File Version: 28000.352, SVN 9.0

        \Windows\System32\winload.efi is ALLOWED.
            File Version: 10.0.26100.8875


DVD Drive H: "RESCUE"
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        H:\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

    boot.wim:1 (WinRE 26100.1)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
            \Windows\Boot\EFI_EX\bootmgfw_EX.efi
            File Version: 28000.352, SVN 9.0

        \Windows\System32\winload.efi is ALLOWED.
            File Version: 10.0.26100.8875

So not sure why forcing the Get-Volume to find both drives changes the result.
And I re-downloaded your script from post #3046 and compared them to make sure I had not changed anything else.
Most probably it impacts the rest of your script but not good enough to understand all your code...

garlin · Aug 5, 2026

anchamp65 said:
Macrium staging in E:\boot\macrium

Your Macrium's staging path doesn't matter, because the script looks it up from the registry.

anchamp65 said:
Now if I change 1 line in your script to force it to scan drives G: and H: (line 2295)

Code:

# $RemovableDrives = Get-Volume | where { $_.DriveType -in 'CD-ROM','Removable' -and $_.DriveLetter -ne $null -and $_.OperationalStatus -eq 'OK' } | sort DriveLetter $RemovableDrives = Get-Volume | where { $_.DriveLetter -in "H","G" -and $_.OperationalStatus -eq 'OK' } | sort DriveLetter

So not sure why forcing the Get-Volume to find both drives changes the result.

Get-Volume isn't wrong, it's the selection criteria that blows up. Normally you would filter by any mounted CD/DVD device, and "Removable" drives. Typically all USB sticks fall under the "Removable" category.

If you manually select the drive letters you want to scan, then it means the filter is wrong. But in reality, PS (or Windows, or some stupid USB device implementation) is identifying some removable USB's as anything but "Removable". Now, why is it broken for some users but not the majority of every one else?

Quandary · Aug 5, 2026

garlin said:
I misread the reply. So the first one is with HSB, and the second one is with Ventoy?

Correct.

garlin · Aug 5, 2026

OK. Latest test script for everyone. You should see every removable USB drive, or mounted CD/DVD listed.

Klaver7 · Aug 5, 2026

ok I get this

Code:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Users\jwdav> powershell -nop -ep bypass -f E:\Z_c2023\NOT_SMART2.ps1
PS C:\Users\jwdav>

kinda like nothing ...

garlin · Aug 5, 2026

Klaver7 said:

ok I get this

Code:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Users\jwdav> powershell -nop -ep bypass -f E:\Z_c2023\NOT_SMART2.ps1
PS C:\Users\jwdav>

kinda like nothing ...

What's the result?

Code:

Get-WmiObject -Class Win32_DiskDrive | where { $_.InterfaceType -eq 'USB' -and $_.MediaType -notmatch 'External' }

Klaver7 · Aug 5, 2026

Code:

PS C:\Users\jwdav> Get-WmiObject -Class Win32_DiskDrive | where { $_.InterfaceType -eq 'USB' -and $_.MediaType -notmatch 'External' }
PS C:\Users\jwdav>

Klaver7 · Aug 5, 2026

Did my Powershell die ?

Klaver7 · Aug 5, 2026

Nah it's still fine

Code:

PS C:\Users\jwdav> Get-WmiObject -Class Win32_DiskDrive | where { $_.InterfaceType -eq 'USB' -and $_.MediaType -notmatch 'External' }
PS C:\Users\jwdav> powershell -nop -ep bypass -f E:\Z_c2023\Check_BootMedia.ps1
Secure Boot: ON
Virtualization Based Security: ON

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 9.0

EFI Files
---------
    SkuSiPolicy.p7b is CURRENT.

PS C:\Users\jw

garlin · Aug 5, 2026

OK. Just USB devices...

Code:

Get-WmiObject -Class Win32_DiskDrive | where { $_.InterfaceType -eq 'USB' }

Klaver7 · Aug 5, 2026

Code:

Partitions : 1
DeviceID   : \\.\PHYSICALDRIVE3
Model      : PHILIPS USB Device
Size       : 31453470720
Caption    : PHILIPS USB Device

garlin · Aug 5, 2026

Get-WmiObject -Class Win32_DiskDrive | where { $_.InterfaceType -eq 'USB' } | fl *

Klaver7 · Aug 5, 2026

Code:

PS C:\Users\jwdav> Get-WmiObject -Class Win32_DiskDrive | where { $_.InterfaceType -eq 'USB' } | fl *


PSComputerName              : ASUTUF87G
ConfigManagerErrorCode      : 0
LastErrorCode               :
NeedsCleaning               :
Status                      : OK
DeviceID                    : \\.\PHYSICALDRIVE3
StatusInfo                  :
Partitions                  : 1
BytesPerSector              : 512
ConfigManagerUserConfig     : False
DefaultBlockSize            :
Index                       : 3
InstallDate                 :
InterfaceType               : USB
MaxBlockSize                :
MaxMediaSize                :
MinBlockSize                :
NumberOfMediaSupported      :
SectorsPerTrack             : 63
Size                        : 30778997760
TotalCylinders              : 3742
TotalHeads                  : 255
TotalSectors                : 60115230
TotalTracks                 : 954210
TracksPerCylinder           : 255
__GENUS                     : 2
__CLASS                     : Win32_DiskDrive
__SUPERCLASS                : CIM_DiskDrive
__DYNASTY                   : CIM_ManagedSystemElement
__RELPATH                   : Win32_DiskDrive.DeviceID="\\\\.\\PHYSICALDRIVE3"
__PROPERTY_COUNT            : 51
__DERIVATION                : {CIM_DiskDrive, CIM_MediaAccessDevice, CIM_LogicalDevice, CIM_LogicalElement...}
__SERVER                    : ASUTUF87G
__NAMESPACE                 : root\cimv2
__PATH                      : \\ASUTUF87G\root\cimv2:Win32_DiskDrive.DeviceID="\\\\.\\PHYSICALDRIVE3"
Availability                :
Capabilities                : {3, 4, 7}
CapabilityDescriptions      : {Random Access, Supports Writing, Supports Removable Media}
Caption                     :  USB  SanDisk 3.2Gen1 USB Device
CompressionMethod           :
CreationClassName           : Win32_DiskDrive
Description                 : Disk drive
ErrorCleared                :
ErrorDescription            :
ErrorMethodology            :
FirmwareRevision            : 1.00
Manufacturer                : (Standard disk drives)
MediaLoaded                 : True
MediaType                   : Removable Media
Model                       :  USB  SanDisk 3.2Gen1 USB Device
Name                        : \\.\PHYSICALDRIVE3
PNPDeviceID                 : USBSTOR\DISK&VEN__USB&PROD__SANDISK_3.2GEN1&REV_1.00\090182068849D6F5B1E34386D0BA2CA2B791
                              571D4FAB16BE929F0832DD74AB1
PowerManagementCapabilities :
PowerManagementSupported    :
SCSIBus                     : 0
SCSILogicalUnit             : 0
SCSIPort                    : 0
SCSITargetId                : 0
SerialNumber                : 0XXXXXXXXXXXXXXXXXXXX
Signature                   :
SystemCreationClassName     : Win32_ComputerSystem
SystemName                  : ASUTUF87G
Scope                       : System.Management.ManagementScope
Path                        : \\ASUTUF87G\root\cimv2:Win32_DiskDrive.DeviceID="\\\\.\\PHYSICALDRIVE3"
Options                     : System.Management.ObjectGetOptions
ClassPath                   : \\ASUTUF87G\root\cimv2:Win32_DiskDrive
Properties                  : {Availability, BytesPerSector, Capabilities, CapabilityDescriptions...}
SystemProperties            : {__GENUS, __CLASS, __SUPERCLASS, __DYNASTY...}
Qualifiers                  : {dynamic, Locale, provider, UUID}
Site                        :
Container                   :



PS C:\Users\jwdav>

Older USB bootable Macrium after june update

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer