Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

fg2001gf11F · 2026-10-17T01:38:22-0400

garlin said:
Are you using “Recommended settings for my system”?

@garlin,
I think Microsoft must have changed something yesterday, I can now boot using the official MCT installation media 26300.9711.
I no longer get the banned messages either. Any Idea on what they fixed?

fg2001gf11F · 2026-10-17T01:43:02-0400

Scott said:
I do have it. I updated it on patch Tuesday with the -SkuSiPolicy switch.
View attachment 186973

Using the one-time boot menu bypasses the running system's EFI partition.

View attachment 186975

@Scott,
I think Microsoft is playing games, they must have changed something yesterday, because now it works with the Official MCT media 26300.9711.

See my last post 4,121 above.

fg2001gf11F · 2026-10-17T02:39:59-0400

This is one made from UUP-dump, I'll try booting and see if it works.

Edit:
That booted fine without any change.
Go figure what Microsoft fixed without any notice.

hader · 2026-10-17T05:20:32-0400

garlin said:
If the script isn't detecting your USB drive, add the drive's letter on the command line.

Run either one of these commands:

Code:

.\Check_BootMedia.ps1 E: .\Check-BootMedia.bat E:

OK. I just did that, But it showed also; (Find it curious that the script detects does not detect the USB stick while at others it did)

Code:

Image Files
-----------

USB Drive G: "HASLEOBS"
    Boot File [Windows UEFI CA 2023] is ALLOWED.

    boot.wim:1 (WinPE 26100.1)
        Boot Manager [Windows UEFI CA 2023] is BANNED.
        winload.efi is ALLOWED

Someone suggested that the versions are not equal. I noticed that earlier on (version was 11.0) re-wrote the Emerency-disk with the latest WinPE-image from Microsoft and I got:

Code:

Get-SecureBootSVN -BootManagerPath "G:\EFI\Boot\bootx64.efi"

FirmwareSVN      : 12.0
BootManagerSVN   : 12.0
StagedSVN        : 12.0
ComplianceStatus : Compliant (Boot Manager SVN meets staged SVN)
BootManagerPath  : G:\EFI\Boot\bootx64.efi

So that it would say not allowed because there is a version mismatch isn't true!

@garlin
I am sill sitting with the fact that Windows deemed the .efi files on the boot partition as not compliant because it is located on a FAT32 disk. MS already knows this and should take measures to give the correct result.

Found another thing strange
I got this result by using this command:

Code:

Get-SecureBootSVN

FirmwareSVN      : 12.0
BootManagerSVN   : 12.0
StagedSVN        : 12.0
ComplianceStatus : Compliant (Boot Manager SVN meets staged SVN)
BootManagerPath  : \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi

And if I specify that path:

Code:

Get-SecureBootSVN -BootManagerPath "C:\EFI\Microsoft\Boot\bootmgfw.efi"

FirmwareSVN      : 12.0
BootManagerSVN   : 0.0
StagedSVN        : 12.0
ComplianceStatus : Not compliant
BootManagerPath  : C:\EFI\Microsoft\Boot\bootmgfw.efi

I would rather expect that it gave me an error because there is no EFI on the C-drive. Is seems to look but comes up with a BootManagerSVN of v0.0?...
So what is happening here?

Celery · 2026-10-17T05:46:56-0400

@hader

Code:

PS C:\Users\admin> Get-SecureBootSVN -BootManagerPath "C:\this_folder_does_not_exist\bootmgfw.efi"

FirmwareSVN      : 0.0
BootManagerSVN   : 0.0
StagedSVN        : 12.0
ComplianceStatus : Not compliant (Staged SVN does not match firmware SVN)
BootManagerPath  : C:\this_folder_does_not_exist\bootmgfw.efi

hader · 2026-10-17T05:48:03-0400

fg2001gf11F said:
@garlin,
I think Microsoft must have changed something yesterday, I can now boot using the official MCT installation media 26300.9711.
I no longer get the banned messages either. Any Idea on what they fixed?

Good point!!! Could point to some silent changes...
I am attempt to do also an In-Place-Installment. I also will make a new VM with the official 26H2 Windows 11 release.
Maybe the transition from 25H2 to 26H2 did not went so smooth as Microsoft thought it did......

I am noticing also strange things that I can not explain.

hader · 2026-10-17T05:53:37-0400

Celery said:

@hader

Code:

PS C:\Users\admin> Get-SecureBootSVN -BootManagerPath "C:\this_folder_does_not_exist\bootmgfw.efi"

FirmwareSVN      : 0.0
BootManagerSVN   : 0.0
StagedSVN        : 12.0
ComplianceStatus : Not compliant (Staged SVN does not match firmware SVN)
BootManagerPath  : C:\this_folder_does_not_exist\bootmgfw.efi

That is not the same!! If you run this command with the correct existing location; The FirmwareSVN version number is also 12.0..... So...

StagedSVN is the value it want to see at FirmwareSVN and BootManagerSVN also. If yes: Compliant, if not: Not Compliant.

gunrunnerjohn · 2026-10-17T10:40:56-0400

fg2001gf11F said:
I don't use Rufus. I want the official Microsoft stuff to work properly. They can never get it right.

Since Microsoft can't get it right, I choose to use the tools that will get it right.

bikemanAMD · 2026-10-17T11:31:03-0400

I myself use Rufus for my Windows Install USB Creation, and Macrium Reflect X for my Rescue Media from the backup software creation. Came to conclusion if doesn't wanna work now, i'm ok with waiting til it does work properly to create the USB Sticks.

As both my Desktop and Gaming Laptop OS install is in good condition i do believe, not an emergency to have both usb sticks working properly at the moment, i spent most of yesterday afternoon on the Desktop trying to get it at least the Macrium Reflect X Rescue USB to say all allowed when i ran the check bootmedia script, then finally i just gave up around 10PM last night lol.

fg2001gf11F · 2026-10-17T13:44:14-0400

Tried another new Build from UUP-dump and that seems to confirm the rules, for the ranges that are not blocked.
26340.9750 which is based on 26100.9750 boots just fine on this machine.
.9750 is above the .9680 which is the limit for the ones blocked by this 3.0.0.19 policy.

Edit:
All of the current official insider ISO Builds are in the blocked ranges.
The MCT .9711 is the 1st official Microsoft Build that is allowed with policy 3.0.0.19.

garlin · 2026-10-17T15:22:33-0400

The key point is SkuSkiPolicy.p7b is not the same file across all release channels!

Other versions may also report as version 3.0.0.19, but their File Rules can be different. If you're constantly hopping around Insider builds, it's probably best not to use SkuSiPolicy since the allowed winload.efi versions are more likely to conflict at some point.

fg2001gf11F · 2026-10-17T15:41:29-0400

garlin said:
The key point is SkuSkiPolicy.p7b is not the same file across all release channels!

Other versions may also report as version 3.0.0.19, but their File Rules can be different. If you're constantly hopping around Insider builds, it's probably best not to use SkuSiPolicy since the allowed winload.efi versions are more likely to conflict at some point.

I don't use SkuSiPolicy on the multiboot machines.
I think 26220.9739 being higher than .9680 from UUP-dump will work too with SkuSiPlicy.p7b (3.0.0.19),
I'm downloading and building it now to verify.
It is quite a slow process downloading and building from UUP-dump. The slowest I have seen in a long time.

But I want to test if it will boot on the machine that has the policy 3.0.0.19.

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computer

My Computer

My Computer