How to check if your Secure Boot certs are updated. (three methods)

Ghot · Jan 4, 2026

Scott said:
I used cjee21's command line version.

So did I.
I added it to post #3 of this topic.

The I changed the topic title to... xxxxxxxxxxxx (three methods).

fg2001gf11F · Jan 7, 2026

Ghot said:
So did I.

This file does not show "Banned" but if I use an older one like yours, I get the "Banned' message.

Ghot · Jan 7, 2026

I understand what you're saying, but this is what I get when running the script in post #1...

On a side note... I think Method Three, in this topic is the way to go.

See this post...

Secure boot update HowTo

See so all looked ok, but would I need to do this after every windows 11 clean install? :-) After mid 2026, you'll never need to "do all this". More importantly, you shouldn't have to "do clean installs", you should use 3rd party backup software...

www.elevenforum.com

I'd be curious to see the results you get when running this command from cjee21... (Method Three, in this topic).

Check UEFI PK, KEK, DB and DBX.cmd

fg2001gf11F · Jan 7, 2026

Ghot said:
I understand what you're saying, but this is what I get when running the script in post #1...

View attachment 159211

On a side note... I think Method Three, in this topic is the way to go.

See this post...

Secure boot update HowTo

See so all looked ok, but would I need to do this after every windows 11 clean install? :-) After mid 2026, you'll never need to "do all this". More importantly, you shouldn't have to "do clean installs", you should use 3rd party backup software...

www.elevenforum.com

I'd be curious to see the results you get when running this command from cjee21... (Method Three, in this topic).

Check UEFI PK, KEK, DB and DBX.cmd

That from post 1 is the one that gets the "Banned" message.

Here is the output of Check UEFI PK, KEK, DB and DBX.cmd

Ghot · Jan 7, 2026

fg2001gf11F said:
Here is the output of Check UEFI PK, KEK, DB and DBX.cmd

Try this one, then redo the Check you just did...

Apply 2023 KEK, DB and bootmgfw update.cmd
Run it from within the folder, same as you ran the Check one.

I noticed in the "Secure boot update HowTo" topic, that the folks that used cjee21's stuff had fewer problems.
Unfortunately, I did things the hard way, so I can't really test cjee21's other commands.

fg2001gf11F · Jan 7, 2026

Ghot said:
Try this one, then redo the Check you just did...

Apply 2023 KEK, DB and bootmgfw update.cmd
Run it from within the folder, same as you ran the Check one.

Same as before.

Ghot · Jan 7, 2026

fg2001gf11F said:
Same as before.

Did you run the "Apply" command first?

If so... cjee21 mentioned in his README, that it can sometimes take MS's update servers up to 12 hours to do their thing.

fg2001gf11F · Jan 7, 2026

Ghot said:
Did you run the "Apply" command first?

If so... cjee21 mentioned in his README, that it can sometimes take MS's update servers up to 12 hours to do their thing.

Yes, I did.

Ghot · Jan 7, 2026

fg2001gf11F said:
Yes, I did.

I dunno. We'll have to wait for @garlin to compare the two scripts.
All I know is that the old one works for me.

All three methods in this topic, work for me.

The only obvious difference I see is that you're on a DELL, and I'm on a home built PC, with the very latest BIOS.
My mobo's BIOS is from Oct 27th 2025, and I used it to flash the BIOS on Nov 29th, 2025.

The BIOS version, could be part of the issue, as this is an update to Secure Boot.
Or... it could be the possible 12 hour wait that cjee21 mentioned.

We'll have to see what garlin says. If needed, I can always update Method One, in this topic.

fg2001gf11F · Jan 7, 2026

Ghot said:
I dunno. We'll have to wait for @garlin to compare the two scripts.
All I know is that the old one works for me.

All three methods in this topic, work for me.

The only obvious difference I see is that you're on a DELL, and I'm on a home built PC, with the very latest BIOS.
My mobo's BIOS is from Oct 27th 2025, and I used it to flash the BIOS on Nov 29th, 2025.

My Dell XPS 8940 has the latest Bios available, but it is from 5/23/2025.
Garlin was the one that pointed out the problem about the "Banned" message.
If I compare the contents of the 2 scripts date 11/27/2025 and 11/15/2025 they are clearly different.
I get the same "Banned" message with the old script on all my different machines including Lenovo Yoga 920 Laptop.

Ghot · Jan 7, 2026

fg2001gf11F said:
they are clearly different.

And it could also be DELL not updating the BIOS since May 2025.
I know you like to "discuss" everything to death (which isn't necessarily a bad thing).
But let's wait and see WHY garlin's script works for you and the generic one doesn't. ^^

You DO understand, that since mine is completely done, I can't test these things.
I HAVE to wait for @garlin.

This is my "Check" from around the end of December 2025.
I can't go back and undo these changes.
And, even if I could... I wouldn't. I'm not that brave.

Anyway, I have morning stuff to do, but as Arnold used to say.... "I'll be back".

fg2001gf11F · Jan 7, 2026

Ghot said:
And it could also be DELL not updating the BIOS since May 2025.
I know you like to "discuss" everything to death (which isn't necessarily a bad thing).
But let's wait and see WHY garlin's script works for you and the generic one doesn't. ^^

You DO understand, that since mine is completely done, I can't test these things.
I HAVE to wait for @garlin.

This is my "Check" from around the end of December 2025.
I can't go back and undo these changes.
And, even if I could... I wouldn't. I'm not that brave.

View attachment 159226

Anyway, I have morning stuff to do, but as Arnold used to say.... "I'll be back".

Good night.

fg2001gf11F · Jan 7, 2026

F.Y.I.
I uploaded the 2 script files here on Google drive, the -Old one dated Nov 15, 2025, is producing the "Banned" message on all my machines.
The other one dated Nov 27, 2025, looks fine.
You can compare the 2 files to see what they are doing different.

Google Drive: Sign-in

Access Google Drive with a Google account (for personal use) or Google Workspace account (for business use).

drive.google.com

I think I found the difference when using the older script. The "Banned" message only shows up when I use the PowerShell 7.5.4.0 App.
It does not show if I use the old Windows PowerShell. See screenshot below.

fg2001gf11F · Jan 7, 2026

@Goth, @garlin,@Re7tore,

I think I found out why you are not getting the "Banned" message with the script dated Nov 15, 2025. Another user reported the issue.
See Post #535 and #540 on the thread below.

Did you manually update your Secure Boot Keys ?

My latest BIOS is from 2023 and doesn't have the 2023 certificate. I also have both Intel GPUs and an Nvidia GPU. I think some ISOs require Secure Boot to boot, but I don't know if that should cause a BSOD. I'll wait until the last minute. And even wait afterward by disabling Secure Boot if...

www.elevenforum.com

The message only shows when using PowerShell App 7.5.x it does not show when using the old Windows PowerShell.

See also update on my previous post.
Perhaps you are not using the new 7.5.4.0 PowerShell App? That is why you are not getting the "Banned" message.

Ghot · Jan 7, 2026

I'm using the old basic powershell.
Well, whichever one comes up in Terminal (Admin).

PowerShell 5.1 ...I believe.

fg2001gf11F · Jan 7, 2026

Ghot said:
I'm using the old basic powershell.
Well, whichever one comes up in Terminal (Admin).

PowerShell 5.1 ...I believe.

Thanks.
That explains why you don't see the "Banned" message.
Try using PowerShell 7.5.4.

Coresus · Jan 14, 2026

Hello, I used method three (cjee21's files) and got the result below.

However I must add that before doing that, I had downloaded the Check_EFIBootFile.ps1 file (method one), and after misreading the instructions, I ran that file (Check_EFIBootFile.ps1) in Powershell by mistake. Nothing particular happened (there may have been a very quick message but it dissappeared).

garlin · Jan 15, 2026

I haven't kept up with this thread (ElevenForum has 5 different Secure Boot topics going on), but PLEASE STOP USING Check_EFIBootFile.ps1.

It's outdated, and has several bugs that are corrected in the newest script Check_UEFI-CA2023.ps1.
garlin's PowerShell scripts for updating Secure Boot CA 2023

The new script has a different name, so users can know it's not the same one. It's also fully tested on PS 7.5. I've spent over two months adding to the script to check for different possible scenarios for how an UEFI could be configured (or misconfigured).

Usage:

Code:

Check_UEFI-CA2023.ps1

Check_UEFI-CA2023.ps1 -Verbose

Check_UEFI-CA2023.ps1 -Audit

Check_UEFI-CA2023.ps1 -Audit -Verbose

-Verbose provides more details like the Factory Defaults but organized in a more logical format.

-Audit provides a list of unfinished work that need to be done, in order to finish the updates.

Both options can be used separately, or combined at the same time. At the end of the report is a list of possible REQUIRED ACTIONS. This is derived from auditing the current UEFI variables, their contents, and whether you have a supported BIOS (based on the current PK's thumbprint).

If you're at the beginning of the update process, halfway done, or completed; Check_UEFI-CA2023.ps1 will be able to figure it out. I appreciate everyone use my original script, but it was a first pass at a working answer and can be retired. Thanks.

Ghot · Jan 15, 2026

There's nothing wrong with Check_EFIBootFile.ps1 as long as you are using the standard version of PowerShell.

This is noted in the first post of this topic.

garlin · Jan 15, 2026

You shouldn't be required to type "powershell -ep bypass -f script.ps1" from inside a PS 7 window. That's lame.

That's why I had to go back, and retest everything so it worked on both PowerShell's.

How to check if your Secure Boot certs are updated. (three methods)

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer