Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

garlin · Saturday at 12:24 PM

anchamp65 said:
Been playing with Hasleo for the past few days.

I remember a lot of people were patching Hasleo staging to copy the boot loader with latest certs and SVN number.
Latest version, 5.9.2.2, if you use WinRE, so not ticking the "Download WinPE components", you don't need to patch the staging anymore.

If all backup products would stop promoting the use of WinPE for W11, that would be ideal. But older systems (W7-W10) don't mandate having a working WinRE, and therefore you need to support WinPE/ADK.

The problem is all the user guides talk about WinPE since it's universal across the different Windows versions. Except for W10 22H2, all the old Windows never got Secure boot updates, so that's why they don't mention why WinRE works better for W11.

anchamp65 · Saturday at 12:43 PM

TheVisitor said:
@anchamp65 I have Hasleo 5.9.2.1 how did you get an update ? I'm using the 'free' version'

I did not update, I installed directly from latest download.
Did you check for updates in Hasleo ?

TheVisitor · Saturday at 12:46 PM

anchamp65 said:
I did not update, I installed directly from latest download.
Did you check for updates in Hasleo ?

View attachment 181789

Oh wow ! I totally missed that... I've not been using it very long. Thanks

anchamp65 · Saturday at 12:48 PM

garlin said:
If all backup products would stop promoting the use of WinPE for W11, that would be ideal. But older systems (W7-W10) don't mandate having a working WinRE, and therefore you need to support WinPE/ADK.

The problem is all the user guides talk about WinPE since it's universal across the different Windows versions. Except for W10 22H2, all the old Windows never got Secure boot updates, so that's why they don't mention why WinRE works better for W11.

And I actually was not using WinRE a few years back and I would delete the recovery partition on any of my systems ! :zany:

When I moved to Win11, I decided to just leave it there and not bother with it any more.
When I upgraded to Macrium X, I decided to give WinRE a try and it worked, used to have issues back in v6 or v7, can't remember.
With your comments and recommandations, I'm now glad I use WinRE !!!

anchamp65 · Saturday at 12:55 PM

TheVisitor said:
Oh wow ! I totally missed that... I've not been using it very long. Thanks

You might also want to tick this option
I think it's off by default

Chrysalis · 2026-09-06T08:53:52-0400

Hi Garlin, just a headsup, my mistake I accidently ran the update instead of check, and I suggest adding a warning followed by a pause, for the following reasons.

It proceeds offering no abort.
It overwritten my bcdedit, luckily I had a backup.
The new bcd config, removed my custom config, and changed my locale from en-gb to en-us.

I am hoping it didnt wipe my 2011 cert from UEFI.

Chrysalis · 2026-09-06T09:15:53-0400

So I believe my system is now falsely reporting the bootloader as updated.

Sequence of events,

Check script said not updated.
I accidentally ran update script, rebooted, and it booted with wrong locale whilst wiping my bcd config, this I thinkj set a registry key to mark as updated.
I restored backup of EFI partition which has the 2011 bootloader.
Windows now thinks I have 2023 bootloader when it is 2011.

So how do I fix this without also restoring main C: drive backup as well? Ntlite and the script reports the new bootloader is on but I assume these are just checking the registry value.

Is there an actual sector check I can carry out. Or a way to reset the fragile Microsoft process which was so easy for me to break.

Ok this seems to claim the EFI boot loader is good. So luckily I think the EFI backup was already updated and system not left in frankenstein state.

GitHub - claude-boucher/CheckCA2023: PowerShell XAML GUI utility to monitor the Microsoft CA 2023 Secure Boot certificate update process

PowerShell XAML GUI utility to monitor the Microsoft CA 2023 Secure Boot certificate update process - claude-boucher/CheckCA2023

github.com

garlin · 2026-09-06T11:08:36-0400

Chrysalis said:
Hi Garlin, just a headsup, my mistake I accidently ran the update instead of check, and I suggest adding a warning followed by a pause, for the following reasons.

It proceeds offering no abort.

There is no pause because the update script, when used without the -Revoke option, should no harm. The exception is if you have a problem BIOS with a firmware restriction on the size of the Secure Boot keys added.

The script follows MS's recommendation to use bcdboot to copy all of the required boot files to the EFI. By default, bcdboot assumes US English (en-US). I'll change the script to keep your current system locale.

Chrysalis said:
It overwritten my bcdedit, luckily I had a backup.
The new bcd config, removed my custom config, and changed my locale from en-gb to en-us.

I am hoping it didnt wipe my 2011 cert from UEFI.

When the script updates removable media, I will backup the BCD and restore it afterwards. This wasn't done for the EFI volume, and I've added that just in case you have a custom BCD.

The update script cannot delete certs. It can ban the PCA 2011 cert, but only when the -Revoke option is used.

garlin · 2026-09-06T11:12:39-0400

Chrysalis said:
Check script said not updated.
I accidentally ran update script, rebooted, and it booted with wrong locale whilst wiping my bcd config, this I thinkj set a registry key to mark as updated.
I restored backup of EFI partition which has the 2011 bootloader.
Windows now thinks I have 2023 bootloader when it is 2011.

Please run "Check-UEFI.bat -Verbose" and post the results.

Chrysalis said:
So how do I fix this without also restoring main C: drive backup as well? Ntlite and the script reports the new bootloader is on but I assume these are just checking the registry value.

Is there an actual sector check I can carry out. Or a way to reset the fragile Microsoft process which was so easy for me to break.

Please don't use NTLite as a reliable basis for determining your status. While it reads the same reg keys, it's an incomplete picture of your current state, which the check script's verbose output can report.

Chrysalis · 2026-09-06T11:37:49-0400

Here is the results, thanks for agreeing to changing to backup the bcd.

Code:

Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

BIOS Firmware
-------------
    ASRock Z690 Steel Legend
    Version: 19.02
    Date: 2024-08-09

Factory Default UEFI PK Cert
----------------------------
    ASRock Inc.

UEFI PK Cert
------------
    ASRock Inc.

Factory Default UEFI KEK Certs
------------------------------
    Microsoft Corporation KEK CA 2011

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
    (NONE)
    EFI_CERT_SHA256_GUID Signatures: 217

UEFI DBX Certs
--------------
    (NONE)
    Windows BootMgr SVN is MISSING.
    EFI_CERT_SHA256_GUID Signatures: 445

UEFI Variables
--------------
    SBAT (Linux only): sbat,1,2024010900 / shim,4 / grub,3 / grub.debian,4

EFI Files
---------
    Windows Boot Manager [Production PCA 2011] is ALLOWED.
        \\.\HarddiskVolume18\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 26100.1041, SVN 3.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

STATUS REPORT
-------------
    Registry: "UEFICA2023Status" = Updated

garlin · 2026-09-06T11:42:41-0400

That's a really old version of boot manager on the EFI (SVN 3.0). What version of Windows are you running?

To manually copy the latest version, run as Admin:

Code:

mountvol S: /s
copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi S:\EFI\Microsoft\Boot\bootmgfw.efi
mountvol S: /d

garlin · 2026-09-06T13:05:14-0400

I looked up bootmgfw.efi (version 26100.1041). That's a Windows ISO from August to December 2024.

HuntyFtw · 2026-09-06T16:51:01-0400

garlin said:
From the current Acer support page:

Predator PH315-54 Available on Windows Update v1.16

In theory, version 1.17 would also work. What I would try is this:

1. Disable Secure Boot.
2. Try reset to factory defaults (it should have the CA 2023 certs included now).
3. Leave Secure Boot off. Boot Windows.
4. Run the check script, make sure everything is still OK.
5. Enable Secure Boot. See if the VSM error disappears; sometimes a firmware update leaves corrupted NVRAM values which the reset to defaults can fix.

Would the BIOS boot even after that error code?

garlin · 2026-09-06T17:22:14-0400

That's one of the big unknowns. For some problem BIOS'es, a Reset to Factory Defaults can clear the broken condition.

For other firmwares, you're stuck until you can reflash the BIOS image. Whatever can be done is entirely controlled by what the current BIOS can or can't do. Unfortunately, it's like a black box. All you can do is either reset (and hope it clears), or reflash the BIOS (and hope it clears).

It's not about the Secure Key keys, but rather how the BIOS writes that data into the NVRAM.

onuracengiz · 2026-09-07T05:56:05-0400

Acer VN7-792G, bios v1.10 (received last update during Spectre), ESU active Win10. Clean install from ISO.

Check_UEFI-CA2023 came up UNTRUSTED, Check_DBXupdate.bin showed missing files.
I have run Update_UEFI-CA2023 but it didnt stick. Kept resetting back to default keys after every restart. "Select an UEFI file as trusted for execution" option on bios showed nothing.
So, I have used "Erase all Secure Boot Setting" option on bios, then Disabled Secure Boot, once back on Win10, opened up Powershell with admin rights again and run;

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process
.\Update_UEFI-CA2023 -Latest -Revoke

after a restart i run Check_UEFI-CA2023 again, it cames up with ALLOWED with 2011 certs revoked, Check_DBXupdate.bin said no missing files. Restarted again and Re-enabled Secure Boot, run Check_UEFI-CA2023 once again to make sure, everything is order.
Thank you very much.
Hope this helps someone.

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer