Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

bikemanAMD · 2026-10-16T15:52:27-0400

garlin said:
Users should stop using WinPE as their source for boot.wim. WinPE requires someone (ie. Macrium) to constantly post updated images and there can be a delay after any Monthly Update that introduces a new boot manager or winload.efi. WinRE as the source image is the way to go.

To disable SkuSiPolicy enforcement:
1. Disable Secure Boot.

2. Run these commands as Admin:

Code:

mountvol S: /s del S:\EFI\Microsoft\Boot\SkuSiPolicy.p7b

3. Enable Secure Boot.

Ok will take care of that asap here--as Admin in Powershell or Command Prompt.

Thank you so much for all the help you provide on this Secure Boot CA 2023 procedures

bikemanAMD · 2026-10-16T15:52:57-0400

itsme1 said:
1.72 GB is more than enough.
What does reagentc /info show?

Code:

PS C:\> reagentc /info
Windows Recovery Environment (Windows RE) and system reset configuration
Information:

    Windows RE status:         Enabled
    Windows RE location:       \\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE
    Boot Configuration Data (BCD) identifier: 927990ba-a49b-11f0-9266-f5d12741e5c5
    Recovery image location:
    Recovery image index:      0
    Custom image location:
    Custom image index:        0
    Windows RE Version:        10.0.26100.9711

REAGENTC.EXE: Operation Successful.

garlin · 2026-10-16T16:06:29-0400

fernando BARBA said:
i have my "old" 2016 ASUS PC updated with the 2023 Secure Boot certs --thanks to garlin´s scripts -- except for the revocation of the Microsoft Windows Production PCA 2011 one
-what should i expect when and IF Microsoft make the process in my particular PC on the next Monday 19th? i´m asking because of the parameters found in the REGISTER EDITOR, specially about "Confidence Level: Under Observation - More Data Needed" among others --- see below, please

1. ConfidenceLevel should be generally ignored. It's an internal-use setting written so the Secure Boot task knows whether it should try update a specific PC model or not. It's not based on any live system data, but generated by MS by analyzing telemetry data.

Every month, the BucketConfidenceData.cab is released in the Monthly Update. The task matches your HW signature against a list, and changes the reported ConfidenceLevel. If you have already updated your PC, this setting has no meaning. It will always be negative for an unsupported PC.

2. When PCA 2011 cert expires on Oct 19, 2026, nothing changes. An expired signing cert doesn't mean Windows or Secure Boot stops working. It means MS can no longer use the PCA 2011 cert to sign a newer version of the Windows boot file. Any older version of the boot file which was signed by PCA 2011 is still valid (because it was signed before the deadline), unless you revoked the cert as untrusted.

3. You have not revoked PCA 2011. It's still optional (for now).

No action is required. Unless you want to revoke PCA 2011 now by following the script's instructions.

garlin · 2026-10-16T16:09:12-0400

bikemanAMD said:

Code:

PS C:\> reagentc /info
Windows Recovery Environment (Windows RE) and system reset configuration
Information:

    Windows RE status:         Enabled
    Windows RE location:       \\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE
    Boot Configuration Data (BCD) identifier: 927990ba-a49b-11f0-9266-f5d12741e5c5
    Recovery image location:
    Recovery image index:      0
    Custom image location:
    Custom image index:        0
    Windows RE Version:        10.0.26100.9711

This won't report WinRE's consumed size.

Replace the partition # with whatever was reported by "Windows RE location"

Code:

> reagentc /info
Windows Recovery Environment (Windows RE) and system reset configuration
Information:

    Windows RE status:         Enabled
    Windows RE location:       \\?\GLOBALROOT\device\harddisk0\partition5\Recovery\WindowsRE
    Boot Configuration Data (BCD) identifier: b5ceec5e-c28e-11f1-8563-000c2907b188
    Recovery image location:
    Recovery image index:      0
    Custom image location:
    Custom image index:        0
    Windows RE Version:        10.0.26100.9444

REAGENTC.EXE: Operation Successful.

> Get-Item -LiteralPath '\\?\GLOBALROOT\device\harddisk0\partition5\Recovery\WindowsRE\winre.wim' -Force

    Directory: \\?\GLOBALROOT\device\harddisk0\partition5\Recovery\WindowsRE

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
---hs           9/14/2026  9:59 PM      792235512 winre.wim

bikemanAMD · 2026-10-16T16:21:08-0400

garlin said:

This won't report WinRE's consumed size.

Replace the partition # with whatever was reported by "Windows RE location"

Code:

> reagentc /info
Windows Recovery Environment (Windows RE) and system reset configuration
Information:

    Windows RE status:         Enabled
    Windows RE location:       \\?\GLOBALROOT\device\harddisk0\partition5\Recovery\WindowsRE
    Boot Configuration Data (BCD) identifier: b5ceec5e-c28e-11f1-8563-000c2907b188
    Recovery image location:
    Recovery image index:      0
    Custom image location:
    Custom image index:        0
    Windows RE Version:        10.0.26100.9444

REAGENTC.EXE: Operation Successful.

> Get-Item -LiteralPath '\\?\GLOBALROOT\device\harddisk0\partition5\Recovery\WindowsRE\winre.wim' -Force

    Directory: \\?\GLOBALROOT\device\harddisk0\partition5\Recovery\WindowsRE

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
---hs           9/14/2026  9:59 PM      792235512 winre.wim

PS C:\> Get-Item -LiteralPath '\\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE\winre.wim' -Force

Directory: \\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE

Mode LastWriteTime Length Name
---- ------------- ------ ----
-a-hs- 10/13/2026 1:16 PM 823387447 winre.wim

There is the results of that command

garlin · 2026-10-16T16:46:34-0400

Or 767 MB in size. If you follow the MS rule of 220 MB of headroom, somewhere around 1-1.2 GB for Recovery partition is needed for future growth.

When I see users suggest 1.7 to 2 GB, that’s wasteful on disk space.

bikemanAMD · 2026-10-16T16:49:05-0400

garlin said:
Or 767 MB in size. If you follow the MS rule of 220 MB of headroom, somewhere around 1-1.2 GB for Recovery partition is needed for future growth.

When I see users suggest 1.7 to 2 GB, that’s wasteful on disk space.

Ohh so i resized it way too large in the past oops.

PC 2 Gaming Laptop-i did a clean Windows 11 Pro install not too long ago as i severely messed up resizing that one on my own, and now it should be proper sized on that machine.

hsehestedt · 2026-10-16T17:22:56-0400

garlin said:
Or 767 MB in size. If you follow the MS rule of 220 MB of headroom, somewhere around 1-1.2 GB for Recovery partition is needed for future growth.

When I see users suggest 1.7 to 2 GB, that’s wasteful on disk space.

I used to size my Recovery partition at 2GB to guarantee that I had enough space and because I always have plenty of free space so that little bit of extra space does not bother me at all. But my thinking on that has changed. Since that partition can now be resized at will, I simp[ly allow Windows setup to create it at whatever size it wants knowing that it can always be resized later.

fg2001gf11F · 2026-10-16T19:06:07-0400

@garlin?

Any idea on this?
Why is Microsoft updating SkuSiPolicy.p7b to version 3.0.0.19 that doesn't even allow any of their official Installation media to boot including MCT 26300.9711?

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computers

My Computers

My Computer

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer