Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

garlin · 2026-08-11T16:42:17-0400

wabbit said:
I'm still at SkuSiPolicy.p7b 3.0.0.16 after the latest windows update. SVN remains at 9.0.

We confirmed back in July (when SkuSiPolicy jumped to 3.0.0.16), that the Secure Boot task doesn't want to automatically copy the latest SkuSiPolicy to the EFI volume. It knows how, but it won't.

That's probably for safety reasons, as Windows doesn't know if copying the file will cause unintentional grief to a dual-boot setup. You have to force the copy yourself, or run the update script:

Code:

Update-UEFI.bat -SkuSiPolicy

Klaver7 · 2026-08-11T16:45:09-0400

garlin said:
We confirmed back in July (when SkuSiPolicy jumped to 3.0.0.16), that the Secure Boot task doesn't want to automatically copy the latest SkuSiPolicy to the EFI volume. It knows how, but it won't.

That's probably for safety reasons, as Windows doesn't know if copying the file will cause unintentional grief to a dual-boot setup. You have to force the copy yourself, or run the update script:

Code:

Update-UEFI.bat -SkuSiPolicy

Thats what I had to do to be up to date again.

garlin · 2026-08-11T16:50:52-0400

anchamp65 said:
WARNING: C:\WINDOWS\System32\SecureBootUpdates\SkuSiPolicy.p7b has an invalid or unsupported binary CI policy format version value: 0x0000000B. If you are sure that you are dealing with a binary code integrity policy, there is a high likelihood that Microsoft updated the binary file format to support new schema elements and that this code will likely need to be updated.

This warning is from Matt Graeber's original code.

When he wrote it, the highest known policy format was version 7. Since he knew the code might be used after he stopped work on it, it throws a warning to say "hey, I don't know what happens if you run my code without studying the newer version of the policy file".

I have no clue, since I'm not a Windows security researcher and don't have any interest in reverse-engineering this obscure policy format. In the Check_BootMedia.ps1 script, the warning is ignored.

wabbit · 2026-08-11T16:54:40-0400

garlin said:
We confirmed back in July (when SkuSiPolicy jumped to 3.0.0.16), that the Secure Boot task doesn't want to automatically copy the latest SkuSiPolicy to the EFI volume. It knows how, but it won't.

That's probably for safety reasons, as Windows doesn't know if copying the file will cause unintentional grief to a dual-boot setup. You have to force the copy yourself, or run the update script:

Code:

Update-UEFI.bat -SkuSiPolicy

And then rebuild the Macrium RE rescue media again. So I have 3 choices: Copy the new SkuSiPolicy file to the ESD partition, leave the existing file on the ESD partition, or just remove it from the ESD partition and not enforce the SkuSiPolicy. I just rebuilt my Macrium rescue media after the July update.

garlin · 2026-08-11T17:01:22-0400

Copying a newer .p7b file from the SecureBootUpdates folder to the EFI volume is trivial. But there's no supported mechanism for chasing down all the dependencies.

Which is why I keep suggesting the Macrium and Hasleo devs pay attention, and monitor when certain security settings change. And when they do, automatically notify the user "hey, time to rebuild your USB recovery drives". Because this is the "new normal", they need to adapt.

garlin · 2026-08-11T17:22:54-0400

And wimlib.net is back again.

anchamp65 · 2026-08-11T17:36:10-0400

garlin said:
Copying a newer .p7b file from the SecureBootUpdates folder to the EFI volume is trivial. But there's no supported mechanism for chasing down all the dependencies.

Which is why I keep suggesting the Macrium and Hasleo devs pay attention, and monitor when certain security settings change. And when they do, automatically notify the user "hey, time to rebuild your USB recovery drives". Because this is the "new normal", they need to adapt.

I followed your suggestion and I'm not enforcing SkuSiPolicy since I'm using Macrium and intend to use it or another imaging software for the foreseeable future...

garlin · 2026-08-11T17:51:06-0400

anchamp65 said:

Code:

DriveLetter FriendlyName             FileSystemType DriveType HealthStatus OperationalStatus SizeRemaining      Size
----------- ------------             -------------- --------- ------------ ----------------- -------------      ----
G           MACRIUM_PE               FAT32          Removable Healthy      OK                     765.8 MB   1.99 GB
I           MACRIUM_PE               FAT32          Removable Healthy      OK                    447.11 MB   1020 MB
J           Rescue                   Unknown        CD-ROM    Healthy      OK                          0 B   1.25 GB
H           RESCUE                   FAT32          Fixed     Healthy      OK                      2.48 GB   3.72 GB

So basically your H: drive is GPT + FAT32?

anchamp65 · 2026-08-11T18:10:08-0400

garlin said:
So basically your H: drive is GPT + FAT32?

Yes, Rufus suggest GTP + FAT32 and I just let it do that without changing anything.
If I create the USB from Macrium (G: & I:), it wants MBR and creates the FAT32 partition.

garlin · 2026-08-11T18:13:47-0400

I'm gonna pretend I don't know you strange people on the web.

garlin · 2026-08-11T18:24:10-0400

UPDATE: 2026-08-11

1. [Feature Request] Add .wim and .iso file support for -BootMedia
2. Get-Volume doesn't reliably find removable USB drives in PowerShell 7 (pwsh)
3. Remove the restriction to ignore Hasleo Backup Suite's staging folders for versions 5.8.2.2 and later
4. Fix reporting on the W10 release name when checking a WIM image
5. Add feature to check the current WinRE from Check_BootMedia.ps1
6. Remove boot.stl checking if mounted drive is missing install WIM/ESD
7. Non-Windows boot files were reported as BANNED
8. Check_DBXUpdate.bin.ps1 does not ignore invalid command-line parameters
9. Add -Quiet option to Check_BootMedia.ps1
10. Check for Secure-Boot-Update task status in Check_UEFI-CA2023.ps1 & Update_UEFI-CA2023.ps1 scripts

Check_BootMedia.ps1 will now read from individual WIM and ISO files.

Code:

Check-BootMedia D:\sources\boot.wim R:\folder\Windows11.iso

Check_BootMedia.ps1 can now find a lot more removable media devices (except for @anchamp65's Frankenstein GPT + FAT32 Macrium recovery drive).

There's no longer a restriction on ignoring the WinPE staging folders on later versions of Hasleo. All versions are treated equally.

Your current WinRE can be checked (it's a WIM file).

Code:

Check-BootMedia -WinRE

boot.stl checking is only done when there is an install WIM/ESD on the device. The warning about matching boot.stl doesn't apply when you're using boot.wim as a platform, and no install is intended.

Fixed a problem where 3rd-party boot files (Rufus and Ventoy) were incorrectly tagged as BANNED.

After July 2026's CU, some users report their PC's locking up shortly after reboot. Disabling the Secure Boot task appears to temporarily fix the problem. Added checking to confirm if the task is disabled or removed. If you removed the task, MS provides a script for recreating it.

Klaver7 · 2026-08-11T18:34:05-0400

Code:

Windows Recovery
----------------
    \\.\HarddiskVolume4\Recovery\WindowsRE\Winre.wim:1 (W11 24H2 26100.1)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        winload.efi is ALLOWED


PS C:\Users\

thing boots everything but is that W11 24H2 26100.1 correct ? I know I am getting OLD

Klaver7 · 2026-08-11T18:36:16-0400

as I dont see no 24H2 here:

Code:

Details for image : \\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE\winre.wim

Index : 1
Name : Microsoft Windows Recovery Environment (amd64)
Description : Microsoft Windows Recover Environment (amd64)
Size : 3,218,126,030 bytes
WIM Bootable : No
Architecture : x64
Hal : <undefined>
Version : 10.0.26100
ServicePack Build : 9168
ServicePack Level : 0
Edition : WindowsPE
Installation : WindowsPE
ProductType : WinNT
ProductSuite :
System Root : WINDOWS
Directories : 4698
Files : 21288
Created : 4/1/2024 - 9:51:35 AM
Modified : 8/11/2026 - 7:31:39 PM
Languages :
        en-US (Default)
The operation completed successfully.

C:\Windows\System32>

TheVisitor · 2026-08-11T18:52:32-0400

Just download the new update 8-11 from github ran two files both throw errors:
PS C:\Windows\System32> powershell -nop -ep bypass -f C:\temp17\check_bootmedia.ps1
Secure Boot: ON
Virtualization Based Security: ON

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0

EFI Files
---------
SkuSiPolicy.p7b is CURRENT.

Hasleo 5.9.2.1
--------------
WinPE Boot Manager [Windows UEFI CA 2023] is BANNED.
You cannot call a method on a null-valued expression.
At C:\temp17\check_bootmedia.ps1:2393 char:9
+ $RemovableDrives = @(
+ ~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull

batfile:
ecure Boot: ON
Virtualization Based Security: ON

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0

EFI Files
---------
SkuSiPolicy.p7b is CURRENT.

Hasleo 5.9.2.1
--------------
WinPE Boot Manager [Windows UEFI CA 2023] is BANNED.
InvalidOperation: C:\Temp17\Check_BootMedia.ps1:2393
Line |
2393 | $RemovableDrives = @(
| ~~~~~~~~~~~~~~~~~~~~~
| You cannot call a method on a null-valued expression.

PerpetualCycle · 2026-08-11T19:02:52-0400

All my disk drives are listed as DVD, but I know they aren't

garlin · 2026-08-11T19:41:31-0400

Klaver7 said:
as I dont see no 24H2 here:

Klaver7 said:
Code:

Version : 10.0.26100 ServicePack Build : 9168

There is nothing wrong with your screen. WinRE is a special version of WinPE (it's WinPE + extra parts).

The build is 26100.9168 or 24H2. WinPE isn't a fully functional Windows, so there's no point have a 25H2 Enablement Package installed to trick it into reporting it's 25H2.

TheVisitor · 2026-08-11T19:56:23-0400

I give up... new updates is giving error codes and not showing any of my USB drives.

Hasleo 5.9.2.1
--------------
WinPE Boot Manager [Windows UEFI CA 2023] is BANNED.
C:\Program Files\Hasleo\Hasleo Backup Suite\bin\WADK\Boot\EFI_EX\bootmgfw.efi
File Version: 26100.30227, SVN 7.0
You cannot call a method on a null-valued expression.
At C:\temp17\check_bootmedia.ps1:2393 char:9
+ $RemovableDrives = @(
+ ~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull

SVN is wrong showing 7.0, was 9.0 before todays MS update.

anchamp65 · 2026-08-11T19:57:45-0400

garlin said:
Check_BootMedia.ps1 can now find a lot more removable media devices (except for @anchamp65's Frankenstein GPT + FAT32 Macrium recovery drive).

Totally agree, don't do any more work on my Frankenstein USB
I'll try tomorrow to have Rufus Create MBR + FAT32 and see
If it works and your script catches it, good for me, if not, too bad for me...!

Your script already can validate my ISO from Macrium, so I'm already covered for my usage pattern.

Thanks Garlin for all you do for us all !!!

TheVisitor · 2026-08-11T20:09:09-0400

TheVisitor said:
I give up... new updates is giving error codes and not showing any of my USB drives.

Hasleo 5.9.2.1
--------------
WinPE Boot Manager [Windows UEFI CA 2023] is BANNED.
C:\Program Files\Hasleo\Hasleo Backup Suite\bin\WADK\Boot\EFI_EX\bootmgfw.efi
File Version: 26100.30227, SVN 7.0
You cannot call a method on a null-valued expression.
At C:\temp17\check_bootmedia.ps1:2393 char:9
+ $RemovableDrives = @(
+ ~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull

SVN is wrong showing 7.0, was 9.0 before todays MS update.

I just tried my Sandisk and it no longer boots - says system needs repair or something like that. Back to drawing board to figure out how to create a rescue disk/usb in Hasleo

anchamp65 · 2026-08-11T22:32:55-0400

TheVisitor said:
I just tried my Sandisk and it no longer boots - says system needs repair or something like that. Back to drawing board to figure out how to create a rescue disk/usb in Hasleo

Could it be that Hasleo has detected an update and it triggered an update of its staging and while updating it, it actually brought back unsupported boot loader...

I'm probably wrong, but hey, maybe I'm not... ! ?

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Syzygy

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer