Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

garlin · 2026-08-12T21:26:50-0400

Fixed it.

Scott · 2026-08-13T00:34:56-0400

garlin said:
Try this version.

UPDATED version

garlin · 2026-08-13T01:12:38-0400

Hmmmm, abbodi's backup of wimlib is version 1.4.1 (not 1.4.5). Maybe it's too old for our needs. I added a step to use Wayback Machine as a backup source.

1. Delete the wimlib in the temp file (only do this once):

Code:

del $env:TEMP\wimlib-imagex.exe
del $env:TEMP\libwim-15.dll

2. Run latest version of script.

Scott · 2026-08-13T01:36:39-0400

@garlin
Same result.

garlin · 2026-08-13T01:44:08-0400

Gonna have to wait until I re-run MCT. I hate how you cannot re-use an ISO file you downloaded before... just converted the USB drive to Rufus.

garlin · 2026-08-13T07:32:18-0400

@Scott Try this version. There's something weird if I delete the temporary converted copy of SWM too quickly.

For some reason, sometimes the converted SWM has a 1\ folder name (indicating index 1), and sometimes it doesn't. This confuses 7z.exe which can't find the right filenames to extract. But it's not a consistent behavior. I may need to reconsider the SWM part in case the -NoSkip option is actually used.

Quandary · 2026-08-13T08:11:36-0400

garlin said:
@Scott Try this version. There's something weird if I delete the temporary converted copy of SWM too quickly.

For some reason, sometimes the converted SWM has a 1\ folder name (indicating index 1), and sometimes it doesn't. This confuses 7z.exe which can't find the right filenames to extract. But it's not a consistent behavior. I may need to reconsider the SWM part in case the -NoSkip option is actually used.

This version produces:

You cannot call a method on a null-valued expression.
At E:\Garlin\Check_BootMedia.ps1:2402 char:9
+ $RemovableDrives = @(
+ ~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull

Changing the code to:

$RemovableDrives = @(
@((Get-CimInstance -ClassName Win32_DiskDrive | where { $_.PNPDeviceID -match $USB_DeviceIDs -and $_.MediaLoaded } )) + `
@((Get-Volume | where { $_.DriveType -eq 'CD-ROM' -and $_.DriveLetter -match '[A-Z]' -and $_.OperationalStatus -eq 'OK' }).DriveLetter) + `
@((Get-Volume | where { $_.DriveLetter -in $MBR_Drives -and $_.FileSystemType -eq 'FAT32' }).DriveLetter)

Completes normally with:

Bootable Media
--------------

USB Drive H: "HASLEOBS"
Boot File [Windows UEFI CA 2023] is ALLOWED.
H:\EFI\Boot\bootx64.efi
File Version: 28000.342, SVN 9.0

boot.wim:1 (WinRE 26100.1)
Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\Windows\Boot\EFI_EX\bootmgfw_EX.efi
File Version: 28000.342, SVN 9.0

\Windows\System32\winload.efi is ALLOWED.
File Version: 26100.8737

man00 · 2026-08-13T08:32:21-0400

IMO the whole process was a mess, thank goodness we have help on here. I also have a felling its not over
yet

boombastik · 2026-08-13T09:27:49-0400

how i can fix the failed part?

itsme1 · 2026-08-13T09:34:16-0400

boombastik said:
how i can fix the failed part?
View attachment 179545

I think the script isn't up to date.

Use garlin's script.
Run dbx.bat as an administrator.

boombastik · 2026-08-13T10:18:54-0400

itsme1 said:
I think the script isn't up to date.

Use garlin's script.
Run dbx.bat as an administrator.

It didn't work.
But i read that only the later matters and the later is 14/7/2026.

itsme1 · 2026-08-13T10:27:39-0400

boombastik said:
It didn't work.
But i read that only the later matters and the later is 14/7/2026.

What isn't working?

In the folder containing Garlin's script, right-click on check-dbx.bat and select "Run as administrator." You should see three green "Success" lines if everything is in order.

Wait for Garlin regarding the date.

TheVisitor · 2026-08-13T10:37:47-0400

itsme1 said:
What isn't working?

In the folder containing Garlin's script, right-click on check-dbx.bat and select "Run as administrator." You should see three green "Success" lines if everything is in order.

Wait for Garlin regarding the date.

The latest scripts are here date 8/11 Releases · garlin-cant-code/SecureBoot-CA-2023-Updates

itsme1 · 2026-08-13T10:48:53-0400

TheVisitor said:
The latest scripts are here date 8/11 Releases · garlin-cant-code/SecureBoot-CA-2023-Updates

The date boombastik is referring to is the one from his screenshot in post 3,369

There are two dates for the UEFI dbx.

boombastik · 2026-08-13T11:05:12-0400

itsme1 said:
The date boombastik is referring to is the one from his screenshot in post 3,369
There are two dates for the UEFI dbx.

With garlin script i see three green lights. The other three pc has also 2 dates for uefi dbx bath they have both days as sucess and green.

garlin · 2026-08-13T11:26:20-0400

boombastik said:
how i can fix the failed part?

cjee21's script is broken since April 2026. He knows exactly why, because he added comments to an issue I filed on the official MS Secure Boot Objects GitHub which talks about the missing DBX entries.

[Bug]: Windows 11 April 2026 LCU pushed out a new DBXUpdateSVN.bin file · Issue #396 · microsoft/secureboot_objects

There is nothing to "fix" if you have already revoked CA 2011.
MS retired 154 EFI signature hashes which are now superseded by the banning of PCA 2011. This was done to help save valuable UEFI NVRAM space on older BIOS'es which could run out memory sooner than than later BIOS'es, because they're weren't so concerned about the size of DBX back in the day.

If his script wants to report this condition as a "failure", then I can't change it. MS made a deliberate decision to remove those entries to save space for the user's benefit.

boombastik · 2026-08-13T11:46:13-0400

Thank for your time! I understand it now.

hvoqasimo · 2026-08-13T12:35:11-0400

garlin said:
@Scott Try this version. There's something weird if I delete the temporary converted copy of SWM too quickly.

For some reason, sometimes the converted SWM has a 1\ folder name (indicating index 1), and sometimes it doesn't. This confuses 7z.exe which can't find the right filenames to extract. But it's not a consistent behavior. I may need to reconsider the SWM part in case the -NoSkip option is actually used.

garlin said:
Hmmmm, abbodi's backup of wimlib is version 1.4.1 (not 1.4.5). Maybe it's too old for our needs. I added a step to use Wayback Machine as a backup source.

1. Delete the wimlib in the temp file (only do this once):

Code:

del $env:TEMP\wimlib-imagex.exe del $env:TEMP\libwim-15.dll

2. Run latest version of script.

I ran the latest version of the script and the outcome is as follows

Secure Boot: ON
Virtualization Based Security: OFF

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 9.0

Bootable Media
--------------

PS C:\Windows\system32>

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer