Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

anchamp65 · 2026-08-09T10:51:39-0400

garlin said:
Would a 3rd-option work for the dissenters?

Normal: is ALLOWED
Quiet: (nothing)
Verbose: is ALLOWED

The reason the script originally printed so much text was to avoid any possible confusion. You wouldn't assume any detail was good or bad, it was always stated for you. But now I can see if you got lots of drives to check, the output gets painful to read.

Suggestion, if the quiet mode is used, maybe only print what is banned or not at the good version
If all test pass, then just write something like "All good" or "All secure boot info is up to date"
That way, people that only want to see what's not good could use the quiet mode and get just that

I don't really know the impact it would have on your code...
So, I let you be the judge of that and see if it's worth the effort

Again, your code, so you have the final word

Klaver7 · 2026-08-09T12:17:21-0400

I thought it was allready in there .. ?

Code:

AUDIT REPORT
============
    PASSED ALL CHECKS.

STATUS REPORT
-------------
    Registry: "UEFICA2023Status" = Updated

    SUCCESS: UPDATES ARE FINISHED

garlin · 2026-08-09T12:30:30-0400

I think @anchamp65 is talking about the Boot Media status. Your BIOS may be updated, but your drives aren't.

anchamp65 · 2026-08-09T12:45:33-0400

@garlin I used your last version of Check_BootMedia from post #3206 and I'm getting this error

Code:

Macrium v10.0.8843
------------------
    WinRE Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Bootable Media
--------------
Check-DriveVolume : Cannot bind argument to parameter 'DriveLetter' because it is an empty string.
At E:\tmp\Check_BootMedia.ps1:2357 char:52
+                     Check-DriveVolume -DriveLetter $Drive
+                                                    ~~~~~~
    + CategoryInfo          : InvalidData: (:) [Check-DriveVolume], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAllowed,Check-DriveVolume

It's coming from the loop on $Drive and it only happens if I don't have any USB drive connected.
It doesn't matter if a CD-ROM (or virtual or not), it's only when no USB drives are present.
All week I tested your different versions having both my USB (config as FIXED) and Macrium ISO mounted on virtual CD-ROM.
So never tested without a USB...

I broke down the statement (line 2347) where you build the list and it seems to be related to last part, the last piping.
"Get-CimAssociatedInstance -ResultClassName Win32_LogicalDisk).DeviceID"
I ran a few test, and for some reason that part seems to find something and the resulting array as a count of 1 and not 0
But the resulting array is empty

Code:

PS E:\Tmp> $x = @((Get-CimInstance -Class Win32_DiskDrive -Filter 'InterfaceType = "USB"' -KeyOnly |
>>    Get-CimAssociatedInstance -ResultClassName Win32_DiskPartition -KeyOnly |
>>    Get-CimAssociatedInstance -ResultClassName Win32_LogicalDisk).DeviceID)
PS E:\Tmp> $x.count
1
PS E:\Tmp> $x = @((Get-CimInstance -Class Win32_DiskDrive -Filter 'InterfaceType = "USB"' -KeyOnly |
>>    Get-CimAssociatedInstance -ResultClassName Win32_DiskPartition -KeyOnly))
PS E:\Tmp> $x.count
0
PS E:\Tmp> $x = @((Get-CimInstance -Class Win32_DiskDrive -Filter 'InterfaceType = "USB"' -KeyOnly |
>>    Get-CimAssociatedInstance -ResultClassName Win32_DiskPartition -KeyOnly |
>>    Get-CimAssociatedInstance -ResultClassName Win32_LogicalDisk).DeviceID)
PS E:\Tmp> $x.count
1
PS E:\Tmp> write-host "---$x---"
------
PS E:\Tmp>

Klaver7 · 2026-08-09T13:06:44-0400

look at 3,169 I had a "blond" moment" lol

anchamp65 · 2026-08-09T13:09:27-0400

Klaver7 said:
look at 3,169 I had a "blond" moment" lol

True, I forgot you had posted that
But, maybe Garlin will want to check it out, or not
In my usage pattern, I would like to check the Macrium staging folder and the ISO Macrium created
As for putting the ISO on a USB, I never encountered a problem while using Rufus that the USB with the ISO on it would not work

garlin · 2026-08-09T15:18:31-0400

anchamp65 said:
+ CategoryInfo : InvalidData: (:) [Check-DriveVolume], ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAllowed,Check-DriveVolume

Run this test script. Does it finish without errors?

anchamp65 · 2026-08-09T16:59:59-0400

garlin said:
Run this test script. Does it finish without errors?

Seems to do the job

Code:

PS E:\Tmp> powershell -nop -ep bypass -f E:\tmp\TEST.ps1  # no USB
Count: 0
PS E:\Tmp> powershell -nop -ep bypass -f E:\tmp\TEST.ps1  # inserted USB
Count: 1
|H|
PS E:\Tmp> powershell -nop -ep bypass -f E:\tmp\TEST.ps1  # removed USB
Count: 0
PS E:\Tmp>

anchamp65 · 2026-08-09T17:06:30-0400

I replaced the the section in your Check_BootMedia script with your fix and works !
Thanks again and again and again !

anchamp65 · 2026-08-09T17:11:18-0400

where { $_ -match '[A-Z]' }

Such a simple solutions !
And it can't affect anyone else's usage
Beautiful !!!

garlin · 2026-08-09T17:20:03-0400

In theory I shouldn't have to match by a valid letter character. Unless it's a stupid "null" which isn't a $null. Again.

Ghot · 2026-08-09T17:36:37-0400

@garlin

I just wiped out my comp (software wise) Something about a winefi load problem
ERROR 0x0000225 when I try and boot to windows

I made a win 11 install USB on friends comp.
It starts the install then tells me the comp dooesn't support Secure boot (which it does)
Secure boot is enabled in the BIOS.
BIOS is set to UEFI Bios.

Problem started when I canceled a macrium Restore. Something about a winefi load problem
Tried using Macrium again... it just gets stuck loading high power something or other.

I'm guessing something with the keys in the BIOS?

Kinda need help asap.

Edit: In my BIOS Secure Boot is enabled and greyed out... I see no way to disable Secure Boot

Quandary · 2026-08-09T17:37:19-0400

garlin said:
Run this test script. Does it finish without errors?

It finished normally with return 0 (no drive letter)when the Rufus created USB plugged in. With a Hasleo USB it returns the drive letter, and with the Ventoy USB it return two drive letters.

garlin · 2026-08-09T17:41:33-0400

Ghot said:
@garlin
I made a win 11 install USB on friends comp.
It starts the install then tells me the comp dooesn't support Secure boot (which it does)
Secure boot is enabled in the BIOS.
BIOS is set to UEFI Bios.

Secure Boot keys are kept in the UEFI, outside of your OS. They persist no matter how many times you replaced a drive or reinstalled from scratch. And the install process doesn't touch any Secure Boot settings.

You made an USB drive on friend's PC. Was this ISO updated for CA 2023 while you were there? Maybe it's got the CA 2011 files for booting. Short term answer: temporarily Secure Boot so you can finish the install. Worry about it once you have a functional system.

With a full Windows, you can check if your Secure Boot status was the same as before the install (minus Secure Boot off). Then you can run the Check_BootMedia.ps1 script to confirm the install USB was updated.

garlin · 2026-08-09T17:46:03-0400

Quandary said:
It finished normally with return 0 (no drive letter)when the Rufus created USB plugged in. With a Hasleo USB it returns the drive letter, and with the Ventoy USB it return two drive letters.

That's strange. I would imagine Rufus should show up, unless it's dependent on how the volumes are formatted or written. Gotta be some weird criteria for why Get-Volume doesn't always match a drive letter to an USB device.

Ghot · 2026-08-09T17:46:26-0400

garlin said:
Short term answer: temporarily Secure Boot

Problem is that in my BIOS there is no way I can see to disable Secure Boot... it's greyed out... it says enabled?
CSM is enabled and set to UEFI and Legacy... and it's set to UEFI BIOS

Would changing it to "Other OS" disable Secure Boot?

garlin · 2026-08-09T17:50:08-0400

Ghot said:
Problem is that in my BIOS there is no way I can see to disable Secure Boot... it's greyed out... it says enabled?
CSM is enabled and set to UEFI and Legacy... and it's set to UEFI BIOS

Would changing it to "Other OS" disable Secure Boot?

Secure Boot is only allowed in pure UEFI mode. No CSM or UEFI + CSM modes.

Ghot · 2026-08-09T17:51:09-0400

garlin said:
Secure Boot is only allowed in pure UEFI mode. No CSM or UEFI + CSM modes.

I'll try that now

Win 11 is installing

garlin · 2026-08-09T17:52:15-0400

@Quandary Are the Rufus and Ventoy drives using the same USB drive model? Or different models?

I'm wondering if you want to try an experiment. Remake the Rufus drive as a Ventoy drive. Remake the Ventoy drive as a Rufus drive. Does the problem follow how each tool formats the drive, or is it something based on specific drive models?

Ghot · 2026-08-09T18:11:52-0400

@garlin

Ok, I'm on Win 11 (new). I'm going to try to restore my backup

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers