Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

garlin · 2026-08-06T16:11:51-0400

Fracer said:
Just wanted to double-check [Macrium 8.0] recovery media is solid...

Fracer said:
USB Drive F: "RESCUEM93P2"
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
F:\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.352, SVN 9.0

F:\EFI\Microsoft\Boot\boot.stl [Mon 05/18/2026 11:44 AM] is CURRENT.

boot.wim:1 (WinRE 26100.1)
Boot Manager [Windows UEFI CA 2023] is BANNED.
\Windows\Boot\EFI_EX\bootmgfw_EX.efi
File Version: 26100.30227, SVN 7.0

\Windows\System32\winload.efi is BANNED.
File Version: 26100.7149

No, your boot.wim isn't current. This is what you can do:

1. Temporarily disable WinRE, so the winre.wim is pulled back into the \Windows\System32\Recovery folder.

Code:

reagentc /info
reagentc /disable

2. From Macrium, use the Advanced Options / Options to import from your own WIM file. Select "\Windows\System32\Recovery\winre.wim".

This file is marked hidden and system. So just type in the full path, instead of searching from the file browser window.

3. Build a new Recovery drive.

4. Re-enable WinRE, restoring the winre.wim back to the Recovery volume.

Code:

reagentc /enable
reagentc /info

KevTech · 2026-08-06T16:30:00-0400

Not sure why Macrium is not giving people the option to use the 2023 if building with WinRE wim.

They still expect nobody to revoke 2011.

Option in advanced to build with 2023 is only available if building with PE wim as the option is missing for RE wim.

garlin · 2026-08-06T16:34:30-0400

"You can lead a horse to water. But you can't make him drink."

KevTech · 2026-08-06T17:01:25-0400

I was able to get 2023 and no SVN error with WinRE on macrium without having to use a custom wim.

Once you create rescue media the files will be in the boot folder Macrium stored the RE files in.

As long as you do not rebuild the wim then the files are just used from this location.

So I just did this copy then created rescue media again.

Code:

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi C:\Boot\macrium\WinREFiles\media\EFI\Boot\bootx64.efi

I also know I can just copy the file after the media is created.

Code:

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi F:\EFI\boot\bootx64.efi

Exploring different ways until Macrium address this issue.

Klaver7 · 2026-08-06T17:27:25-0400

OK am I missing something

Code:

PS C:\Users\jwdav> powershell -nop -ep bypass -f E:\Z_c2023\Check_BootMedia.ps1 -audit -verbose
Windows 11 25H2 (26200.8875)

Secure Boot: ON
Virtualization Based Security: ON

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 9.0

EFI Files
---------
    SkuSiPolicy.p7b is CURRENT.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
        Version: 3.0.0.16

    FileRule             MinimumFileVersion MaximumFileVersion
    --------             ------------------ ------------------
    ID_FILEATTRIB_F_0042 0.0.0.0            10.0.14393.9309
    ID_FILEATTRIB_F_0044 10.0.14400.0       10.0.17763.8979
    ID_FILEATTRIB_F_0040 10.0.18000.0       10.0.19041.7519
    ID_FILEATTRIB_F_0049 10.0.19100.0       10.0.20348.5359
    ID_FILEATTRIB_F_0047 10.0.20400.0       10.0.22621.7349
    ID_FILEATTRIB_F_0041 10.0.23000.0       10.0.26100.8835
    ID_FILEATTRIB_F_0043 10.0.26100.32000   10.0.26100.33099
    ID_FILEATTRIB_F_0048 10.0.26172.0       10.0.26172.33099
    ID_FILEATTRIB_F_0046 10.0.27000.0       10.0.28000.2489
    ID_FILEATTRIB_F_0045 10.0.29426.0       65535.65535.65535.65535



Macrium v10.0.8843
------------------
    WinRE Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

PS C:\Users\jwdav>

Just made this with Macrium X tonight, now we grab an older USB Media fromWednesday, ‎April ‎22, ‎2026, ‏‎4:24:32 AM

Code:

PS C:\Users\jwdav> powershell -nop -ep bypass -f E:\Z_c2023\Check_BootMedia.ps1 -audit -verbose
Windows 11 25H2 (26200.8875)

Secure Boot: ON
Virtualization Based Security: ON

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 9.0

EFI Files
---------
    SkuSiPolicy.p7b is CURRENT.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
        Version: 3.0.0.16

    FileRule             MinimumFileVersion MaximumFileVersion
    --------             ------------------ ------------------
    ID_FILEATTRIB_F_0042 0.0.0.0            10.0.14393.9309
    ID_FILEATTRIB_F_0044 10.0.14400.0       10.0.17763.8979
    ID_FILEATTRIB_F_0040 10.0.18000.0       10.0.19041.7519
    ID_FILEATTRIB_F_0049 10.0.19100.0       10.0.20348.5359
    ID_FILEATTRIB_F_0047 10.0.20400.0       10.0.22621.7349
    ID_FILEATTRIB_F_0041 10.0.23000.0       10.0.26100.8835
    ID_FILEATTRIB_F_0043 10.0.26100.32000   10.0.26100.33099
    ID_FILEATTRIB_F_0048 10.0.26172.0       10.0.26172.33099
    ID_FILEATTRIB_F_0046 10.0.27000.0       10.0.28000.2489
    ID_FILEATTRIB_F_0045 10.0.29426.0       65535.65535.65535.65535



Macrium v10.0.8843
------------------
    WinRE Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

PS C:\Users\jwdav>

And I get the same result, even done a file compare with the text files and they are the same, till I boot the April USB

Klaver7 · 2026-08-06T17:31:30-0400

@KevTech I do the same to copy over the c2023 certificates with Macrium free, X. I just update the Boot folder on C

Dirtyflash · 2026-08-06T17:35:43-0400

KevTech said:
I was able to get 2023 and no SVN error with WinRE on macrium without having to use a custom wim.

Once you create rescue media the files will be in the boot folder Macrium stored the RE files in.

As long as you do not rebuild the wim then the files are just used from this location.

So I just did this copy then created rescue media again.

Code:

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi C:\Boot\macrium\WinREFiles\media\EFI\Boot\bootx64.efi

I also know I can just copy the file after the media is created.

Code:

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi F:\EFI\boot\bootx64.efi

Exploring different ways until Macrium address this issue.

I did the same and it seemed to fix things up.

Before and after:

KevTech · 2026-08-06T18:08:28-0400

Klaver7 said:
And I get the same result, even done a file compare with the text files and they are the same, till I boot the April USB

Do this on the April USB as it will update from Windows then you should not get SVN mismatch.

Change F: to the drive letter of your USB.

Code:

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi F:\EFI\boot\bootx64.efi

Quandary · 2026-08-06T18:13:08-0400

Another interesting twist. I temporarily disabled WinRE and did a build. In this configuration Hasleo gave the option to download from MS or use an Offline. I chose download. This the result below, after the USB was created, suggest that the winload.efi on the system and boot.wim on the USB are both 26100.1, and not a later version.

Hasleo 5.9.2.1
--------------
C:\Program Files\Hasleo\Hasleo Backup Suite\bin\WADK\Windows Preinstallation Environment\amd64\winpe.wim:1 (WinPE 26100.1)
Boot Manager [Windows UEFI CA 2023] is BANNED.
\Windows\Boot\EFI_EX\bootmgfw_EX.efi
File Version: 26089.1001, SVN 2.0

\Windows\System32\winload.efi is ALLOWED.
File Version: 26100.1

WinPE Boot Manager [Windows UEFI CA 2023] is ALLOWED.
C:\Program Files\Hasleo\Hasleo Backup Suite\bin\WADK\Boot\EFI_EX\bootmgfw.efi
File Version: 28000.352, SVN 9.0

Bootable Media
--------------

USB Drive H: "HASLEOBS"
Boot File [Production PCA 2011] is BANNED.
H:\EFI\Boot\bootx64.efi
File Version: 28000.352, SVN 9.0

H:\EFI\Microsoft\Boot\boot.stl [2026-05-18 1:44 PM] is CURRENT.

boot.wim:1 (WinPE 26100.1)
Boot Manager [Windows UEFI CA 2023] is BANNED.
\Windows\Boot\EFI_EX\bootmgfw_EX.efi
File Version: 26089.1001, SVN 2.0

\Windows\System32\winload.efi is ALLOWED.
File Version: 26100.1

Klaver7 · 2026-08-06T18:21:40-0400

KevTech said:
Do this on the April USB as it will update from Windows then you should not get SVN mismatch.

Change F: to the drive letter of your USB.

Code:

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi F:\EFI\boot\bootx64.efi

Not the problem, the script quits after:

Code:

Macrium v10.0.8843
------------------
    WinRE Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

It dont read my USB stick

I checked with an older version of Check_UEFI-CA2023.ps1 -BootMedia and voila it shows up

Asus272 · 2026-08-06T18:42:34-0400

Klaver7 said:
Not the problem, the script quits after:

Code:

Macrium v10.0.8843 ------------------ WinRE Boot Manager [Windows UEFI CA 2023] is ALLOWED. c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi File Version: 28000.352, SVN 9.0

It dont read my USB stick

I checked with an older version of Check_UEFI-CA2023.ps1 -BootMedia and voila it shows up

Did you get this error? I have Macruim v10.0.8843 also.

Line |
344 | Get-Volume -DriveLetter $Drive
| ~~~~~~
| Cannot validate argument on parameter 'DriveLetter'. The argument is null. Provide a valid value for the
| argument, and then try running the command again.

Klaver7 · 2026-08-06T18:44:44-0400

Asus272 said:
Did you get this error? I have Macruim v10.0.8843 also

I did at first but turned out that I didnt download the last version as there's a couple floating around

Klaver7 · 2026-08-06T19:03:23-0400

The one on Github also craps out after Macrium info ...

Code:

EFI Files
---------
    SkuSiPolicy.p7b is CURRENT.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
        Version: 3.0.0.16

    FileRule             MinimumFileVersion MaximumFileVersion
    --------             ------------------ ------------------
    ID_FILEATTRIB_F_0042 0.0.0.0            10.0.14393.9309
    ID_FILEATTRIB_F_0044 10.0.14400.0       10.0.17763.8979
    ID_FILEATTRIB_F_0040 10.0.18000.0       10.0.19041.7519
    ID_FILEATTRIB_F_0049 10.0.19100.0       10.0.20348.5359
    ID_FILEATTRIB_F_0047 10.0.20400.0       10.0.22621.7349
    ID_FILEATTRIB_F_0041 10.0.23000.0       10.0.26100.8835
    ID_FILEATTRIB_F_0043 10.0.26100.32000   10.0.26100.33099
    ID_FILEATTRIB_F_0048 10.0.26172.0       10.0.26172.33099
    ID_FILEATTRIB_F_0046 10.0.27000.0       10.0.28000.2489
    ID_FILEATTRIB_F_0045 10.0.29426.0       65535.65535.65535.65535



Macrium v10.0.8843
------------------
    WinRE Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

PS C:\Users\

KevTech · 2026-08-06T19:09:15-0400

Garlin been updating the checkbootmedia.

https://www.elevenforum.com/t/garlins-powershell-scripts-for-updating-secure-boot-ca-2023.43423/post-770237

Klaver7 · 2026-08-06T19:15:11-0400

KevTech said:
Garlin been updating the checkbootmedia.

https://www.elevenforum.com/t/garlins-powershell-scripts-for-updating-secure-boot-ca-2023.43423/post-770237

Try #3,115 the one you point me to has severe errors

Klaver7 · 2026-08-06T20:26:30-0400

Cheers for the Man that helps us get through 2023 certificate's mess that Microsoft created !

garlin · 2026-08-06T23:05:10-0400

Klaver7 said:
Try #3,115 the one you point me to has severe errors

The change btw post #3108 and #3115 is fixing the "null filter".

Code:

% diff Check_BootMedia_3108.ps1  Check_BootMedia_3115.ps1
339c339
<         ((Get-CimInstance -Class Win32_DiskDrive -Filter 'InterfaceType = "USB"' -KeyOnly | Get-CimAssociatedInstance -ResultClassName Win32_DiskPartition -KeyOnly | Get-CimAssociatedInstance -ResultClassName Win32_LogicalDisk).DeviceID | where { $_ -ne $null } | foreach { $_ -replace ':' }),
---
>         ((Get-CimInstance -Class Win32_DiskDrive -Filter 'InterfaceType = "USB"' -KeyOnly | Get-CimAssociatedInstance -ResultClassName Win32_DiskPartition -KeyOnly | Get-CimAssociatedInstance -ResultClassName Win32_LogicalDisk).DeviceID | foreach { $_ -replace ':' }),
344c344,346
<         Get-Volume -DriveLetter $Drive
---
>         if ($Drive -ne $null ) {
>             Get-Volume -DriveLetter $Drive
>         }

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer