Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Monika1491 · 2026-10-15T14:45:51-0400

gunrunnerjohn said:
I got this ISO: Windows11_Client_x64_en-us_26300_9457.iso

But my current build is this: 26300.9711

Windows11_Client_x64_en-us_26300_9457.iso is not MCT iso.
I wrote about ESD, and garlin wrote about MCT ISOs created from ESD using MCT.
ISO downloads are not updated as frequently as ESD files.

neldog · 2026-10-15T15:31:08-0400

neldog said:
USB Drive D: "HASLEOBS"
Boot File [Windows UEFI CA 2023] is ALLOWED.

boot.wim:1 (WinRE 26100.1)
Boot Manager [Windows UEFI CA 2023] is BANNED.
winload.efi is BANNED.

Well, this will just not play nice, lol. I have tried every method, and nothing has worked. At this point, I am forced to find new backup software as I am unable to make Hasleo play ball. I think maybe Hasleo (I am using the free version) is trying to use the WinRE partition for source files.

Thanks for all your patience and help. It looks like the fix for my problems will be another software program.

REAGENTC.EXE: Operation Successful.

@garlin

Your Update Boot Media scrip works fine here with Windows Media Creation Tool. So, it's not your scrip or my Secure Boot files. It is some other evil place where my Hasleo USB Recovery Media goes bad.

But I'm good, not going to worry about it any longer - no need to reply, just wanted to let you know.

Code:

EFI Files
---------
    SkuSiPolicy.p7b is CURRENT.

Hasleo 5.9.2.4
--------------
    WinPE Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Bootable Media
--------------

USB Drive E: "26300-9711"
    Boot File [Windows UEFI CA 2023] is ALLOWED.

    boot.wim:2 (WinPE 26100.9711)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        winload.efi is ALLOWED

    boot.stl is CURRENT.

    Please wait while install SWM is analyzed.

    install.swm:1 (W11 26H2 26300.9711)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        winload.efi is ALLOWED

Skipping over the next 6 images.
PS C:\Windows\System32>

garlin · 2026-10-15T15:34:15-0400

There's a way to get Hasleo to pick up the latest WinRE, but I don't use it myself so I can't provide the right answer.

neldog · 2026-10-15T15:46:05-0400

garlin said:
There's a way to get Hasleo to pick up the latest WinRE, but I don't use it myself so I can't provide the right answer.

I am sure there is, but I am not asking you to waste your good time on whatever that maybe — you have done already way more than one should ever ask for. My issue is off the track of what you are doing. My fix will come around later in its own time, I am good for now. If I were not so cheap, I could buy the full version and problem solved.

Thanks for all your help, Garlin.

itsme1 · 2026-10-15T16:05:14-0400

Recreate the Hasleo Backup emergency disk, but do not check the "Download Windows PE components" box. This will use WinRE to create the disk.

I personally create my emergency disk without checking that box. If I verify the resulting emergency disk, whether as a Ventoy ISO or on a USB drive, using Garlin's script, it flags it as "banned," but both versions will boot successfully.

neldog · 2026-10-15T16:22:46-0400

itsme1 said:
Recreate the Hasleo Backup emergency disk, but do not check the "Download Windows PE components" box. This will use WinRE to create the disk.

I personally create my emergency disk without checking that box. If I verify the resulting emergency disk, whether as a Ventoy ISO or on a USB drive, using Garlin's script, it flags it as "banned," but both versions will boot successfully.

Thanks, I have tried that both ways too and it's always banned for me as well. I guess I am just not going to worry about it. One day it will come together. Thank you for your suggestion, everything helps.

itsme1 · 2026-10-15T16:48:30-0400

neldog said:
Thanks, I have tried that both ways too and it's always banned for me as well. I guess I am just not going to worry about it. One day it will come together. Thank you for your suggestion, everything helps.

In an Administrator Command Prompt, run the following command:

Code:

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi "C:\Program Files\Hasleo\Hasleo Backup Suite\bin\WADK\Boot\EFI_EX\bootmgfw.efi"

Recreate the Hasleo Backup rescue disk.
Now, when you check using Garlin's script, it should no longer show as "banned."

TheVisitor is correct, this sets the SVN to 12...
Whenever there is a new SVN, you will need to run the command again and recreate the rescue disk.

Ghot · 2026-10-15T17:04:20-0400

@garlin

Could you translate this command into Macrium v8.1?

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi "C:\Program Files\Hasleo\Hasleo Backup Suite\bin\WADK\Boot\EFI_EX\bootmgfw.efi"

N:\EFI\Boot\bootx64.efi ??

garlin · 2026-10-15T17:06:09-0400

Code:

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi C:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi C:\boot\macrium\WA11KFiles\media\EFI\Boot\bootx64.efi

anchamp65 · 2026-10-15T17:07:09-0400

Ghot said:
@garlin

Could you translate this command into Macrium v8.1?

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi "C:\Program Files\Hasleo\Hasleo Backup Suite\bin\WADK\Boot\EFI_EX\bootmgfw.efi"

For Macrium 8 or 10

Code:

$MacriumStagingFolder = Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\Macrium\RescuePE' -Name 'InstallDir'

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi $MacriumStagingFolder\macrium\WinREFiles\media\EFI\Boot\bootx64.efi
copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi $MacriumStagingFolder\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi

neldog · 2026-10-15T17:08:56-0400

itsme1 said:
In an Administrator Command Prompt, run the following command:

Code:

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi "C:\Program Files\Hasleo\Hasleo Backup Suite\bin\WADK\Boot\EFI_EX\bootmgfw.efi"

Recreate the Hasleo Backup rescue disk.
Now, when you check using Garlin's script, it should no longer show as "banned."

TheVisitor is correct, this sets the SVN to 12...
Whenever there is a new SVN, you will need to run the command again and recreate the rescue disk.

I still get this below.

EFI Files
---------
SkuSiPolicy.p7b is CURRENT.

Hasleo 5.9.2.4
--------------
WinPE Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Bootable Media
--------------

USB Drive D: "HASLEOBS"
Boot File [Windows UEFI CA 2023] is ALLOWED.

boot.wim:1 (WinRE 26100.1)
Boot Manager [Windows UEFI CA 2023] is BANNED.
winload.efi is BANNED.

Ghot · 2026-10-15T17:14:52-0400

garlin said:

Code:

copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi C:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi C:\boot\macrium\WA11KFiles\media\EFI\Boot\bootx64.efi

Thanks. I have the 2nd one.

itsme1 · 2026-10-15T17:17:47-0400

neldog said:
I still get this below.

EFI Files
---------
SkuSiPolicy.p7b is CURRENT.

Hasleo 5.9.2.4
--------------
WinPE Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Bootable Media
--------------

USB Drive D: "HASLEOBS"
Boot File [Windows UEFI CA 2023] is ALLOWED.

boot.wim:1 (WinRE 26100.1)
Boot Manager [Windows UEFI CA 2023] is BANNED.
winload.efi is BANNED.

Wait for TheVisitor. He has the solution, the right command(s) i think.

Edit: Run `bootmedia` with the `-verbose` flag. Your `svn` version shouldn't be 12, mine is 7.

garlin · 2026-10-15T17:19:29-0400

anchamp65 said:
For Macrium 8 or 10

I don't believe the folders change in the two differet versions.

anchamp65 · 2026-10-15T17:20:42-0400

neldog said:
I still get this below.

have you tried:

Code:

copy d:\EFI\MICROSOFT\BOOT\BCD d:\EFI\MICROSOFT\BOOT\BCD.BAK
bcdboot c:\windows /f UEFI /s d: /bootex"
copy d:\EFI\MICROSOFT\BOOT\BCD.BAK d:\EFI\MICROSOFT\BOOT\BCD

Ghot · 2026-10-15T17:23:38-0400

anchamp65 said:
For Macrium 8 or 10

I've used @garlin 's before. It works like a champ.
In fact the old was is still working after the .9711 update.

Like Grandpa used to say: "Dance with the girl that brung ya".

My grandpa didn't really say that. I read it somewhere or saw it in a movie.

fg2001gf11F · 2026-10-15T17:32:54-0400

@garlin,
MCT 26300.9711 was another waste of time.

anchamp65 · 2026-10-15T17:34:20-0400

Ghot said:
I've used @garlin 's before. It works like a champ.
In fact it's still working after the .9711 update.

Like Grandpa used to say: "Dance with the girl that brung ya".

My grandpa didn't really say that. I read it somewhere or saw it in a movie.

it's actually the same commands that Garlin gave a few months back
it just handles custom Macrium staging area folder

Ghot · 2026-10-15T17:37:34-0400

anchamp65 said:
it's actually the same commands that Garlin gave a few months back
it just handles custom Macrium staging area folder

Too complex for me. I don't understand those hieroglyphics.
@garlin has been on top of this certification cr*p since day one. ^^

I handled the Revocations back in 2023. That killed the few remaining certification brain cells I had.

If you're into ancient history, you can read about it here...

This was back before we "knew" Microsoft was evil. ^^

KB5028254 breaks the Macrium bootable media.

I'm still on Macrium Reflect 8.0.6635, and today's Cumulative Update broke my bootable rescue media. I can create a Macrium Boot Menu entry that works, which IMO is useless. If the boot record ever gets corrupt, I won't be able to access my backups. I have NOT done the "revocations". I created...

www.elevenforum.com

Time to run some errands. ^^

TheVisitor · 2026-10-15T19:05:03-0400

@neldog Please run the check_bootmedia.ps1 -verbose this will reveal the SVN numbers that way we can quit guessing what's missing.

I don't have an easy fix. Something I got from AI help about creating a scratch folder, copying some files for windows boot .
eventually after a few more steps it copies the windows efi file into Hasleo but don't have it all in my head. My notes from the AI are messy. I
am hesitant to share because the steps are out of sequence. I need to sit down and re-write/edit the whole thing.

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Member

My Computer My Computer

At a glance

Rancho Seldom Siesta

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Rancho Seldom Siesta

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Rancho Seldom Siesta

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Rancho Seldom Siesta

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computers

My Computer

My Computer

My Computers

My Computers

My Computer

My Computers

My Computers

My Computer