Works for me
Macrium v10.0.8843
------------------
WinRE Boot Manager [Windows UEFI CA 2023] is ALLOWED.
E:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.352, SVN 9.0
Bootable Media
--------------
DVD Drive G: "Rescue"
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
G:\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.352, SVN 9.0
boot.wim:1 (WinRE 26100.1)
Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\Windows\Boot\EFI_EX\bootmgfw_EX.efi
File Version: 28000.352, SVN 9.0
\Windows\System32\winload.efi is ALLOWED.
File Version: 26100.8875
DVD Drive H: "RESCUE"
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
H:\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.352, SVN 9.0
boot.wim:1 (WinRE 26100.1)
Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\Windows\Boot\EFI_EX\bootmgfw_EX.efi
File Version: 28000.352, SVN 9.0
\Windows\System32\winload.efi is ALLOWED.
File Version: 26100.8875
UEFI DBX Certs
--------------
Microsoft Windows PCA 2010
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0
EFI Files
---------
SkuSiPolicy.p7b is CURRENT.
\\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
Version: 3.0.0.16
FileRule MinimumFileVersion MaximumFileVersion
-------- ------------------ ------------------
ID_FILEATTRIB_F_0042 0.0.0.0 10.0.14393.9309
ID_FILEATTRIB_F_0044 10.0.14400.0 10.0.17763.8979
ID_FILEATTRIB_F_0040 10.0.18000.0 10.0.19041.7519
ID_FILEATTRIB_F_0049 10.0.19100.0 10.0.20348.5359
ID_FILEATTRIB_F_0047 10.0.20400.0 10.0.22621.7349
ID_FILEATTRIB_F_0041 10.0.23000.0 10.0.26100.8835
ID_FILEATTRIB_F_0043 10.0.26100.32000 10.0.26100.33099
ID_FILEATTRIB_F_0048 10.0.26172.0 10.0.26172.33099
ID_FILEATTRIB_F_0046 10.0.27000.0 10.0.28000.2489
ID_FILEATTRIB_F_0045 10.0.29426.0 65535.65535.65535.65535
Hasleo 5.9.2.1
--------------
C:\Program Files\Hasleo\Hasleo Backup Suite\bin\WADK\Windows Preinstallation Environment\amd64\winpe.wim:1 (WinPE 26100.1)
Boot Manager [Windows UEFI CA 2023] is BANNED.
\Windows\Boot\EFI_EX\bootmgfw_EX.efi
File Version: 26089.1001, SVN 2.0
\Windows\System32\winload.efi is BANNED.
File Version: 26100.1
Get-Volume: C:\Users\nelson\Desktop\Check_BootMedia.ps1:344
Line |
344 | Get-Volume -DriveLetter $Drive
| ~~~~~~
| Cannot validate argument on parameter 'DriveLetter'. The argument is null. Provide a valid
| value for the argument, and then try running the command again.
Bootable Media
--------------
USB Drive D: "HASLEOBS"
Boot File [Windows UEFI CA 2023] is ALLOWED.
D:\EFI\Boot\bootx64.efi
File Version: 28000.352, SVN 9.0
D:\EFI\Microsoft\Boot\boot.stl [5/18/2026 1:44 PM] is CURRENT.
boot.wim:1 (WinPE 26100.1)
Boot Manager [Windows UEFI CA 2023] is BANNED.
\Windows\Boot\EFI_EX\bootmgfw_EX.efi
File Version: 26089.1001, SVN 2.0
\Windows\System32\winload.efi is BANNED.
File Version: 26100.1
PS C:\Users\nelson\Desktop> if ($DriveType -eq 'USB') {
Validate-BootStl "$DriveLetter\EFI\Microsoft\Boot\boot.stl"
}The theory being a Windows ISO will include the correct version of boot.stl for that ISO. And users don't normally modify their ISO file.
The Flintstone trick works to search for USB devices, but I also need to support reading ISO files. So we're throwing two different data sets into the same queue:
$RemovableDrives = @(
# This one filters for USB media
((Get-CimInstance -Class Win32_DiskDrive -Filter 'InterfaceType = "USB"' -KeyOnly | Get-CimAssociatedInstance -ResultClassName Win32_DiskPartition -KeyOnly | Get-CimAssociatedInstance -ResultClassName Win32_LogicalDisk).DeviceID | where { $_ -ne $null } | foreach { $_ -replace ':' }),
# This one adds the ISO's
(Get-Volume | where { $_.DriveType -eq 'CD-ROM' -and $_.DriveLetter -ne $null -and $_.OperationalStatus -eq 'OK' }).DriveLetter
)After you've installed the June 2026 (or later) CU, Windows has updated the DBX SVN to 9.0.
I'm still getting that :;
Thanks for the explanation. I have tested both USB's and they still boot into Macrium Rescue okay. I'll install Macrium v8.0 again at some point and rebuild the USB's.
But that is assuming it's a Windows ISO
I fully understand and agree with you on this
For that to happen, does Hasleo or Macrium create a finalized .ISO file for you? I honestly don't know. My experience is both tools want to format and write a finished image to your USB drive.
No, because the root of the original problem are USB drives which are marked Fixed instead of Removable. But both drives are still USB (based on the controller type).It's just that testing the bootl.stl for both USB and ISO (when not Windows ISO) would make sens
It would just tell users, yup your boot.stl is good or not for any USB or CD-ROM
Obviously, removing the "if ($DriveType -eq 'USB')" at line 1974 would address my misconfigured USB that reports as "Fixed"
But it's not your fault I have a misconfigured USB drive
UEFI DBX Certs
--------------
Microsoft Windows PCA 2010
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0
EFI Files
---------
SkuSiPolicy.p7b is CURRENT.
Hasleo 5.9.2.1
--------------
C:\Program Files\Hasleo\Hasleo Backup Suite\bin\WADK\Windows Preinstallation Environment\amd64\winpe.wim:1 (WinPE 26100.1)
Boot Manager [Windows UEFI CA 2023] is BANNED.
winload.efi is BANNED.
Bootable Media
--------------
USB Drive D: "HASLEOBS"
Boot File [Windows UEFI CA 2023] is ALLOWED.
boot.stl is CURRENT.
boot.wim:1 (WinPE 26100.1)
Boot Manager [Windows UEFI CA 2023] is BANNED.
winload.efi is BANNED.
PS C:\Users\nelson\Desktop>Actually, I tested/used Macrium, Hasleo, Paragon, Veeam, Ghost and others that I can't remember the names over the years. I always use the pattern: create ISO and write ISO to a USB. The reason is that I also backup the ISO to a backup drive in case the USB stops working. I also have off site copy of my backups. Old habbit from when I had my own business and needed off site backups. I just kept doing it afterwards... But we disgress....
Again, I agree with you
