Solved garlin's PowerShell scripts for updating Secure Boot CA 2023


I am suffering from extreme brain fog yesterday and today after trying to to run the updated scripts after Tuesday patch day. What's the right way to fix this:

Image1.webp
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 25H2i7-8565U16GBIntel UHD Graphics 620
    OS
    Windows 11 Pro 25H2
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo T490 (2020 Hardware)
    CPU
    i7-8565U
    Motherboard
    20N20028US
    Memory
    16GB
    Graphics Card(s)
    Intel UHD Graphics 620
    Sound Card
    Realtec Audio
    Monitor(s) Displays
    ASUS VE248
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung SSD 970 PRO 512GB NVMe
    Internet Speed
    Frontier fiber 1GB
    Browser
    Chrome, Firefox, Edge
    Antivirus
    Norton 360 Deluxe Plus
    Other Info
    Supported hardware, upgraded from Windows 10 Pro to Windows 11 Pro version 24H2 on 06/01/2025 using the Windows 11 ISO file. Used the enablement package to upgrade to version 25H2 on 10/07/2025. Secure boot enabled. Secure Boot CA 2023 updated.

  • At a glance

    Windows 11 Pro 25H2i7-4770 (with SSE4.2, and POPCNT)16GBIntel HD Graphics 4600
    Operating System
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Lenovo ThinkCentre M83 (2014 Hardware)
    CPU
    i7-4770 (with SSE4.2, and POPCNT)
    Motherboard
    10AL000GUS
    Memory
    16GB
    Graphics card(s)
    Intel HD Graphics 4600
    Sound Card
    Realtec High Definition Audio
    Monitor(s) Displays
    ASUS VE248
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung SSD 860 PRO 1TB SATA
    Internet Speed
    Frontier fiber 1GB
    Browser
    Chrome, Firefox, Edge
    Antivirus
    Norton 360 Deluxe Plus
    Other Info
    Unsupported hardware, upgraded from Windows 10 Pro (TPM 1.2 & unsupported CPU, but does have SSE4.2, and POPCNT) to Windows 11 Pro version 24H2 on 06/15/2025. Added Registry Key HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup – AllowUpgradesWithUnsupportedTPMOrCPU=1 to allow installation using the Windows 11 ISO file. Used the enablement package to upgrade to version 25H2 on 10/08/2025. Secure boot enabled. Secure Boot CA 2023 updated.
nikki605 said:
I am suffering from extreme brain fog yesterday and today after trying to to run the updated scripts after Tuesday patch day. What's the right way to fix this:

View attachment 182449
Click to expand...
I had the same issue. Resolved with the instructions in How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 | Microsoft Support

Starting with the July 9, 2024, updates, the SVN is being incremented in the Boot Manager and the update to the firmware. The firmware update is optional and can be applied by following this step:

1: Apply the SVN update to the firmware. To do this, open a Command Prompt window as an Administrator, type each of the following commands separately, and then press Enter:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f

2: Then start the task in task manager
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

PS: command no. 2 give me an error. I started the task manually from Task Manager (under "Microsoft\Windows\PI\Secure-Boot-Update")
 

My Computer My Computer

At a glance

Windows 11 22H2 22621.2215Intel Core i7-11800H64 GBIntel Tiger Lake-H - GT1 Integrated Graphics ...
OS
Windows 11 22H2 22621.2215
Computer type
Laptop
Manufacturer/Model
HP OMEN 17''
CPU
Intel Core i7-11800H
Motherboard
HP 88F7 - Intel HM570 (Tiger Lake PCH-H) chipset
Memory
64 GB
Graphics Card(s)
Intel Tiger Lake-H - GT1 Integrated Graphics [Hewlett-Packard] + NVIDIA GeForce RTX 3070
Screen Resolution
2560x1440
Hard Drives
Crucial nvme (CT2000P5PSSD8+CT2000P3SSD8) with Intel RST WMD controller
I added the registry key, but I'm doing something wrong when running the task.

Image1.webp
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 25H2i7-8565U16GBIntel UHD Graphics 620
    OS
    Windows 11 Pro 25H2
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo T490 (2020 Hardware)
    CPU
    i7-8565U
    Motherboard
    20N20028US
    Memory
    16GB
    Graphics Card(s)
    Intel UHD Graphics 620
    Sound Card
    Realtec Audio
    Monitor(s) Displays
    ASUS VE248
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung SSD 970 PRO 512GB NVMe
    Internet Speed
    Frontier fiber 1GB
    Browser
    Chrome, Firefox, Edge
    Antivirus
    Norton 360 Deluxe Plus
    Other Info
    Supported hardware, upgraded from Windows 10 Pro to Windows 11 Pro version 24H2 on 06/01/2025 using the Windows 11 ISO file. Used the enablement package to upgrade to version 25H2 on 10/07/2025. Secure boot enabled. Secure Boot CA 2023 updated.

  • At a glance

    Windows 11 Pro 25H2i7-4770 (with SSE4.2, and POPCNT)16GBIntel HD Graphics 4600
    Operating System
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Lenovo ThinkCentre M83 (2014 Hardware)
    CPU
    i7-4770 (with SSE4.2, and POPCNT)
    Motherboard
    10AL000GUS
    Memory
    16GB
    Graphics card(s)
    Intel HD Graphics 4600
    Sound Card
    Realtec High Definition Audio
    Monitor(s) Displays
    ASUS VE248
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung SSD 860 PRO 1TB SATA
    Internet Speed
    Frontier fiber 1GB
    Browser
    Chrome, Firefox, Edge
    Antivirus
    Norton 360 Deluxe Plus
    Other Info
    Unsupported hardware, upgraded from Windows 10 Pro (TPM 1.2 & unsupported CPU, but does have SSE4.2, and POPCNT) to Windows 11 Pro version 24H2 on 06/15/2025. Added Registry Key HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup – AllowUpgradesWithUnsupportedTPMOrCPU=1 to allow installation using the Windows 11 ISO file. Used the enablement package to upgrade to version 25H2 on 10/08/2025. Secure boot enabled. Secure Boot CA 2023 updated.
nikki605 said:
I added the registry key, but I'm doing something wrong when running the task.

View attachment 182456
Click to expand...
Yes, I had the same error. As I wrote before, you must open Task Manager, search for the first task you see under "Microsoft\Windows\PI". The task is named "Secure-Boot-Update". Run it and reboot.
 

My Computer My Computer

At a glance

Windows 11 22H2 22621.2215Intel Core i7-11800H64 GBIntel Tiger Lake-H - GT1 Integrated Graphics ...
OS
Windows 11 22H2 22621.2215
Computer type
Laptop
Manufacturer/Model
HP OMEN 17''
CPU
Intel Core i7-11800H
Motherboard
HP 88F7 - Intel HM570 (Tiger Lake PCH-H) chipset
Memory
64 GB
Graphics Card(s)
Intel Tiger Lake-H - GT1 Integrated Graphics [Hewlett-Packard] + NVIDIA GeForce RTX 3070
Screen Resolution
2560x1440
Hard Drives
Crucial nvme (CT2000P5PSSD8+CT2000P3SSD8) with Intel RST WMD controller
botus said:
tried last nights second test file - am I doing something wrong - this is an on a oldish Dell Inspiron 3668

BIOS Version/Date Dell Inc. 1.18.0, 05/10/2021
SMBIOS Version 3.0
Embedded Controller Version 255.255
BIOS Mode UEFI
on Win 10 with latest updates
Click to expand...


this is a strange one - it did a boomerang today

it already claimed it went on the day after it actually did - now MS are putting it on again ???

bomerang.webp

edit - and here it is magically reinstalled TODAY

Same PC.webp

how the very same PC looked yesterday.... KB5127070 loaded and rebooted showing it was there on Tuesday evening - but updates list says it went on Wednesday - now Thursday MS is reinstalling it ????

re-update-webp.182275
 

My Computer My Computer

At a glance

Win11
OS
Win11
UPDATE: 2026-09-10

1. September 2026 LCU introduced SVN 11.0, requiring a new minimum UBR for supported releases
2. Get-SignatureDataSVN fails to cast SVN as type [version] in Check_DBXUpdate.bin.ps1

Fixed the bug where Check_DBXUpdate.bin.ps1 incorrectly reports DBX is missing 1 out of 3 SVN's.

Updated the check for your Windows monthly update level, to reflect Sept 2026 is required for having the latest Secure Boot changes.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
Alan Smithee said:
Yes, I had the same error. As I wrote before, you must open Task Manager, search for the first task you see under "Microsoft\Windows\PI". The task is named "Secure-Boot-Update". Run it and reboot.
Click to expand...
I don't have anything called Microsoft\Windows\PI in Task Manager.

Image1.webp

Going through this every month after patch Tuesday is getting to be too much for this old man. In a month's time I forget what to do and how to do it.

I desperately miss Windows 7.
 
Last edited:

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 25H2i7-8565U16GBIntel UHD Graphics 620
    OS
    Windows 11 Pro 25H2
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo T490 (2020 Hardware)
    CPU
    i7-8565U
    Motherboard
    20N20028US
    Memory
    16GB
    Graphics Card(s)
    Intel UHD Graphics 620
    Sound Card
    Realtec Audio
    Monitor(s) Displays
    ASUS VE248
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung SSD 970 PRO 512GB NVMe
    Internet Speed
    Frontier fiber 1GB
    Browser
    Chrome, Firefox, Edge
    Antivirus
    Norton 360 Deluxe Plus
    Other Info
    Supported hardware, upgraded from Windows 10 Pro to Windows 11 Pro version 24H2 on 06/01/2025 using the Windows 11 ISO file. Used the enablement package to upgrade to version 25H2 on 10/07/2025. Secure boot enabled. Secure Boot CA 2023 updated.

  • At a glance

    Windows 11 Pro 25H2i7-4770 (with SSE4.2, and POPCNT)16GBIntel HD Graphics 4600
    Operating System
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Lenovo ThinkCentre M83 (2014 Hardware)
    CPU
    i7-4770 (with SSE4.2, and POPCNT)
    Motherboard
    10AL000GUS
    Memory
    16GB
    Graphics card(s)
    Intel HD Graphics 4600
    Sound Card
    Realtec High Definition Audio
    Monitor(s) Displays
    ASUS VE248
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung SSD 860 PRO 1TB SATA
    Internet Speed
    Frontier fiber 1GB
    Browser
    Chrome, Firefox, Edge
    Antivirus
    Norton 360 Deluxe Plus
    Other Info
    Unsupported hardware, upgraded from Windows 10 Pro (TPM 1.2 & unsupported CPU, but does have SSE4.2, and POPCNT) to Windows 11 Pro version 24H2 on 06/15/2025. Added Registry Key HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup – AllowUpgradesWithUnsupportedTPMOrCPU=1 to allow installation using the Windows 11 ISO file. Used the enablement package to upgrade to version 25H2 on 10/08/2025. Secure boot enabled. Secure Boot CA 2023 updated.
@nikki605 Ignore the DBX error, it's a reporting bug fixed by today's ZIP file update.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
That's a fixed bug. Download the ZIP file again.
Click to expand...
I downloaded the new ZIP file. This looks good, I think:
Image1.webp

I also ran the latest Check-UEFI.bat -Verbose which also looks good, I think. What say you @garlin ? Now I'll have to try to remember how to update my Macrium X Rescue boot USB. Then I'll have to wait for my wife to get off her desktop so I can do all of this on her machine.... groan :confused:

Windows 11 25H2 (26200.9445)
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
LENOVO 20N20028US
Version: N2IETA7W (1.85 )
Date: 2026-04-06

Factory Default UEFI PK Cert
----------------------------
Lenovo Ltd. PK CA 2012

UEFI PK Cert
------------
Lenovo Ltd. PK CA 2012

Factory Default UEFI KEK Certs
------------------------------
Microsoft Corporation KEK CA 2011
Lenovo Ltd. KEK CA 2012
Microsoft Corporation KEK 2K CA 2023

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Lenovo Ltd. KEK CA 2012
Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
ThinkPad Product CA 2012
Lenovo UEFI CA 2014
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
ThinkPad Product CA 2012
Lenovo UEFI CA 2014
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
Debian Secure Boot Signer
Canonical Ltd. Secure Boot Signing
EFI_CERT_SHA256_GUID Signatures: 894

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 11.0
EFI_CERT_SHA256_GUID Signatures: 506

UEFI Variables
--------------
Credential Guard: ON
SBAT (Linux only): sbat,1,2025051000 / shim,4 / grub,5 / grub.debian,4 / grub.peimage,2 / grub.proxmox,2

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\\.\HarddiskVolume2\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.367, SVN 11.0

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

[OPTIONAL] SkuSiPolicy.p7b (for VBS) is MISSING.

STATUS REPORT
-------------
Registry: "UEFICA2023Status" = Updated

SUCCESS: UPDATES ARE FINISHED.
UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

PS C:\SecureBoot\SecureBoot-CA-2023-Updates_v2026-09-10>
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 25H2i7-8565U16GBIntel UHD Graphics 620
    OS
    Windows 11 Pro 25H2
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo T490 (2020 Hardware)
    CPU
    i7-8565U
    Motherboard
    20N20028US
    Memory
    16GB
    Graphics Card(s)
    Intel UHD Graphics 620
    Sound Card
    Realtec Audio
    Monitor(s) Displays
    ASUS VE248
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung SSD 970 PRO 512GB NVMe
    Internet Speed
    Frontier fiber 1GB
    Browser
    Chrome, Firefox, Edge
    Antivirus
    Norton 360 Deluxe Plus
    Other Info
    Supported hardware, upgraded from Windows 10 Pro to Windows 11 Pro version 24H2 on 06/01/2025 using the Windows 11 ISO file. Used the enablement package to upgrade to version 25H2 on 10/07/2025. Secure boot enabled. Secure Boot CA 2023 updated.

  • At a glance

    Windows 11 Pro 25H2i7-4770 (with SSE4.2, and POPCNT)16GBIntel HD Graphics 4600
    Operating System
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Lenovo ThinkCentre M83 (2014 Hardware)
    CPU
    i7-4770 (with SSE4.2, and POPCNT)
    Motherboard
    10AL000GUS
    Memory
    16GB
    Graphics card(s)
    Intel HD Graphics 4600
    Sound Card
    Realtec High Definition Audio
    Monitor(s) Displays
    ASUS VE248
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung SSD 860 PRO 1TB SATA
    Internet Speed
    Frontier fiber 1GB
    Browser
    Chrome, Firefox, Edge
    Antivirus
    Norton 360 Deluxe Plus
    Other Info
    Unsupported hardware, upgraded from Windows 10 Pro (TPM 1.2 & unsupported CPU, but does have SSE4.2, and POPCNT) to Windows 11 Pro version 24H2 on 06/15/2025. Added Registry Key HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup – AllowUpgradesWithUnsupportedTPMOrCPU=1 to allow installation using the Windows 11 ISO file. Used the enablement package to upgrade to version 25H2 on 10/08/2025. Secure boot enabled. Secure Boot CA 2023 updated.
nikki605 said:
I also ran the latest Check-UEFI.bat -Verbose which also looks good, I think. What say you @garlin ? Now I'll have to try to remember how to update my Macrium X Rescue boot USB. Then I'll have to wait for my wife to get off her desktop so I can do all of this on her machine.... groan :confused:
Click to expand...

nikki605 said:
UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 11.0
EFI_CERT_SHA256_GUID Signatures: 506
Click to expand...
nikki605 said:
EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\\.\HarddiskVolume2\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.367, SVN 11.0
Click to expand...
Basically if the SVN changes (for September, it jumps to 11.0) in both the DBX and EFI locations, then you're good.

@KevTech has some Macrium X tips posted in this thread. Use the search function (-> "This thread") to find the earlier posts.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
Basically if the SVN changes (for September, it jumps to 11.0) in both the DBX and EFI locations, then you're good.

@KevTech has some Macrium X tips posted in this thread. Use the search function (-> "This thread") to find the earlier posts.
Click to expand...
Thanks. Macrium X boot USB is next. I also found out that I have to update the Windows recovery USB drive.
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 25H2i7-8565U16GBIntel UHD Graphics 620
    OS
    Windows 11 Pro 25H2
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo T490 (2020 Hardware)
    CPU
    i7-8565U
    Motherboard
    20N20028US
    Memory
    16GB
    Graphics Card(s)
    Intel UHD Graphics 620
    Sound Card
    Realtec Audio
    Monitor(s) Displays
    ASUS VE248
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung SSD 970 PRO 512GB NVMe
    Internet Speed
    Frontier fiber 1GB
    Browser
    Chrome, Firefox, Edge
    Antivirus
    Norton 360 Deluxe Plus
    Other Info
    Supported hardware, upgraded from Windows 10 Pro to Windows 11 Pro version 24H2 on 06/01/2025 using the Windows 11 ISO file. Used the enablement package to upgrade to version 25H2 on 10/07/2025. Secure boot enabled. Secure Boot CA 2023 updated.

  • At a glance

    Windows 11 Pro 25H2i7-4770 (with SSE4.2, and POPCNT)16GBIntel HD Graphics 4600
    Operating System
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Lenovo ThinkCentre M83 (2014 Hardware)
    CPU
    i7-4770 (with SSE4.2, and POPCNT)
    Motherboard
    10AL000GUS
    Memory
    16GB
    Graphics card(s)
    Intel HD Graphics 4600
    Sound Card
    Realtec High Definition Audio
    Monitor(s) Displays
    ASUS VE248
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung SSD 860 PRO 1TB SATA
    Internet Speed
    Frontier fiber 1GB
    Browser
    Chrome, Firefox, Edge
    Antivirus
    Norton 360 Deluxe Plus
    Other Info
    Unsupported hardware, upgraded from Windows 10 Pro (TPM 1.2 & unsupported CPU, but does have SSE4.2, and POPCNT) to Windows 11 Pro version 24H2 on 06/15/2025. Added Registry Key HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup – AllowUpgradesWithUnsupportedTPMOrCPU=1 to allow installation using the Windows 11 ISO file. Used the enablement package to upgrade to version 25H2 on 10/08/2025. Secure boot enabled. Secure Boot CA 2023 updated.
Don't worry, after you've done this a few times it becomes muscle memory. :LOL:
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
Don't worry, after you've done this a few times it becomes muscle memory. :LOL:
Click to expand...
I hope!

I copied the new bootx64.efi and bootmgfw.efi files to the Macrium X and Windows Recovery boot USB drives and both booted just fine. :thumbsup:
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 Pro 25H2i7-8565U16GBIntel UHD Graphics 620
    OS
    Windows 11 Pro 25H2
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo T490 (2020 Hardware)
    CPU
    i7-8565U
    Motherboard
    20N20028US
    Memory
    16GB
    Graphics Card(s)
    Intel UHD Graphics 620
    Sound Card
    Realtec Audio
    Monitor(s) Displays
    ASUS VE248
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung SSD 970 PRO 512GB NVMe
    Internet Speed
    Frontier fiber 1GB
    Browser
    Chrome, Firefox, Edge
    Antivirus
    Norton 360 Deluxe Plus
    Other Info
    Supported hardware, upgraded from Windows 10 Pro to Windows 11 Pro version 24H2 on 06/01/2025 using the Windows 11 ISO file. Used the enablement package to upgrade to version 25H2 on 10/07/2025. Secure boot enabled. Secure Boot CA 2023 updated.

  • At a glance

    Windows 11 Pro 25H2i7-4770 (with SSE4.2, and POPCNT)16GBIntel HD Graphics 4600
    Operating System
    Windows 11 Pro 25H2
    Computer type
    PC/Desktop
    Manufacturer/Model
    Lenovo ThinkCentre M83 (2014 Hardware)
    CPU
    i7-4770 (with SSE4.2, and POPCNT)
    Motherboard
    10AL000GUS
    Memory
    16GB
    Graphics card(s)
    Intel HD Graphics 4600
    Sound Card
    Realtec High Definition Audio
    Monitor(s) Displays
    ASUS VE248
    Screen Resolution
    1920 X 1080
    Hard Drives
    Samsung SSD 860 PRO 1TB SATA
    Internet Speed
    Frontier fiber 1GB
    Browser
    Chrome, Firefox, Edge
    Antivirus
    Norton 360 Deluxe Plus
    Other Info
    Unsupported hardware, upgraded from Windows 10 Pro (TPM 1.2 & unsupported CPU, but does have SSE4.2, and POPCNT) to Windows 11 Pro version 24H2 on 06/15/2025. Added Registry Key HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup – AllowUpgradesWithUnsupportedTPMOrCPU=1 to allow installation using the Windows 11 ISO file. Used the enablement package to upgrade to version 25H2 on 10/08/2025. Secure boot enabled. Secure Boot CA 2023 updated.
garlin said:
It makes you wonder how many Secure Boot bugs they fixed in the past month. Jumping from SVN 9.0 to 11.0 makes me think they got hit twice in a row.
Click to expand...

This whole process is going to make it painful to restore backups. I guess the procedure would be to disable secure boot in BIOS before the restore, restore, boot and fix the boot manager from windows, then restore secure boot in BIOS. Correct?
 

My Computers My Computers

System One System Two

  • At a glance

    Windows 11 ProIntel Core i9 14900K 5800/4500 P/E96GB (2x48) G.skill Ripjaws 6800Asus ROG Strix 4070 Ti OC
    OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    DIY Photoshop/Audio/Game/tinker
    CPU
    Intel Core i9 14900K 5800/4500 P/E
    Motherboard
    Asus ROG Maximus Z790 Dark Hero
    Memory
    96GB (2x48) G.skill Ripjaws 6800
    Graphics Card(s)
    Asus ROG Strix 4070 Ti OC
    Sound Card
    B&W 606 S3 speakers; Audiolabs 7000a integrated amp; RSL 10S Mk2 sub
    Monitor(s) Displays
    Eizo CG2730 ColorEdge, ViewSonic VP2768
    Screen Resolution
    2560 x 1440 x 2
    Hard Drives
    nvme: WDC SN850X 4TB, SN850 1TB, SK-Hynix 2 TB P41
    Spinners: Sabrent USB-C DS-SC5B 5-bay docking station, 6TB WDC Black, 6TB Ironwolf Pro 2x 2TB WDC Black
    PSU
    850W Seasonic Vertex PX-850
    Case
    FD North XL Mesh, Black Walnut
    Cooling
    EK Nucleus black 360 AIO w/Phanteks T30 fans; 2 Noctua NF-A14 Chromax ; T30 for memory
    Keyboard
    Keychron Q3 Max TKL w/GMK Redsuns Red Samuri keycaps
    Mouse
    Logitech G305 wireless gaming
    Internet Speed
    575 Mb/s down | 25 Mb/s up
    Browser
    Firefox
    Antivirus
    Defender, Macrium Reflect X
    Other Info
    Phangkey Amaterasu V2 Desk Mat

  • At a glance

    Apple M1
    Computer type
    Laptop
    Manufacturer/Model
    💻 Apple 13" Macbook Pro 2020 (m1)
    CPU
    Apple M1
    Screen Resolution
    2560x1600
    Browser
    Firefox
PerpetualCycle said:
I guess the procedure would be to disable secure boot in BIOS before the restore, restore, boot and fix the boot manager from windows, then restore secure boot in BIOS. Correct?
Click to expand...
Correct.

At some point, a lot of folks likely will just get tired of the rebuilding loop, and leave Secure Boot off...
 

My Computer My Computer

At a glance

Windows 11 Pro 25H2
OS
Windows 11 Pro 25H2
Computer type
Laptop
Manufacturer/Model
Toshiba
Or leave it disabled only while recovering.

Or maybe the backup vendors will take my suggestion and self-monitor when Windows changes the boot file, and auto-prompt you to insert your USB drive for a quick refresh. It's free advice...
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
UPDATE: 2026-09-10

1. September 2026 LCU introduced SVN 11.0, requiring a new minimum UBR for supported releases
2. Get-SignatureDataSVN fails to cast SVN as type [version] in Check_DBXUpdate.bin.ps1

Fixed the bug where Check_DBXUpdate.bin.ps1 incorrectly reports DBX is missing 1 out of 3 SVN's.

Updated the check for your Windows monthly update level, to reflect Sept 2026 is required for having the latest Secure Boot changes.
Click to expand...
is it something I'm doing ?

Same issue.webp


check

Windows 10 22H2 (19045.7725)
Secure Boot: ON
Virtualization Based Security: OFF
BitLocker on (C:) OFF

BIOS Firmware
-------------
Dell Inc. Inspiron 3668
Version: 1.18.0
Date: 2021-10-05

Factory Default UEFI PK Cert
----------------------------
Dell Inc. UEFI Platform Key

UEFI PK Cert
------------
Windows OEM Devices PK

Factory Default UEFI KEK Certs
------------------------------
Microsoft Corporation KEK CA 2011

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
Microsoft Windows PCA 2010
EFI_CERT_SHA256_GUID Signatures: 13

UEFI DBX Certs
--------------
(NONE)
Windows BootMgr SVN is MISSING.
EFI_CERT_SHA256_GUID Signatures: 445

UEFI Variables
--------------
SBAT (Linux only): sbat,1,2025051000 / shim,4 / grub,5 / grub.debian,4 / grub.peimage,2 / grub.proxmox,2

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.367, SVN 11.0

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

STATUS REPORT
-------------
Registry: "UEFICA2023Status" = Updated


REQUIRED ACTION
===============

To REVOKE the [PCA 2011] cert, run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x280 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

PS C:\WINDOWS\system32>
Click to expand...
 

My Computer My Computer

At a glance

Win11
OS
Win11
hello,
after last Tuesday monthly update, i´m getting continuos "event error TPM-WMI 1796" about the impossibility of SBAT update due to device not ready...
maybe it´s because i´ve not made the revocation of the Microsoft Windows Production PCA 2011 yet?
any advice, please
thank you in advance,
fernando
**************************************************************************************************Captura de pantalla (675).webp

Windows 10 21H2 (19044.7725)

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
ASUSTeK COMPUTER INC. M32CD_A_F_K20CD_K31CD
Version: 1102
Date: 2018-04-12

Factory Default UEFI PK Cert
----------------------------
ASUSTeK MotherBoard PK Certificate

UEFI PK Cert
------------
Windows OEM Devices PK

Factory Default UEFI KEK Certs
------------------------------
Microsoft Corporation KEK CA 2011
Canonical Ltd. Master Certificate Authority
ASUSTeK MotherBoard KEK Certificate

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Canonical Ltd. Master Certificate Authority
ASUSTeK MotherBoard SW Key Certificate
ASUSTeK Notebook SW Key Certificate

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
(NONE)
EFI_CERT_SHA256_GUID Signatures: 77

UEFI DBX Certs
--------------
(NONE)
Windows BootMgr SVN is MISSING.
EFI_CERT_SHA256_GUID Signatures: 445

UEFI Variables
--------------
SBAT (Linux only): sbat,1,2024010900 / shim,4 / grub,3 / grub.debian,4

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\\.\HarddiskVolume6\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.367, SVN 11.0

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

[OPTIONAL] SkuSiPolicy.p7b (for VBS) is MISSING.


REQUIRED ACTION
===============
To REVOKE the [PCA 2011] cert, run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x280 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
*****************************************************************************************************
 

My Computer My Computer

At a glance

windows 10 Enterprise IoT LTSCIntel(R) Core(TM) i5-6400 CPU @ 2.70GHz16GBIntel HD Graphics 530 (integrated on Motherbo...
OS
windows 10 Enterprise IoT LTSC
Computer type
PC/Desktop
Manufacturer/Model
ASUS/ K31CD
CPU
Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz
Memory
16GB
Graphics Card(s)
Intel HD Graphics 530 (integrated on Motherboard)
Other Info
BIOS: American Megatrends Inc.
v. 1102 (12-2018)
You must log in or register to reply here.

Similar threads

Secure Boot Update Issue for 2014 Dell Laptop
Replies
7
Views
2K
SIW2
SIW2

Latest Support Threads

Latest Tutorials

Back
Top Bottom