Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

bikemanAMD · 2026-10-15T20:09:04-0400

Hopefully Someday Macrium Reflect X has an update out that actually fixes Rescue Media Creation and wouldn't need to enter commands after each SVN is updated.

But i'll work on mine again possibly tomorrow, and i will get it sorted fully somehow lol tomorrow for both Desktop PC and Gaming Laptop

And then after that get the Windows USB Stick updated hopefully right after i get the Macrium one working properly hopefully early tomorrow

neldog · 2026-10-16T08:19:54-0400

TheVisitor said:
@neldog Please run the check_bootmedia.ps1 -verbose this will reveal the SVN numbers that way we can quit guessing what's missing.

I don't have an easy fix. Something I got from AI help about creating a scratch folder, copying some files for windows boot .
eventually after a few more steps it copies the windows efi file into Hasleo but don't have it all in my head. My notes from the AI are messy. I
am hesitant to share because the steps are out of sequence. I need to sit down and re-write/edit the whole thing.

Here it is, (check_bootmedia.ps1 -verbose) At this point I have given up on Hasleo, it shouldn't be this difficult. I am okay moving to another program. At some point, one needs to know when to give up trying to make software work. This, (Hasleo) should work without any user modifications needed.

Thank you and everyone else for all the help.

hader · 2026-10-16T08:21:29-0400

Found something strange that I could not explain.

After running Check-BootMedia.bat and having an HASLEOBS Emergency USB drive (Made with Hasleo Backup Suite v5.9.2.4, the latest. Made with 26300.9550) in my PC it did not see that USB stick that is bootable and contains only 1 bootable partition. I saw other users here that could see this HASLEOBS Emergency disk

I saw this part of the result:

Powershell:

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 12.0

EFI Files
---------
    [OPTIONAL] SkuSiPolicy.p7b (for VBS) is MISSING.

Bootable Media
--------------

PS C:\WINDOWS\system32>

So I was searching for a way to interrogate the Boot file and found; there is; (PS as Admin) Get-SecureBootSVN -BootManagerPath "G:\EFI\Boot\bootx64.efi"
I then got the following result:

Code:

FirmwareSVN      : 12.0
BootManagerSVN   : 11.0
StagedSVN        : 12.0
ComplianceStatus : Not compliant
BootManagerPath  : G:\EFI\Boot\bootx64.efi

That "Not compliant" status got me worried. So I made a new Emergency disk but this time I downloaded the WinPE-image from Microsoft. After inspecting it again I got;

Code:

FirmwareSVN      : 12.0
BootManagerSVN   : 12.0
StagedSVN        : 12.0
ComplianceStatus : Compliant (Boot Manager SVN meets staged SVN)
BootManagerPath  : G:\EFI\Boot\bootx64.efi

OK that is fixed I guess....

I also inspected the boot partition of my C-drive and it gave me the following result;

Code:

Get-SecureBootSVN -BootManagerPath "C:\EFI\Boot\bootx64.efi"

FirmwareSVN      : 12.0
BootManagerSVN   : 0.0
StagedSVN        : 12.0
ComplianceStatus : Not compliant
BootManagerPath  : C:\EFI\Boot\bootx64.efi

It seems this command is using some kind of link to the Boot partition that is not accessible because there is no EFI directory on the C-drive.
I made that partition visible temporary inside explorer using diskpart (again not accessible by explorer but by CMD as Admin) and tried it again: The same result: Not compliant. Strange.....
I investigate the versions of the 2 files inside C:\EFI\Microsoft\Boot directory; bootmgfw.efi and bootmgr.efi. The same: Non compliant.

Found one thing curious; their file sizes.
C:\EFI\Boot\bootx64.efi is 966.644 Bytes. (d.d. 9 Sept.2026) C:\EFI\Microsoft\Boot\bootmgfw.efi is 3.086.680 Bytes. (d.d. 15 Oct.2026, updated yesterday by 26300.9711)
The file G:\EFI\Boot\ bootx64.efi is also 3.086.680 Bytes in size. (d.d. is the date the Emergency disk is created)

I think that that bootx64.efi on the C-drive is just a bootstrap file that calls bootmgfw.efi in reality. Same sizes.
If this is the case why are all the .efi files on the boot partition of the C-drive all Not compliant?

Does anyone have any clue and explain why this is the case. At least you would expect that that Get-SecureBootSVN command showed: "Compliant (Boot Manager SVN meets staged SVN)" but it doesn't......

Celery · 2026-10-16T10:40:53-0400

hader said:
I think that that bootx64.efi on the C-drive is just a bootstrap file that calls bootmgfw.efi in reality. Same sizes.
If this is the case why are all the .efi files on the boot partition of the C-drive all Not compliant?

The UEFI firmware loads EFI executables (.efi) directly from the FAT32-formatted EFI system partition, not from the Windows partition (C:).

How Windows boots on a UEFI system:

\EFI\Microsoft\Boot\bootmgfw.efi is normally launched via a firmware "Windows Boot Manager" boot entry stored in NVRAM.
\EFI\Boot\bootx64.efi is the default/fallback boot path defined by the UEFI specification for x64 systems. It is commonly used for booting removable media and as a fallback when normal firmware boot entries are unavailable.

If you want to check the Secure Boot SVN of your installed Windows Boot Manager, simply run Get-SecureBootSVN without specifying a path. This normally checks the boot manager on the actual EFI system partition.

Code:

Get-SecureBootSVN

FirmwareSVN      : 0.0
BootManagerSVN   : 12.0
StagedSVN        : 12.0
ComplianceStatus : Not compliant (Staged SVN does not match firmware SVN)
BootManagerPath  : \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi

SaliesBuzz · 2026-10-16T11:23:34-0400

As I have posted before, I use the Terabyte Unlimited tools to manage partition backups on a monthly cycle. This is after the Tuesday Microsoft Update day.
As we store no data on any, (we have 5), computer on our LAN, (we have NAS Servers to manage that, which backup every day), this is sufficient for us.
As part of that monthly backup regime I use the TBWinRe tool to create a bootable USB drive containing the latest Wim.
When checked with Check_BootMedia.ps1 this reports:

Bootable Media
--------------

USB Drive D: "TBWINRE"
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
D:\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.376, SVN 12.0

boot.wim:1 (WinRE 26100.9711)
Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\Windows\Boot\EFI_EX\bootmgfw_EX.efi
File Version: 28000.376, SVN 12.0

\Windows\System32\winload.efi is ALLOWED.
File Version: 26100.9711

My idea is, that if something goes seriously amiss, I can use the bootable media to boot the system and then restore any partition or all from the compressed archive written by Terabyte's Image for Windows.
I have used this company's products for over 20 years and they have been life savers through disk crashes, major Microsoft cock-ups and user errors etc.

They are not free utilities but are worth every penny in my opinion.

Home

Software to backup your computer, copy hard drives, boot multiple operating systems, manage the clipboard, capture the screen and more.

www.terabyteunlimited.com

anchamp65 · 2026-10-16T11:47:17-0400

SaliesBuzz said:
I have used this company's products for over 20 years and they have been life savers through disk crashes, major Microsoft cock-ups and user errors etc.

They are not free utilities but are worth every penny in my opinion.

And home users get 5 installations per purchased licence...

Terabyte Image for Windows
$49.98 US per licence

itsme1 · 2026-10-16T12:02:52-0400

I’m having an issue with Hasleo bootable USB media, Garlin’s script doesn’t detect them. I’ve tried 3 different USB drives, using 2 front-panel ports, one rear USB 3.0 port, and one rear USB 2.0 port.

However, when I mounted the Hasleo rescue disk ISO, the script detected it. The output confirms everything is fine:
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

boot.wim:1 (WinRE 26100.9711)
Boot Manager [Windows UEFI CA 2023] is ALLOWED.

\Windows\System32\winload.efi is ALLOWED

I’m not sure why the USB drives aren’t being detected. It’s possible that some of the BIOS settings I enabled, which provide protection at the USB port level, are the cause. I’ll look into it later.

Edit: I also tried using earlier versions of the script.

garlin · 2026-10-16T12:10:27-0400

If the script isn't detecting your USB drive, add the drive's letter on the command line.

Run either one of these commands:

Code:

.\Check_BootMedia.ps1 E:

.\Check-BootMedia.bat E:

itsme1 · 2026-10-16T13:05:42-0400

Thanks, that worked using the USB media letter.
The output is correct, everything is ALLOWED.

bikemanAMD · 2026-10-16T15:10:20-0400

Well 3rd Attempt to update Macrium Reflect X Boot Media with Win RE option selected in Macrium Reflect X

Code:

PS D:\Scripts\Tools> .\Check_BootMedia.ps1 G:

Security warning
Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your
computer. If you trust this script, use the Unblock-File cmdlet to allow the script to run without this warning
message. Do you want to run D:\Scripts\Tools\Check_BootMedia.ps1?
[D] Do not run  [R] Run once  [S] Suspend  [?] Help (default is "D"): R
Secure Boot: ON
Virtualization Based Security: ON

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 12.0

EFI Files
---------
    SkuSiPolicy.p7b is CURRENT.

Image Files
-----------

USB Drive G: "MACRIUM_PE"
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

    boot.wim:1 (WinRE 26100.9545)
        Boot Manager [Windows UEFI CA 2023] is BANNED.
        winload.efi is BANNED.

What heck am i doing wrong this time? CA 2023 shouldn't be banned as far as i know, yet still isn't properly working right as yet lol.

TheVisitor · 2026-10-16T15:12:09-0400

@bikemanAMD run that with the -verbose method will likely show a SVN is not current

bikemanAMD · 2026-10-16T15:13:56-0400

TheVisitor said:
@bikemanAMD run that with the -verbose method will likely show a SVN is not current

Results after -verbose method

Code:

PS D:\Scripts\Tools> .\Check_BootMedia.ps1 G: -verbose

Security warning
Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your
computer. If you trust this script, use the Unblock-File cmdlet to allow the script to run without this warning
message. Do you want to run D:\Scripts\Tools\Check_BootMedia.ps1?
[D] Do not run  [R] Run once  [S] Suspend  [?] Help (default is "D"): R
Windows 11 26H2 (26300.9711)
Secure Boot: ON
Virtualization Based Security: ON

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 12.0

EFI Files
---------
    SkuSiPolicy.p7b is CURRENT.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
        Version: 3.0.0.19

        FileRule             MinimumFileVersion MaximumFileVersion
        --------             ------------------ ------------------
        ID_FILEATTRIB_F_0044 0.0.0.0            10.0.14393.9579
        ID_FILEATTRIB_F_0042 10.0.14400.0       10.0.17763.9339
        ID_FILEATTRIB_F_0040 10.0.18000.0       10.0.19041.7759
        ID_FILEATTRIB_F_0041 10.0.19100.0       10.0.20348.5719
        ID_FILEATTRIB_F_0046 10.0.20400.0       10.0.22621.7619
        ID_FILEATTRIB_F_0049 10.0.23000.0       10.0.26100.9680
        ID_FILEATTRIB_F_0045 10.0.26100.32000   10.0.26100.33589
        ID_FILEATTRIB_F_0048 10.0.26172.0       10.0.26172.33590
        ID_FILEATTRIB_F_0047 10.0.27000.0       10.0.28000.3200
        ID_FILEATTRIB_F_0043 10.0.29426.0       65535.65535.65535.65535



Image Files
-----------

USB Drive G: "MACRIUM_PE"
    Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
        G:\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.376, SVN 12.0

    boot.wim:1 (WinRE 26100.9545)
        Boot Manager [Windows UEFI CA 2023] is BANNED.
            \Windows\Boot\EFI_EX\bootmgfw_EX.efi
            File Version: 28000.367, SVN 11.0

        \Windows\System32\winload.efi is BANNED.
            File Version: 26100.9545

TheVisitor · 2026-10-16T15:17:22-0400

@bikemanAMD Yes that shows your bootmgfw_ex.efi is only at svn 11, needs updated to 12 not sure what to do with winload.efi

bikemanAMD · 2026-10-16T15:19:14-0400

@TheVisitor Yeah i don't know either, it worked last month when i updated the SVN and updated the Rescue disk, not sure whats happening this month at all.

But i guess at some point i'll get it all figured out someway

I do get this everytime i run the Update_UEFi-CA2023.ps1 -Bootmedia script, the first time it said it updated the Flash drive successfully supposely

But always asks for a Reboot each time i run it

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

SUCCESS: NO UPDATES ARE REQUIRED.

Restart Windows, for pending updates to take effect.

((but what pending update))

itsme1 · 2026-10-16T15:38:06-0400

bikemanAMD said:
@TheVisitor Yeah i don't know either, it worked last month when i updated the SVN and updated the Rescue disk, not sure whats happening this month at all.

But i guess at some point i'll get it all figured out someway

I do get this everytime i run the Update_UEFi-CA2023.ps1 -Bootmedia script, the first time it said it updated the Flash drive successfully supposely

But always asks for a Reboot each time i run it

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

SUCCESS: NO UPDATES ARE REQUIRED.

Restart Windows, for pending updates to take effect.

((but what pending update))

Run reagentc /info in a Command Prompt or PowerShell window.

The version should be: Windows RE Version: 10.0.26100.9711

If the version is lower, your recovery partition has not updated automatically. This is due to a lack of space, and the fact that Microsoft does not automatically resize the partition or create a new one.

garlin · 2026-10-16T15:38:10-0400

TheVisitor said:
@bikemanAMD Yes that shows your bootmgfw_ex.efi is only at svn 11, needs updated to 12 not sure what to do with winload.efi

When winload.efi doesn't pass, you have to two options:

1. Stop using SkuSiPolicy.p7b (any winload.efi will beeligible for booting).
2. Replace boot.wim with a later version of WinRE (rebuild the Macrium or Hasleo USB using the current WinRE as the image source).

bikemanAMD · 2026-10-16T15:45:34-0400

Well i tried to expand my WinRE Partition in the past, didn't work so well. But i can try again if need be on that part

Should i switch to Windows PE version of Macrium Rescue Media? not sure how i'd stop using SkuSiPolicy at all, as always used it thus far, til now having issues

Desktop WinRe Parition size right now is 1.72GB (Healthy Recovery Partition it says in Disk Management area)

fernando BARBA · 2026-10-16T15:49:58-0400

hello,
i have my "old" 2016 ASUS PC updated with the 2023 Secure Boot certs --thanks to garlin´s scripts

-- except for the revocation of the Microsoft Windows Production PCA 2011 one
-what should i expect when and IF Microsoft make the process in my particular PC on the next Monday 19th? i´m asking because of the parameters found in the REGISTER EDITOR, specially about "Confidence Level: Under Observation - More Data Needed" among others --- see below, please
thanks in advance,
fernando barba
****************************************************

PS C:\windows\system32> C:\Users\fbm\Desktop\Check_UEFI-CA2023.ps1 -Verbose -Audit
W10 IoT ENT LTSC 2021 (19044.7807)
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
ASUSTeK COMPUTER INC. M32CD_A_F_K20CD_K31CD
Version: 1102
Date: 2018-04-12

Factory Default UEFI PK Cert
----------------------------
ASUSTeK MotherBoard PK Certificate

UEFI PK Cert
------------
Windows OEM Devices PK

Factory Default UEFI KEK Certs
------------------------------
Microsoft Corporation KEK CA 2011
Canonical Ltd. Master Certificate Authority
ASUSTeK MotherBoard KEK Certificate

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Canonical Ltd. Master Certificate Authority
ASUSTeK MotherBoard SW Key Certificate
ASUSTeK Notebook SW Key Certificate

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
(NONE)
EFI_CERT_SHA256_GUID Signatures: 77

UEFI DBX Certs
--------------
(NONE)
Windows BootMgr SVN is MISSING.
EFI_CERT_SHA256_GUID Signatures: 445

UEFI Variables
--------------
SBAT (Linux only): sbat,1,2024010900 / shim,4 / grub,3 / grub.debian,4

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\\.\HarddiskVolume6\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.376, SVN 12.0

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

[OPTIONAL] SkuSiPolicy.p7b (for VBS) is MISSING.

AUDIT REPORT
============
1. [Production PCA 2011] is missing from UEFI DBX
2. Windows BootMgr SVN is missing from UEFI DBX

[OPTIONAL] SkuSiPolicy.p7b (for VBS) is missing from EFI

STATUS REPORT
-------------
Registry: "UEFICA2023Status" = Updated

REQUIRED ACTION
===============

To REVOKE the [PCA 2011] cert, run the commands:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x280 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
*************************************************************************************************************************************************

garlin · 2026-10-16T15:49:58-0400

bikemanAMD said:
Should i switch to Windows PE version of Macrium Rescue Media? not sure how i'd stop using SkuSiPolicy at all, as always used it thus far, til now having issues

Users should stop using WinPE as their source for boot.wim. WinPE requires someone (ie. Macrium) to constantly post updated images and there can be a delay after any Monthly Update that introduces a new boot manager or winload.efi. WinRE as the source image is the way to go.

To disable SkuSiPolicy enforcement:
1. Disable Secure Boot.

2. Run these commands as Admin:

Code:

mountvol S: /s
del S:\EFI\Microsoft\Boot\SkuSiPolicy.p7b

3. Enable Secure Boot.

itsme1 · 2026-10-16T15:51:28-0400

1.72 GB is more than enough.
What does reagentc /info show?

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computers My Computers

At a glance

At a glance

Rancho Seldom Siesta

Attachments

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

@bikemanAMD run that with the -verbose method will likely show a SVN is not current​

My Computer My Computer

At a glance

Well-known member

@bikemanAMD run that with the -verbose method will likely show a SVN is not current​

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computers

My Computers

My Computers

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

@bikemanAMD run that with the -verbose method will likely show a SVN is not current

My Computer

@bikemanAMD run that with the -verbose method will likely show a SVN is not current

My Computers

My Computer

My Computers

My Computer

My Computer

My Computers

My Computers

My Computer

My Computer