Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Klaver7 · 2026-09-08T13:36:45-0400

And were good for a month again

Code:

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.367, SVN 11.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    SkuSiPolicy.p7b is CURRENT.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
        Version: 3.0.0.18

AUDIT REPORT
============
    PASSED ALL CHECKS.

STATUS REPORT
-------------
    Registry: "UEFICA2023Status" = Updated

    SUCCESS: UPDATES ARE FINISHED.
    UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

PS C:\Users\

wabbit · 2026-09-08T13:44:13-0400

SkuSiPolicy.p7b has also been updated. After running Check_UEFI in verbose. it gave me instructions for updating the SVN and SkuSiPolicy.

garlin · 2026-09-08T13:48:11-0400

It makes you wonder how many Secure Boot bugs they fixed in the past month. Jumping from SVN 9.0 to 11.0 makes me think they got hit twice in a row.

TheVisitor · 2026-09-08T13:50:11-0400

following today's update scanning Event logs I see a 'critical' ID 4502 WinREAgent failed ?

Scott · 2026-09-08T13:54:35-0400

Now just need to work on boot media...

Code:

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 11.0
    EFI_CERT_SHA256_GUID Signatures: 504

UEFI Variables
--------------
    Credential Guard: ON
    SBAT (Linux only): sbat,1,2025051000 / shim,4 / grub,5 / grub.debian,4 / grub.peimage,2 / grub.proxmox,2

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        \\.\HarddiskVolume2\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.367, SVN 11.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    SkuSiPolicy.p7b is CURRENT.
        \\.\HarddiskVolume2\EFI\Microsoft\Boot\SkuSiPolicy.p7b
        Version: 3.0.0.18
    NOT RECOMMENDED for dual-boot setups.


STATUS REPORT
-------------
    Registry: "UEFICA2023Status" = Updated

    SUCCESS: UPDATES ARE FINISHED.
    UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

Asus272 · 2026-09-08T14:02:55-0400

TheVisitor said:
following today's update scanning Event logs I see a 'critical' ID 4502 WinREAgent failed ?

You may have run out of space mine is using 977 mb and microsoft recommends you keep 200 mb free

garlin · 2026-09-08T14:04:25-0400

WU has to push a new boot manager (and winload.efi?) into WinRE.

TheVisitor · 2026-09-08T14:06:25-0400

Asus272 said:
You may have run out of space mine is using 977 mb and microsoft recommends you keep 200 mb free

Well if that's the case I'm in trouble - Only have 71mb free - not a clue how to expand Winre file

bikemanAMD · 2026-09-08T14:07:26-0400

My PC 2 Gaming Laptop i'm gonna have to make the Windows RE parition larger as already showing Red in Macrium Reflect, so probably gonna need more space on that system. PC 1 has plenty of space thankfully for Window RE parition

Klaver7 · 2026-09-08T14:08:41-0400

"MacFree" keeps on working

Code:

        ID_FILEATTRIB_F_0043 10.0.29426.0       65535.65535.65535.65535



Bootable Media
--------------

USB Drive F: "MAC_SEPT26"
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        F:\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.367, SVN 11.0

    boot.wim:1 (WinRE 26100.9444)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
            \Windows\Boot\EFI_EX\bootmgfw_EX.efi
            File Version: 28000.367, SVN 11.0

        \Windows\System32\winload.efi is ALLOWED.
            File Version: 26100.9444


PS C:\Users\

garlin · 2026-09-08T14:08:47-0400

You find one of those free re-partition tools, and shrink the Windows volume by 150 MB, then expand WinRE sideways into the free space.

garlin · 2026-09-08T14:09:22-0400

TheVisitor said:
Well if that's the case I'm in trouble - Only have 71mb free - not a clue how to expand Winre file

You find one of those free re-partition tools, and shrink the Windows volume by 150 MB, then expand WinRE sideways into the free space.

Asus272 · 2026-09-08T14:42:32-0400

TheVisitor said:
Well if that's the case I'm in trouble - Only have 71mb free - not a clue how to expand Winre file

KB5028997: Instructions to manually resize your partition to install the WinRE update | Microsoft Support

KB5028997: Instructions to manually resize your partition to install the WinRE update

support.microsoft.com

Scott · 2026-09-08T14:45:54-0400

Boot media updated and verified bootable...

Code:

Macrium v8.1.8853
-----------------
    WinRE Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.367, SVN 11.0

Bootable Media
--------------

USB Drive J: "MACRIUMHOME"
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        J:\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.367, SVN 11.0

    boot.wim:1 (WinRE 26100.9444)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
            \Windows\Boot\EFI_EX\bootmgfw_EX.efi
            File Version: 28000.367, SVN 11.0

        \Windows\System32\winload.efi is ALLOWED.
            File Version: 26100.9444


USB Drive K: "BOOT2023PCA"
    Boot File [Windows UEFI CA 2023] is ALLOWED.
        K:\EFI\Boot\bootx64.efi
        File Version: 28000.367, SVN 11.0

    boot.wim:2 (WinRE 26100.9445)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
            \Windows\Boot\EFI_EX\bootmgfw_EX.efi
            File Version: 28000.367, SVN 11.0

        \Windows\System32\winload.efi is ALLOWED.
            File Version: 26100.9444

    K:\EFI\Microsoft\Boot\boot.stl [5/18/2026 07:44] is CURRENT.

    Please wait while install SWM is analyzed.

    install.swm:1 (W11 25H2 26200.9445)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
            \Windows\Boot\EFI_EX\bootmgfw_EX.efi
            File Version: 28000.367, SVN 11.0

        \Windows\System32\winload.efi is ALLOWED.
            File Version: 26100.9444


PS D:\Scripts\SecureBoot-CA-2023-Updates.v2026.09.08>

Scott · 2026-09-08T15:15:39-0400

My new boot.stl file is dated TOMORROW

bikemanAMD · 2026-09-08T15:19:42-0400

Having a bit of problems with my Macrium Reflect X Rescue USB in Windows RE

Code:

PS D:\Scripts\Tools> .\Check_BootMedia.ps1
Invoke-WebRequest: D:\Scripts\Tools\Check_BootMedia.ps1:230
Line |
 230 |              Invoke-WebRequest -UseBasicParsing -Uri $offlinereg_BACKU …
     |              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | 429 Too Many Requests You have sent too many requests in a given amount of time.
Remove-Item: D:\Scripts\Tools\Check_BootMedia.ps1:243
Line |
 243 |              Remove-Item $ZIP_File -Force
     |              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Cannot find path 'C:\Users\PCADMI~1\AppData\Local\Temp\offlinereg.zip' because it does not exist.
Secure Boot: ON
Virtualization Based Security: ON

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 11.0

EFI Files
---------
    SkuSiPolicy.p7b is CURRENT.

Macrium v10.0.8843
------------------
    WinRE Boot Manager [Production PCA 2011] is BANNED.

Bootable Media
--------------

USB Drive F:
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

&: D:\Scripts\Tools\Check_BootMedia.ps1:1874
Line |
1874 |      $CurrentVersion = & $offlinereg $Hive 'Microsoft\Windows NT\Curre …
     |                          ~~~~~~~~~~~
     | The term 'C:\Users\PCADMI~1\AppData\Local\Temp\offlinereg-win32.exe' is not recognized as a name of a cmdlet,
     | function, script file, or executable program. Check the spelling of the name, or if a path was included, verify
     | that the path is correct and try again.
    boot.wim:1 (WinRE 0.9444)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        winload.efi is ALLOWED

bikemanAMD · 2026-09-08T15:26:32-0400

Code:

PS D:\Scripts\Tools> .\Update_UEFI-CA2023.ps1 -bootmedia
SUCCESS: NO UPDATES ARE REQUIRED.

Restart Windows, for pending updates to take effect.

And now wants another PC reboot lol for 5th time

All Set on Desktop Now--Booted just fine on Reboot #5 lol

now just to finish up a few things on PC #2, and that one should be all set like Desktop in just a bit

JamesSmith · 2026-09-08T15:31:42-0400

Code:

PS C:\> cd .\SecureBoot-CA-2023-Updates.v2026.09.08\

PS C:\SecureBoot-CA-2023-Updates.v2026.09.08> powershell -nop -ep bypass -f .\Check_DBXUpdate.bin.ps1

SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"

FAILED: Missing 1/3 SVN signatures from "DBXUpdate2024.bin"

SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"



PS C:\SecureBoot-CA-2023-Updates.v2026.09.08>

Is it supposed to look like this?

TheVisitor · 2026-09-08T15:34:04-0400

Asus272 said:
KB5028997: Instructions to manually resize your partition to install the WinRE update | Microsoft Support

KB5028997: Instructions to manually resize your partition to install the WinRE update

support.microsoft.com

I'm stuck: I got to this part then won't let me shrink unless I'm choosing wrong thing:
DISKPART> list part

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 System 100 MB 1024 KB
Partition 2 Reserved 16 MB 101 MB
Partition 3 Primary 464 GB 117 MB
Partition 4 Recovery 839 MB 464 GB

DISKPART> sel part 4

Partition 4 is now the selected partition.

DISKPART> shrink desired=250 minimum=250

You may not shrink OEM, ESP, or recovery partitions, or, offline volumes.
The volume you have selected may not be shrunk.
Please select another volume and try again.

DISKPART> list part

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 System 100 MB 1024 KB
Partition 2 Reserved 16 MB 101 MB
Partition 3 Primary 464 GB 117 MB
* Partition 4 Recovery 839 MB 464 GB

DISKPART> select part 1

Partition 1 is now the selected partition.

DISKPART> shrink desired=250 minimum=250

You may not shrink OEM, ESP, or recovery partitions, or, offline volumes.
The volume you have selected may not be shrunk.
Please select another volume and try again.

Asus272 · 2026-09-08T15:39:53-0400

TheVisitor said:
I'm stuck: I got to this part then won't let me shrink unless I'm choosing wrong thing:
DISKPART> list part

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 System 100 MB 1024 KB
Partition 2 Reserved 16 MB 101 MB
Partition 3 Primary 464 GB 117 MB
Partition 4 Recovery 839 MB 464 GB

DISKPART> sel part 4

Partition 4 is now the selected partition.

DISKPART> shrink desired=250 minimum=250

You may not shrink OEM, ESP, or recovery partitions, or, offline volumes.
The volume you have selected may not be shrunk.
Please select another volume and try again.

DISKPART> list part

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 System 100 MB 1024 KB
Partition 2 Reserved 16 MB 101 MB
Partition 3 Primary 464 GB 117 MB
* Partition 4 Recovery 839 MB 464 GB

DISKPART> select part 1

Partition 1 is now the selected partition.

DISKPART> shrink desired=250 minimum=250

You may not shrink OEM, ESP, or recovery partitions, or, offline volumes.
The volume you have selected may not be shrunk.
Please select another volume and try again.

Shrink Part 3 the Windows Partition if you are over allocated?

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computers My Computers

At a glance

At a glance

Similar threads

My Computer

My Computers

My Computer

My Computer

My Computers

My Computers

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computer

My Computers