Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

JamesSmith · Tuesday at 6:21 PM

No problem here, updated 3 machines so far, laptop to go ...

Code:

PS C:\Users\jwdav> Get-SecureBootSVN


FirmwareSVN      : 11.0
BootManagerSVN   : 11.0
StagedSVN        : 11.0
ComplianceStatus : Compliant (Boot Manager SVN meets staged SVN)
BootManagerPath  : \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi



PS C:\Users\jwdav> powershell -nop -ep bypass -f E:\Z_c2023\Check_DBXUpdate.bin.ps1
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdate2024.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

PS C:\Users\jwdav> powershell -nop -ep bypass -f E:\Z_c2023\Check_DBXUpdate.bin.ps1 -verbose
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdate2024.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

PS C:\Users\jwdav>

Are you using the latest version that was released today?

cool59 · Tuesday at 6:28 PM

Hello all.

Same output as @JamesSmith @TheVisitor after today update.
No luck with the last two versions of the script.

Regards

Klaver7 · Tuesday at 6:32 PM

JamesSmith said:
Are you using the latest version that was released today?

Yes today's released updated

JamesSmith · Tuesday at 6:36 PM

Klaver7 said:
Yes today's released updated

View attachment 182206

I wonder why a bunch of us are having issues but you are not. Strange but hopefully we can fix this today.

Klaver7 · Tuesday at 7:58 PM

And the Laptop with win 10 21H2 iot LTSC

Code:

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.367, SVN 11.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    SkuSiPolicy.p7b is CURRENT.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
        Version: 3.0.0.18

AUDIT REPORT
============
    PASSED ALL CHECKS.

STATUS REPORT
-------------
    Registry: "UEFICA2023Status" = Updated

    SUCCESS: UPDATES ARE FINISHED.
    UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

PS C:\Windows\system32> Get-SecureBootSVN

FirmwareSVN      : 11.0
BootManagerSVN   : 11.0
StagedSVN        : 11.0
ComplianceStatus : Compliant (Boot Manager SVN meets staged SVN)
BootManagerPath  : \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi

PS C:\Windows\system32> powershell -nop -ep bypass -f D:\Z_c2023\Check_DBXUpdate.bin.ps1
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdate2024.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

PS C:\Windows\system32>

I dont have any trouble with "Check_DBXUpdate.bin.ps1", did have to resize a bunch of Recovery Partitions as Microsoft has the "Winre.wim" on steroids now

bikemanAMD · Tuesday at 8:32 PM

Well i tried to Shrink my C Drive for Recovery Partition, and extend the RE partition lol, and did it with Mini Partition tool

Messed up My PC 2 Gaming Laptop lol, but its fixed now after Reset this PC, just alot to reinstall starting tomorrow. I should've done it manually via Diskpart probably lol oops

Then gonna do a fresh Macrium Reflect Image, and Rescue USB Update--and hopefully it boots just as well as Desktop Macrium Reflect X Rescue USB did with Secure Boot still on

JamesSmith · Tuesday at 8:34 PM

On my wife's laptop now.

The last time I ran your script was after last months patch Tuesday it was version 2026.08.24. I am about to run Windows update then I will run the newest script and see if I get a error or not. I will come back and edit this post when done.

Wife's laptop done Same issue.

TheVisitor · Tuesday at 8:52 PM

For what its worth I ( I'm a big chicken) Google AI is suggesting the error is likely corrupted NVRAM and gave instructions to clear the RAM/ reload factory Keys. the error is SVN 5.0 which is corrupt or out of date, not sure clearing the RAM reloading factory keys will fix anything, but it would not break the system. Its late here, maybe will try tomorrow.

garlin · Tuesday at 8:56 PM

TheVisitor said:
For what its worth I ( I'm a big chicken) Google AI is suggesting the error is likely corrupted NVRAM and gave instructions to clear the RAM/ reload factory Keys. the error is SVN 5.0 which is corrupt or out of date, not sure clearing the RAM reloading factory keys will fix anything, but it would not break the system. Its late here, maybe will try tomorrow.

Don't do that just yet. I'm working on a test script to dump the SVN data. In the Windows UEFI model, you're allowed to have multiple SVN's registered. The highest value found in the DBX wins.

But different versions of DBXUpdate2024.bin or DBXUpdateSVN.bin can add a number which is later superseded (overriden). The check is actually cheating, it's really saying "you don't need this lower SVN since we already have the same or higher SVN in the DBX". Technically you could insert the lower SVN (if it didn't exist before), but it would have no practical effect.

Klaver7 · Tuesday at 9:36 PM

JamesSmith said:
On my wife's laptop now.

The last time I ran your script was after last months patch Tuesday it was version 2026.08.24. I am about to run Windows update then I will run the newest script and see if I get a error or not. I will come back and edit this post when done.

Wife's laptop done Same issue.

View attachment 182226

This is really weird, I tried to break the "bank" but it keeps coming up with SUCCESS ... am I the only one ?

Scott · Tuesday at 9:54 PM

Klaver7 said:
This is really weird, I tried to break the "bank" but it keeps coming up with SUCCESS ... am I the only one ?

View attachment 182228

nope...

JamesSmith · Tuesday at 10:07 PM

Hi Garlin could you try to explain why this is happening to some people and not others?

I remember something like this happening a few months back. My head hurts secure boot is giving me a headache.

anchamp65 · Tuesday at 10:07 PM

I also applied on both desktop and Surface

windows update
Ran Garlin's check script that said I needed to set reg key and run task to fix SVN from 9 to 11 but I ran Garlin's update
Both computers are now fully up to date DBX and SVN 11

Code:

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.367, SVN 11.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    [OPTIONAL] SkuSiPolicy.p7b (for VBS) is MISSING.

STATUS REPORT
-------------
    Registry: "UEFICA2023Status" = Updated

    SUCCESS: UPDATES ARE FINISHED.
    UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

Code:

PS D:\> powershell -nop -ep bypass -f D:\Tmp\Garlin\Check_DBXUpdate.bin.ps1
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdate2024.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

garlin · Tuesday at 11:45 PM

OK. Here's a test script for everyone who isn't matching on DBXUpdate2024.bin. Your actual numbers will vary, depending on when previous updates were applied.

Code:

PS C:\Users\GARLIN\Downloads> .\TEST.ps1
Found  01612B139DD5598843AB1C185C3CB2EB92: SVN 5.0
Found  01612B139DD5598843AB1C185C3CB2EB92: SVN 9.0
Found  01612B139DD5598843AB1C185C3CB2EB92: SVN 11.0
Latest 01612B139DD5598843AB1C185C3CB2EB92: SVN 11.0 <--

Found  019D2EF8E827E15841A4884C18ABE2F284: SVN 3.0
Latest 019D2EF8E827E15841A4884C18ABE2F284: SVN 3.0 <--

Found  01C2CA99C9FE7F6F4981279E2A8A535976: SVN 3.0
Latest 01C2CA99C9FE7F6F4981279E2A8A535976: SVN 3.0 <--

Klaver7 · Tuesday at 11:56 PM

Code:

 powershell -nop -ep bypass -f E:\Z_c2023\TEST.ps1
Found  01612B139DD5598843AB1C185C3CB2EB92: SVN 9.0
Found  01612B139DD5598843AB1C185C3CB2EB92: SVN 5.0
Found  01612B139DD5598843AB1C185C3CB2EB92: SVN 11.0
Latest 01612B139DD5598843AB1C185C3CB2EB92: SVN 11.0

Found  019D2EF8E827E15841A4884C18ABE2F284: SVN 3.0
Latest 019D2EF8E827E15841A4884C18ABE2F284: SVN 3.0

Found  01C2CA99C9FE7F6F4981279E2A8A535976: SVN 3.0
Latest 01C2CA99C9FE7F6F4981279E2A8A535976: SVN 3.0

SUCCESS: Matched 3/3 SVN signatures from C:\Windows\System32\SecureBootUpdates\DBXUpdate2024.bin
PS C:\Users\

I trust you

JamesSmith · Tuesday at 11:58 PM

@garlin

Code:

PS C:\> powershell -nop -ep bypass -f .\TEST.ps1
Found  01612B139DD5598843AB1C185C3CB2EB92: SVN 7.0
Found  01612B139DD5598843AB1C185C3CB2EB92: SVN 2.0
Found  01612B139DD5598843AB1C185C3CB2EB92: SVN 8.0
Found  01612B139DD5598843AB1C185C3CB2EB92: SVN 9.0
Found  01612B139DD5598843AB1C185C3CB2EB92: SVN 11.0
Latest 01612B139DD5598843AB1C185C3CB2EB92: SVN 11.0

Found  019D2EF8E827E15841A4884C18ABE2F284: SVN 3.0
Found  019D2EF8E827E15841A4884C18ABE2F284: SVN 2.0
Latest 019D2EF8E827E15841A4884C18ABE2F284: SVN 3.0

Found  01C2CA99C9FE7F6F4981279E2A8A535976: SVN 3.0
Found  01C2CA99C9FE7F6F4981279E2A8A535976: SVN 2.0
Latest 01C2CA99C9FE7F6F4981279E2A8A535976: SVN 3.0

SUCCESS: Matched 3/3 SVN signatures from C:\Windows\System32\SecureBootUpdates\DBXUpdate2024.bin
PS C:\>

Scott · 2026-09-09T00:35:30-0400

My System 3

JamesSmith · 2026-09-09T00:58:49-0400

Both my PCs had the same results. Thanks again to Garlin who was able to resolve this in under 12 hours. Thank you so much go have a beer and chill out. You are a legend.

garlin · 2026-09-09T02:42:12-0400

I think this version should work for everyone. Fingers crossed.

Since the SVN wasn't treated everywhere as a [version] variable type, PS was sorting it as a string in dictionary (not numerical) sort order. Where 11.0 comes before 3.0, 5.0, 7.0, 9.0.

JamesSmith · 2026-09-09T02:47:58-0400

garlin said:
I think this version should work for everyone. Fingers crossed.

Since the SVN wasn't treated everywhere as a [version] variable type, PS was sorting it as a string in dictionary (not numerical) sort order. Where 11.0 comes before 3.0, 5.0, 7.0, 9.0.

It worked

Code:

PS C:\> powershell -nop -ep bypass -f .\Check_DBXUpdate.bin.ps1 -Verbose
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdate2024.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

PS C:\>

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Similar threads

My Computers

My Computer

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer

My Computer

My Computer

My Computers

My Computers

My Computer

My Computer

My Computer

My Computers

My Computers

My Computers

My Computer

My Computers