Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

garlin · 2026-10-14T12:38:22-0400

UPDATE: 2026-10-14

1. Incorrect warning on DeviceGuard registry key inside Update_UEFI-CA2023.ps1
2. Incorrect warning on RescuePE registry key inside Check_BootMedia.ps1
3. October 2026 LCU introduced SVN 12.0, requiring a new minimum UBR for supported releases
4. October 2026 LCU removed SVN's from DBXUpdate2024.bin

Reverted v2026-10-08 changes to all Get-ItemPropertyValue function calls, where the "-ErrorAction Stop" parameter was incorrectly removed. This broke the error handling when reading from any undefined reg value. Users should not see the "DeviceGuard" error.

Oct 2026's LCU introduced two new changes. SVN was bumped to 12.0, so October's update is now the minimum baseline for having the right Monthly Update installed.

DBXUpdate2024.bin no longer contains any SVN's, and Check_DBXUpdate.bin.ps1 should not consider this an "error". The reported message will remain "No DBX signatures found", but it will be noted whenever the DBX file is DBXUpdate2024.bin. This preserves backward compatibility with older Windows releases, which are stuck with the previous versions of this file.

TheVisitor · 2026-10-14T12:43:53-0400

@garlin thanks updated:

PS C:\Windows\System32> powershell -nop -ep bypass -f C:\temp28\check_dbxupdate.bin.ps1 -verbose -audit
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
No DBX signatures found in "DBXUpdate2024.bin" (removed after October 2026)
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

nikki605 · 2026-10-14T12:45:38-0400

@garlin What does "Scheduled Task: "Secure-Boot-Update" is Ready." mean? I don't remember seeing that before. Is there something else I need to do?

The Check script said I had to run these commands on both of my PCs which I did. It was after that, that the Scheduled Task line showed up in the STATUS REPORT.

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

garlin · 2026-10-14T13:10:56-0400

The scheduled task can be in one of four states:

- Ready (not Running)

- Running

- Disabled

- Removed

The first two states indicate you have not disabled or removed the task. Some users are forced to do that to solve an unrelated problem with the Secure Boot task triggering a system lockup (ie. Dell's with a specific model TPM chip).

For them, it's important to confirm the task is properly Disabled or Removed. Most users should have the task as Ready.

starchase · 2026-10-14T13:13:53-0400

Like someone earlier indicated, my system too reads: as below and I can still boot into Hasleo using an old rescue disk. So that does confirm Garlin's recent post stating that the rescue media won't boot if the Firmware SVN is lower than 11.

Code:

FirmwareSVN      : 11.0
BootManagerSVN   : 12.0
StagedSVN        : 12.0
ComplianceStatus : Not compliant (Firmware does not match boot manager)
BootManagerPath  : \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi

nikki605 · 2026-10-14T13:14:59-0400

garlin said:
The scheduled task can be in one of four states:

- Ready (not Running)
- Running
- Disabled
- Removed

The first two states indicate you have not disabled or removed the task. Some users are forced to do that to solve an unrelated problem with the Secure Boot task triggering a system lockup (ie. Dell's with a specific model TPM chip).

For them, it's important to confirm the task is properly Disabled or Removed. Most users should have the task as Ready.

So I don't need to take any action? I just wait and at some point it will take care of itself?

garlin · 2026-10-14T13:22:30-0400

nikki605 said:
So I don't need to take any action? I just wait and at some point it will take care of itself?

You don't read the Status, but review if there are any REQUIRED ACTIONS listed. The status is provided for the paranoid users, who are concerned something may have changed since the last time.

nikki605 · 2026-10-14T13:30:11-0400

garlin said:
You don't read the Status, but review if there are any REQUIRED ACTIONS listed. The status is provided for the paranoid users, who are concerned something may have changed since the last time.

I executed the REQUIRED ACTIONS that I listed in my post, so I'll try not to be paranoid. :wink:

hader · 2026-10-14T14:29:10-0400

@garlin
Thanks for the adaptation.
It's a more clear message now.

SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
No DBX signatures found in "DBXUpdate2024.bin" (removed after October 2026)
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

TheVisitor · 2026-10-14T14:37:26-0400

Found the steps to update USB - now updated

Bootable Media
--------------

USB Drive G: "HASLEOBS"
Boot File [Windows UEFI CA 2023] is ALLOWED.
G:\EFI\Boot\bootx64.efi
File Version: 28000.376, SVN 12.0

boot.wim:1 (WinPE 26100.1)
Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\Windows\Boot\EFI_EX\bootmgfw_EX.efi
File Version: 28000.376, SVN 12.0

\Windows\System32\winload.efi is ALLOWED.
File Version: 26100.1

Marcus Vinicus · 2026-10-14T14:58:38-0400

Updated my Asus Vivobook X1605VA just now.
I'm not going to do the optional SkuSiPolicy on this machine.

LeeElectrode · 2026-10-14T15:20:20-0400

TheVisitor said:
Found the steps to update USB - now updated

Bootable Media
--------------

USB Drive G: "HASLEOBS"
Boot File [Windows UEFI CA 2023] is ALLOWED.
G:\EFI\Boot\bootx64.efi
File Version: 28000.376, SVN 12.0

boot.wim:1 (WinPE 26100.1)
Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\Windows\Boot\EFI_EX\bootmgfw_EX.efi
File Version: 28000.376, SVN 12.0

\Windows\System32\winload.efi is ALLOWED.
File Version: 26100.1

What were the steps?

garlin · 2026-10-14T15:25:06-0400

Code:

Update-UEFI.bat -BootMedia

TheVisitor · 2026-10-14T15:26:36-0400

LeeElectrode said:
What were the steps?

My notes are messy - not sure I want to share for fear of messing someone up - try google for how to update boot.wim1 on USB

gunrunnerjohn · 2026-10-14T15:46:22-0400

itsme1 said:
Your SVN versions 8.0 and 9.0 are outdated, if Windows had updated them automatically, they would be at version 11(and then 12 with the latest KB).

To update them, run the following commands in an Administrator Command Prompt:

Code:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f

Code:

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Restart the computer and wait about 5 minutes before checking.

Edit: Ignore the error associated with the second command.

What error is associated with the second command?

itsme1 · 2026-10-14T16:40:47-0400

gunrunnerjohn said:
What error is associated with the second command?

View attachment 186648

There is an error in an administrator command prompt, but not in an administrator powershell. I don’t know why, but it works in both cases. I don’t remember the exact message.

RFS · 2026-10-14T16:58:55-0400

I have now updated my SVN so all values are 12.0. I've recreated my Macrium Reflect rescue disk as that at first would not boot because it said it was 3.0. I've now also rebuilt my Rufus 26H2 USB but it will now not boot because its SVN is 9.0. And a bootable USB created directly from the MCT won't boot as its SVN is 11.0.

How do I get Rufus (or MCT) create a 12.0 SVN, or do I simply turn off secure boot if the need arises to do a re-install? Not needed at the moment though.

Thanks

anchamp65 · 2026-10-14T17:11:03-0400

RFS said:
And a bootable USB created directly from the MCT won't boot as its SVN is 11.0.

Created just now or before tuesday ?
USB or ISO created with MCT should not be kept for future use, especially if Microsoft just updated SVN...

RFS · 2026-10-14T17:25:34-0400

anchamp65 said:
Created just now or before tuesday ?
USB or ISO created with MCT should not be kept for future use, especially if Microsoft just updated SVN...

Bootable USB from MCT created just now.

garlin · 2026-10-14T17:28:21-0400

MCT is still offering the Sep 2026 ISO. Sometime on Thursday of this week, it will switch to October's ISO. If you're not sure, wait for this Friday before running MCT again.

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Semper paratus

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer

My Computers

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computers

My Computers

My Computer