Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

wabbit · 2026-10-13T13:47:44-0400

And Groundhog day again

Code:

powershell -nop -ep bypass -f E:\Z_c2023\Check_UEFI-CA2023.ps1 -audit -verbose
Windows 11 26H2 (26300.9711)
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
    Gigabyte Technology Co. B650 GAMING X AX V2
    Version: F38
    Date: 2025-12-17

Factory Default UEFI PK Cert
----------------------------
    GIGABYTE

UEFI PK Cert
------------
    GIGABYTE

Factory Default UEFI KEK Certs
------------------------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023
    GIGABYTE

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023
    GIGABYTE

Factory Default UEFI DB Certs
-----------------------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Windows UEFI CA 2023
    GIGABYTE
    GIGABYTE

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023
    GIGABYTE
    GIGABYTE

Factory Default UEFI DBX Certs
------------------------------
    (NONE)
    EFI_CERT_SHA256_GUID Signatures: 77

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 11.0
    EFI_CERT_SHA256_GUID Signatures: 345

UEFI Variables
--------------
    Credential Guard: ON
    SBAT (Linux only): sbat,1,2025051000 / shim,4 / grub,5 / grub.debian,4 / grub.peimage,2 / grub.proxmox,2

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.376, SVN 12.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    SkuSiPolicy.p7b is WRONG VERSION.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
        Version: 3.0.0.18

AUDIT REPORT
============
1.  DBXUpdateSVN.bin (12.0) is higher than UEFI SVN
2.  SkuSiPolicy.p7b (3.0.0.19) is not updated

STATUS REPORT
-------------
    Scheduled Task: "Secure-Boot-Update" is Ready.

    Registry: "UEFICA2023Status" = Updated


REQUIRED ACTION
===============

To update the DBX SVN, run the commands:

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f
    powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

[OPTIONAL] To update SkuSiPolicy.p7b, run the command:
    Update_UEFI-CA2023.ps1 -SkuSiPolicy

PS C:\Users\

I noticed the same, I'll wait until I can download the latest iso before running the SVN and SkuSIPolicy.p7b updates. So this is the final time the old PCA 2011 bootloader will be updated, as that cert expires next week.

Klaver7 · 2026-10-13T13:48:54-0400

Warre1 said:
after todays updates get this
View attachment 186468

same here:

Code:

powershell -nop -ep bypass -f E:\Z_c2023\Check_DBXUpdate.bin.ps1
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
No DBX signatures in C:\WINDOWS\System32\SecureBootUpdates\DBXUpdate2024.bin
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

PS C:\Users\

Monika1491 · 2026-10-13T13:50:18-0400

It started working:

Code:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x0020 /f
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

for the SkuSiPolicy.p7b update.
It didn't work for me before.

garlin · 2026-10-13T13:53:28-0400

Warre1 said:
after todays updates get this

I'm waiting for my update to finish, before I can check it out.

garlin · 2026-10-13T13:55:30-0400

Klaver7 said:
is it me or a small "bobo" ?

Sorry, that was a bug I introduced in the last build. Will be fixed tomorrow.

I was waiting for today's CU to see if a new boot manager was released (which I expected since it's the last time MS can use the expiring PCA 2011 cert to provide dual-signed versions of the boot file). And MS did exactly what I expected.

garlin · 2026-10-13T13:58:52-0400

BrianInEngland said:
I have secure boot enabled now but SVN is showing as 8.0

What version of the garlin scripts are you using? Or not using my scripts?

There was a fixed bug in September where it wasn't picking the highest SVN number, when determining if it should update the boot manager and SVN.

BrianInEngland · 2026-10-13T14:27:35-0400

garlin said:
What version of the garlin scripts are you using? Or not using my scripts?

There was a fixed bug in September where it wasn't picking the highest SVN number, when determining if it should update the boot manager and SVN.

I ran the reg commands, it updated to svn 12.0 after running

garlin · 2026-10-13T14:52:15-0400

October 2026's DBXUpdate2024.bin went down in size. MS removed all of the SVN entries.

In some ways it makes sense. DBXUpdate2024.bin originally bundled the PCA 2011 cert and a baseline set of SVN numbers. The oldest BootMgrSVN version started at 2.0, then moved to 3.0, 5.0, and 7.0 (over different versions of the same file). But that SVN is potentially overridden by the current SVN from DBXUpdateSVN.bin.

So why push a SVN in DBXUpdate2024.bin that you already know is out of date? MS must have decided it wasn't useful. Does this change anything? Not really. It saves one BootMgrSVN signature from taking up extra space in the DBX variable.

I would say this is "the new normal", and just get used to it. I might rewrite Check_DBXUpdate.bin.ps1 to skip reporting on the file, if you're on a later Windows build which no longer includes those SVN entries.

garlin · 2026-10-13T15:03:22-0400

Interesting discovery: WU pushed out the new boot manager by itself.

Code:

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 11.0
    EFI_CERT_SHA256_GUID Signatures: 81

UEFI Variables
--------------
    Credential Guard: ON

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.376, SVN 12.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

STATUS REPORT
-------------
    Scheduled Task: "Secure-Boot-Update" is Disabled.

I have the Secure Boot task disabled (for other testing reasons). In the past, I would have expected the task to handle this part of updating. You're allowed to have a newer boot manager on the EFI, if that file's own SVN is higher than the UEFI's DBX version.

Normally the task (if it was enabled) would update the DBX SVN on the next reboot.

Scott · 2026-10-13T16:21:58-0400

All 3 systems up to date. All bootable media updated.

Code:

PS D:\Scripts\SecureBoot-CA-2023-Updates.v2026.10.08> .\Check_BootMedia.ps1 -verbose
Windows 11 26H2 (26300.9711)
Secure Boot: ON
Virtualization Based Security: ON

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 12.0

EFI Files
---------
    SkuSiPolicy.p7b is CURRENT.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
        Version: 3.0.0.19

        FileRule             MinimumFileVersion MaximumFileVersion
        --------             ------------------ ------------------
        ID_FILEATTRIB_F_0044 0.0.0.0            10.0.14393.9579
        ID_FILEATTRIB_F_0042 10.0.14400.0       10.0.17763.9339
        ID_FILEATTRIB_F_0040 10.0.18000.0       10.0.19041.7759
        ID_FILEATTRIB_F_0041 10.0.19100.0       10.0.20348.5719
        ID_FILEATTRIB_F_0046 10.0.20400.0       10.0.22621.7619
        ID_FILEATTRIB_F_0049 10.0.23000.0       10.0.26100.9680
        ID_FILEATTRIB_F_0045 10.0.26100.32000   10.0.26100.33589
        ID_FILEATTRIB_F_0048 10.0.26172.0       10.0.26172.33590
        ID_FILEATTRIB_F_0047 10.0.27000.0       10.0.28000.3200
        ID_FILEATTRIB_F_0043 10.0.29426.0       65535.65535.65535.65535


    NOT RECOMMENDED for dual-boot setups.

Macrium v8.1.8853
-----------------
    WinRE Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.376, SVN 12.0

Bootable Media
--------------

USB Drive J: "MACRIUMHOME"
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        J:\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.376, SVN 12.0

    boot.wim:1 (WinRE 26100.9711)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
            \Windows\Boot\EFI_EX\bootmgfw_EX.efi
            File Version: 28000.376, SVN 12.0

        \Windows\System32\winload.efi is ALLOWED.
            File Version: 26100.9711


USB Drive K: "BOOT2023PCA"
    Boot File [Windows UEFI CA 2023] is ALLOWED.
        K:\EFI\Boot\bootx64.efi
        File Version: 28000.376, SVN 12.0

    boot.wim:2 (WinRE 26100.9711)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
            \Windows\Boot\EFI_EX\bootmgfw_EX.efi
            File Version: 28000.376, SVN 12.0

        \Windows\System32\winload.efi is ALLOWED.
            File Version: 26100.9711

    K:\EFI\Microsoft\Boot\boot.stl [9/2/2026 08:37] is CURRENT.

    Please wait while install SWM is analyzed.

    install.swm:1 (W11 26H2 26300.9711)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
            \Windows\Boot\EFI_EX\bootmgfw_EX.efi
            File Version: 28000.376, SVN 12.0

        \Windows\System32\winload.efi is ALLOWED.
            File Version: 26100.9711


PS D:\Scripts\SecureBoot-CA-2023-Updates.v2026.10.08>

suatcini54 · 2026-10-13T22:35:40-0400

garlin said:
Normally the task (if it was enabled) would update the DBX SVN on the next reboot.

DBX SVN has not updated itself on the next several reboots in my system when SecureBoot update Task was enabled. I have to manually update it using registry:

"reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f"

The following screenshot is taken after two reboots, one after the installation of patch Tuesday and the other after a complete shutdown of the PC (October 13) and turning it back on one day later (October 14).

So it seems Firmware DBX SVN does not auto-update in my PC. Could be because my PC is not meeting W11 hardware requirements.

Marcus Vinicus · 2026-10-13T23:35:44-0400

I get the FirmwareSVN not compliant as well. Any help appreciated.

garlin · 2026-10-14T00:01:37-0400

You have the choice of asking the Secure Boot task to update it, or run the update script. Same results.

Code:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Code:

Update-UEFI.bat -Revoke

Marcus Vinicus · 2026-10-14T00:07:32-0400

Muchas Gracias

Code:

PS C:\Windows\System32> powershell -nop -ep bypass -f D:\Scripts\Check_UEFI-CA2023.ps1 -audit -verbose
Windows 11 26H2 (26300.9711)
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
    ASUS System Product Name
    Version: 3202
    Date: 2026-05-07

Factory Default UEFI PK Cert
----------------------------
    ASUSTeK MotherBoard PK Certificate

UEFI PK Cert
------------
    ASUSTeK MotherBoard PK Certificate

Factory Default UEFI KEK Certs
------------------------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023
    ASUSTeK MotherBoard KEK Certificate

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023
    ASUSTeK MotherBoard KEK Certificate

Factory Default UEFI DB Certs
-----------------------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023
    ASUSTeK MotherBoard UEFI DB Certificate
    ASUSTeK MotherBoard UEFI TOOL Certificate
    ASUSTeK Notebook SW Key Certificate

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023
    ASUSTeK MotherBoard SW Key Certificate
    ASUSTeK Notebook SW Key Certificate

Factory Default UEFI DBX Certs
------------------------------
    ASUSTeK MotherBoard SW Key Certificate
    EFI_CERT_SHA256_GUID Signatures: 431

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 12.0
    EFI_CERT_SHA256_GUID Signatures: 450

UEFI Variables
--------------
    Credential Guard: ON
    SBAT (Linux only): sbat,1,2025051000 / shim,4 / grub,5 / grub.debian,4 / grub.peimage,2 / grub.proxmox,2

EFI Files
---------
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.376, SVN 12.0

    Registry: "WindowsUEFICA2023Capable" = 2
        [Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

    SkuSiPolicy.p7b is CURRENT.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
        Version: 3.0.0.19

AUDIT REPORT
============
    PASSED ALL CHECKS.

STATUS REPORT
-------------
    Scheduled Task: "Secure-Boot-Update" is Ready.

    Registry: "UEFICA2023Status" = Updated

    SUCCESS: UPDATES ARE FINISHED.
    UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

garlin · 2026-10-14T00:11:51-0400

I must be getting old. This is the second time I've forgotten the Secure Boot task doesn't auto-update the SVN (probably because MS is scared about breaking dual-boot setups)...

suatcini54 · 2026-10-14T03:27:38-0400

garlin said:
I must be getting old. This is the second time I've forgotten the Secure Boot task doesn't auto-update the SVN (probably because MS is scared about breaking dual-boot setups)...

That is a good thing because I am the one who would be suffering most about it. If MS had auto-updated SVN on its own after a SVN update, I had to disable Secure Boot, update the other OS and re-enable Secure Boot. I once made the mistake of running the registry entry to level SVN update and could not boot into the other.

MS much cares about Windows users.

Thierry 83200 · 2026-10-14T03:55:17-0400

Hello everyone, what should I do, or is everything fine? Thanks for your replies.

RFS · 2026-10-14T03:58:14-0400

I get this on all 4 of my systems, including 2-year old Dell laptop that has had regualr BIOS updates. What does it mean?

garlin · 2026-10-14T04:29:21-0400

RFS said:
I get this on all 4 of my systems, including 2-year old Dell laptop that has had regualr BIOS updates. What does it mean?

This PC hasn’t revoked the CA 2011 cert. As a byproduct of that update process, the SVN gets initialized in the DBX. Since revocation isn’t mandatory for now, only users who have forced a revoke will get a non-zero FirmwareSVN.

You can chose to leave Secure Boot alone, and wait for MS to eventually revoke the old cert, or force it now. Until then the SVN isn’t used to block which older versions of the Windows boot manager are allowed for booting.

Monika1491 · 2026-10-14T04:42:45-0400

suatcini54 said:
DBX SVN has not updated itself on the next several reboots in my system when SecureBoot update Task was enabled. I have to manually update it using registry:

"reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f"

The following screenshot is taken after two reboots, one after the installation of patch Tuesday and the other after a complete shutdown of the PC (October 13) and turning it back on one day later (October 14).

View attachment 186542

So it seems Firmware DBX SVN does not auto-update in my PC. Could be because my PC is not meeting W11 hardware requirements.

update, update, update...
PowerShell 7.6.6 is not up to date.
The current version is PowerShell 7.6.7

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Semper paratus

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Semper paratus

Attachments

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Similar threads

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computers

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer