Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

TheVisitor · 2026-09-08T15:57:16-0400

Thanks, not sure what happened but I have 1Gb recovery partition
DISKPART> select part 3

Partition 3 is now the selected partition.

DISKPART> shrink desired=250 minimum=250

DiskPart successfully shrunk the volume by: 250 MB

DISKPART> sel part 4

Partition 4 is now the selected partition.

DISKPART> delete partition override

DiskPart successfully deleted the selected partition.

DISKPART> create partition primary id=de94bba4-06d1-4d40-a16a-bfd50179d6ac

DiskPart succeeded in creating the specified partition.

DISKPART> gpt attributes =0x8000000000000001

DiskPart successfully assigned the attributes to the selected GPT partition.

DISKPART> format quick fs=ntfs label="Windows RE tools"

100 percent completed

DiskPart successfully formatted the volume.

DISKPART> list vol

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volume 0 F DVD-ROM 0 B No Media
Volume 1 C NTFS Partition 464 GB Healthy Boot
Volume 2 FAT32 Partition 100 MB Healthy System
Volume 4 G HASLEOBS FAT32 Removable 31 GB Healthy
Volume 5 E My Passport NTFS Partition 931 GB Healthy
Volume 6 D Removable 0 B No Media
* Volume 7 Windows RE NTFS Partition 1091 MB Healthy Hidden

DISKPART>

Asus272 · 2026-09-08T16:04:27-0400

Looks good, did you do the reagentc enable?

TheVisitor · 2026-09-08T16:05:22-0400

Asus272 said:
Looks good, did you do the reagentc enable?

Not yet, was waiting to see if this looked ok, will do that now

Dirtyflash · 2026-09-08T16:07:03-0400

Someone remind me how to fix this? I've done it before but can't seem to remember.

JamesSmith · 2026-09-08T16:09:55-0400

Is anyone else getting the same out put when they check Check_DBXUpdate.bin.ps1 ?

I have tried a bunch of things to fix it but I am at a loss.

Code:

PS C:\> cd .\SecureBoot-CA-2023-Updates.v2026.09.08\

PS C:\SecureBoot-CA-2023-Updates.v2026.09.08> powershell -nop -ep bypass -f .\Check_DBXUpdate.bin.ps1

SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"

FAILED: Missing 1/3 SVN signatures from "DBXUpdate2024.bin"

SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"



PS C:\SecureBoot-CA-2023-Updates.v2026.09.08>

TheVisitor · 2026-09-08T16:14:26-0400

JamesSmith said:
Is anyone else getting the same out put when they check Check_DBXUpdate.bin.ps1 ?

I have tried a bunch of things to fix it but I am at a loss.

Code:

PS C:\> cd .\SecureBoot-CA-2023-Updates.v2026.09.08\ PS C:\SecureBoot-CA-2023-Updates.v2026.09.08> powershell -nop -ep bypass -f .\Check_DBXUpdate.bin.ps1 SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin" FAILED: Missing 1/3 SVN signatures from "DBXUpdate2024.bin" SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin" PS C:\SecureBoot-CA-2023-Updates.v2026.09.08>

I see the same:

PS C:\Windows\System32> powershell -nop -ep bypass -f C:\temp23\check_dbxupdate.bin.ps1
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
FAILED: Missing 1/3 SVN signatures from "DBXUpdate2024.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

garlin · 2026-09-08T16:17:32-0400

JamesSmith said:
Is anyone else getting the same out put when they check Check_DBXUpdate.bin.ps1 ?

You didn't run the update script, which would have installed SVN 11.0 and copied a new Windows boot file to the EFI.
Or the Secure Boot update task hasn't run yet...

JamesSmith · 2026-09-08T16:21:10-0400

garlin said:
You didn't run the update script, which would have installed SVN 11.0 and copied a new Windows boot file to the EFI.
Or the Secure Boot update task hasn't run yet...

I ran the update script which installed SVN 11.0 same as I do every month.

Code:

PS C:\SecureBoot-CA-2023-Updates.v2026.09.08> powershell -nop -ep bypass -f .\Check_UEFI-CA2023.ps1 -Verbose -Audit
Windows 11 25H2 (26200.9445)
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
    Gigabyte Technology Co. B760M H DDR4
    Version: F14
    Date: 2025-06-19

Factory Default UEFI PK Cert
----------------------------
    GIGABYTE

UEFI PK Cert
------------
    GIGABYTE

Factory Default UEFI KEK Certs
------------------------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023
    GIGABYTE

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023
    GIGABYTE

Factory Default UEFI DB Certs
-----------------------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Windows UEFI CA 2023
    GIGABYTE
    GIGABYTE

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023
    GIGABYTE
    GIGABYTE

Factory Default UEFI DBX Certs
------------------------------
    (NONE)
    EFI_CERT_SHA256_GUID Signatures: 77

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 11.0
    EFI_CERT_SHA256_GUID Signatures: 504

UEFI Variables
--------------
    Credential Guard: ON
    SBAT (Linux only): sbat,1,2025051000 / shim,4 / grub,5 / grub.debian,4 / grub.peimage,2 / grub.proxmox,2

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.367, SVN 11.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    SkuSiPolicy.p7b is CURRENT.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
        Version: 3.0.0.18

AUDIT REPORT
============
    PASSED ALL CHECKS.

STATUS REPORT
-------------
    Registry: "UEFICA2023Status" = Updated

    SUCCESS: UPDATES ARE FINISHED.
    UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

PS C:\SecureBoot-CA-2023-Updates.v2026.09.08>

Code:

PS C:\SecureBoot-CA-2023-Updates.v2026.09.08> powershell -nop -ep bypass -f .\Check_DBXUpdate.bin.ps1
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
FAILED: Missing 1/3 SVN signatures from "DBXUpdate2024.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

PS C:\SecureBoot-CA-2023-Updates.v2026.09.08>

garlin · 2026-09-08T16:21:47-0400

bikemanAMD said:

Having a bit of problems with my Macrium Reflect X Rescue USB in Windows RE

Code:

PS D:\Scripts\Tools> .\Check_BootMedia.ps1
Invoke-WebRequest: D:\Scripts\Tools\Check_BootMedia.ps1:230
Line |
 230 |              Invoke-WebRequest -UseBasicParsing -Uri $offlinereg_BACKU …
     |              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | 429 Too Many Requests You have sent too many requests in a given amount of time.
Remove-Item: D:\Scripts\Tools\Check_BootMedia.ps1:243
Line |
 243 |              Remove-Item $ZIP_File -Force
     |              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Cannot find path 'C:\Users\PCADMI~1\AppData\Local\Temp\offlinereg.zip' because it does not exist.

You might have a temporary network problem downloading the offlinereg tool into your TEMP folder. Try again in a bit.

TheVisitor · 2026-09-08T16:23:09-0400

I just ran the UEFI update script got this:

PS C:\Windows\System32> powershell -nop -ep bypass -f C:\temp21\update_uefi-ca2023.ps1
SUCCESS: NO UPDATES ARE REQUIRED.

PS C:\Windows\System32> powershell -nop -ep bypass -f C:\temp23\check_dbxupdate.bin.ps1
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
FAILED: Missing 1/3 SVN signatures from "DBXUpdate2024.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

garlin · 2026-09-08T16:28:00-0400

JamesSmith said:

Code:

PS C:\SecureBoot-CA-2023-Updates.v2026.09.08> powershell -nop -ep bypass -f .\Check_DBXUpdate.bin.ps1
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
FAILED: Missing 1/3 SVN signatures from "DBXUpdate2024.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"
[/QUOTE]

Can you run Check_DBXUpdate.bin.ps1 with "-Verbose"?

TheVisitor · 2026-09-08T16:29:21-0400

I got:

PS C:\Windows\System32> powershell -nop -ep bypass -f C:\temp23\check_dbxupdate.bin.ps1 -verbose
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
FAILED: Missing 1/3 SVN signatures from "DBXUpdate2024.bin"
Missing [01612B139DD5598843AB1C185C3CB2EB92000005000000000000000000000000] bootmgfw.efi SVN 5.0
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

JamesSmith · 2026-09-08T16:31:18-0400

garlin said:
Can you run Check_DBXUpdate.bin.ps1 with "-Verbose"?

Code:

PS C:\SecureBoot-CA-2023-Updates.v2026.09.08> powershell -nop -ep bypass -f .\Check_DBXUpdate.bin.ps1 -Verbose
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
FAILED: Missing 1/3 SVN signatures from "DBXUpdate2024.bin"
    Missing [01612B139DD5598843AB1C185C3CB2EB92000005000000000000000000000000] bootmgfw.efi SVN 5.0
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

PS C:\SecureBoot-CA-2023-Updates.v2026.09.08>

garlin · 2026-09-08T16:41:32-0400

Try this test script.

JamesSmith · 2026-09-08T16:46:48-0400

garlin said:
Try this test script.

Code:

PS C:\> powershell -nop -ep bypass -f .\Check_DBXUpdate.bin.ps1 -Verbose
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
Current SVN: 11.0
FAILED: Missing 1/3 SVN signatures from "DBXUpdate2024.bin"
    Missing [01612B139DD5598843AB1C185C3CB2EB92000005000000000000000000000000] bootmgfw.efi SVN 5.0
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

PS C:\>

Also DBXUpdateSVN.bin was updated today.

Scott · 2026-09-08T17:29:27-0400

TheVisitor said:
* Volume 7 Windows RE NTFS Partition 1091 MB Healthy Hidden

I suggest you make it bigger. The current winre.wim is over 700 MB.

AK6DN · 2026-09-08T17:33:49-0400

Scott said:
I suggest you make it bigger. The current winre.wim is over 700 MB.

View attachment 182198

Yeah I made all my systems WinRE partitions 2GB a while ago. Hopefully that should last a while.

garlin · 2026-09-08T18:06:35-0400

@JamesSmith @TheVisitor

Try this version.

JamesSmith · 2026-09-08T18:14:16-0400

garlin said:
@JamesSmith @TheVisitor

Try this version.

Code:

PS C:\> powershell -nop -ep bypass -f .\Check_DBXUpdate.bin.ps1 -Verbose
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
sort : Cannot convert the "7.0" value of type "System.Version" to type "System.Single".
At C:\Check_DBXUpdate.bin.ps1:530 char:99
+ ... h { [version](Get-SignatureDataSVN $_) } | sort { [float]$_ } | selec ...
+                                                ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidResult: (7.0:PSObject) [Sort-Object], RuntimeException
    + FullyQualifiedErrorId : ExpressionEvaluation,Microsoft.PowerShell.Commands.SortObjectCommand

sort : Cannot convert the "2.0" value of type "System.Version" to type "System.Single".
At C:\Check_DBXUpdate.bin.ps1:530 char:99
+ ... h { [version](Get-SignatureDataSVN $_) } | sort { [float]$_ } | selec ...
+                                                ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidResult: (2.0:PSObject) [Sort-Object], RuntimeException
    + FullyQualifiedErrorId : ExpressionEvaluation,Microsoft.PowerShell.Commands.SortObjectCommand

sort : Cannot convert the "8.0" value of type "System.Version" to type "System.Single".
At C:\Check_DBXUpdate.bin.ps1:530 char:99
+ ... h { [version](Get-SignatureDataSVN $_) } | sort { [float]$_ } | selec ...
+                                                ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidResult: (8.0:PSObject) [Sort-Object], RuntimeException
    + FullyQualifiedErrorId : ExpressionEvaluation,Microsoft.PowerShell.Commands.SortObjectCommand

sort : Cannot convert the "9.0" value of type "System.Version" to type "System.Single".
At C:\Check_DBXUpdate.bin.ps1:530 char:99
+ ... h { [version](Get-SignatureDataSVN $_) } | sort { [float]$_ } | selec ...
+                                                ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidResult: (9.0:PSObject) [Sort-Object], RuntimeException
    + FullyQualifiedErrorId : ExpressionEvaluation,Microsoft.PowerShell.Commands.SortObjectCommand

sort : Cannot convert the "11.0" value of type "System.Version" to type "System.Single".
At C:\Check_DBXUpdate.bin.ps1:530 char:99
+ ... h { [version](Get-SignatureDataSVN $_) } | sort { [float]$_ } | selec ...
+                                                ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidResult: (11.0:PSObject) [Sort-Object], RuntimeException
    + FullyQualifiedErrorId : ExpressionEvaluation,Microsoft.PowerShell.Commands.SortObjectCommand

FAILED: Missing 1/3 SVN signatures from "DBXUpdate2024.bin"
    Missing [01612B139DD5598843AB1C185C3CB2EB92000005000000000000000000000000] bootmgfw.efi SVN 5.0
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

PS C:\>

Klaver7 · 2026-09-08T18:16:10-0400

No problem here, updated 3 machines so far, laptop to go ...

Code:

PS C:\Users\jwdav> Get-SecureBootSVN


FirmwareSVN      : 11.0
BootManagerSVN   : 11.0
StagedSVN        : 11.0
ComplianceStatus : Compliant (Boot Manager SVN meets staged SVN)
BootManagerPath  : \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi



PS C:\Users\jwdav> powershell -nop -ep bypass -f E:\Z_c2023\Check_DBXUpdate.bin.ps1
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdate2024.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

PS C:\Users\jwdav> powershell -nop -ep bypass -f E:\Z_c2023\Check_DBXUpdate.bin.ps1 -verbose
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdate2024.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

PS C:\Users\jwdav>

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer My Computer

At a glance

Active member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computers

My Computer

My Computer

My Computers

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computers

My Computers

My Computer

My Computers

My Computer