Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

andyc56 said:

Not sure if this is the same problem, but in Macrium Reflect Free, when choosing to save a Rescue Image as ISO, pressing Ctrl reveals a down arrow on the Build button as below.

View attachment 180938

Clicking the down arrow reveals a "Force WIM Rebuild" option. Choosing that has worked for me, together with Garlin's script to update the boot media after burning the ISO.

Click to expand...

Thanks although rebuilding doesn't seem to do anything

That's the boot files, which are a separate thing than the boot.wim's actual contents. You need everything to line up (ISO boot file, boot.wim contents).

Klaver7 said:

@KevTech Oh and what is this:

View attachment 180942

Click to expand...

Not sure what you're trying to convey here...

KevTech said:

No Macrium does not have this option yet for RE media it is only available for PE.

View attachment 180939

View attachment 180940

I contacted Macrium about this and their response is at this post: garlin's PowerShell scripts for updating Secure Boot CA 2023

Click to expand...

Reading the link it seems Garlins script does the same thing.

Yes and you will end up with:


Several way's possible to get the same results

Klaver7 said:

Yes and you will end up with:

Code:

 ID_FILEATTRIB_F_0043 10.0.29426.0       65535.65535.65535.65535



Macrium v10.0.8843
------------------
    WinRE Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

Bootable Media
--------------

USB Drive F: "TBWINRE"
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        F:\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

    boot.wim:1 (WinRE 26100.9168)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
            \Windows\Boot\EFI_EX\bootmgfw_EX.efi
            File Version: 28000.352, SVN 9.0

        \Windows\System32\winload.efi is ALLOWED.
            File Version: 26100.9168


PS C:\Users\

Several way's possible to get the same result

Click to expand...

I perform:
make an ISO(dummy), then run:
copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi c:\boot\macrium\WinREFiles\media\EFI\Boot\bootx64.efi
copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi

Create USB and I get:
Macrium v10.0.8750
------------------
WinRE Boot Manager [Windows UEFI CA 2023] is ALLOWED.
c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.352, SVN 9.0

WinPE Boot File [Windows UEFI CA 2023] is BANNED.
c:\boot\macrium\WA11KFiles\media\EFI\Boot\bootx64.efi
File Version: 26100.30227, SVN 7.0

Bootable Media
--------------

USB Drive I: "8 GB"
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
I:\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.352, SVN 9.0

boot.wim:1 (WinRE 26100.7014)
Boot Manager [Windows UEFI CA 2023] is BANNED. WHY DO I GET THIS?
\Windows\Boot\EFI_EX\bootmgfw_EX.efi
File Version: 26100.30227, SVN 7.0

\Windows\System32\winload.efi will be ALLOWED.
File Version: 26100.7014

Do you get this reading with: powershell -nop -ep bypass -f E:\Z_c2023\Check_BootMedia.ps1 -audit -verbose

Klaver7 said:

Do you get this reading with: powershell -nop -ep bypass -f E:\Z_c2023\Check_UEFI-CA2023.ps1 -audit -verbose

Code:

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    SkuSiPolicy.p7b is CURRENT.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
        Version: 3.0.0.17
[/CO
[/QUOTE]

Click to expand...

Klaver7 said:

Do you get this reading with: powershell -nop -ep bypass -f E:\Z_c2023\Check_UEFI-CA2023.ps1 -audit -verbose

Code:

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    SkuSiPolicy.p7b is CURRENT.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
        Version: 3.0.0.17

Click to expand...

Not sure what you want me to do? To get what I reported I used: Check_UEFI-CA2023.ps1 -audit -verbose

Hang on I will jump to my other PC where I have Macrium installed....

I think that your are somehow taking the "PE" instead of the "RE"


Clear the "c:\boot\macrium" with the uninstaller




and build a new one to make sure that you choose the "Windows RE"

again make a dummy ISO to populate it

and then make a USB and use Garlins "Update_UEFI-CA2023.ps1 -BootMedia"

When you use the "-Verbose" option with the script, it reports if your boot.wim is from a WinPE or WinRE source.

Klaver7 said:

I think that your are somehow taking the "PE" instead of the "RE"

Code:

WinPE Boot File [Windows UEFI CA 2023] is BANNED.
c:\boot\macrium\WA11KFiles\media\EFI\Boot\bootx64.efi
File Version: 26100.30227, SVN 7.0

Clear the "c:\boot\macrium" with the uninstaller


View attachment 180952

and build a new one to make sure that you choose the "Windows RE"

again make a dummy ISO to populate it

and then make a USB and use Garlins "Update_UEFI-CA2023.ps1 -BootMedia"

Click to expand...

I've done this before but will again and perform the whole process

Kewl !

Been using Garlins script's since about march this year and never ran into problems with it.

Klaver7 said:

Code:

powershell -nop -ep bypass -f D:\Z_c2023\Check_BootMedia.ps1 -verbose
Windows 11 25H2 (26200.9168)

Secure Boot: ON
Virtualization Based Security: ON

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 9.0

EFI Files
---------
    SkuSiPolicy.p7b is CURRENT.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
        Version: 3.0.0.17

        FileRule             MinimumFileVersion MaximumFileVersion
        --------             ------------------ ------------------
        ID_FILEATTRIB_F_0044 0.0.0.0            10.0.14393.9399
        ID_FILEATTRIB_F_0042 10.0.14400.0       10.0.17763.9099
        ID_FILEATTRIB_F_0040 10.0.18000.0       10.0.19041.7639
        ID_FILEATTRIB_F_0041 10.0.19100.0       10.0.20348.5479
        ID_FILEATTRIB_F_0046 10.0.20400.0       10.0.22621.7494
        ID_FILEATTRIB_F_0049 10.0.23000.0       10.0.26100.9140
        ID_FILEATTRIB_F_0045 10.0.26100.32000   10.0.26100.33249
        ID_FILEATTRIB_F_0048 10.0.26172.0       10.0.26172.33249
        ID_FILEATTRIB_F_0047 10.0.27000.0       10.0.28000.2684
        ID_FILEATTRIB_F_0043 10.0.29426.0       65535.65535.65535.65535



Bootable Media
--------------

USB Drive E: "TBWINRE"
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        E:\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.352, SVN 9.0

    boot.wim:1 (WinRE 26100.9168)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
            \Windows\Boot\EFI_EX\bootmgfw_EX.efi
            File Version: 28000.352, SVN 9.0

        \Windows\System32\winload.efi is ALLOWED.
            File Version: 26100.9168


PS C:\Users

Kewl !

Click to expand...

I'll do this tomorrow... done for the evening! Thanks