How to check if your Secure Boot certs are updated. (three methods)

fg2001gf11F · Nov 26, 2025

Can you do a dir on the \sources\install*.* files?

Code:

Secure Boot: OFF
BitLocker on (C:) ON

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011

UEFI DBX Certs
--------------

EFI Files
---------
    Disk 0: Boot Manager [Windows UEFI CA 2023] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 0
        [Windows UEFI CA 2023] is not in UEFI DB.

Bootable Media
--------------
    DVD D: "NTLite"
        Boot File [Production PCA 2011] is ALLOWED.
        boot.wim:2    Boot Manager [Windows UEFI CA 2023] is PRESENT.
        install.swm:1 Boot Manager [Windows UEFI CA 2023] is PRESENT.

PS C:\Users\GARLIN\Downloads> dir d:\sources\install*

    Directory: D:\sources

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
--r--          11/26/2025  2:38 PM     4194066378 install.swm
--r--          11/26/2025  2:38 PM     2160969842 install2.swm

Here it is.
Perhaps they were split from the original install.esd on 26200.7171?
While in the 28000.1 the split was from the original install.wim?

I:\sources>dir install*.*
Volume in drive I is S26200-7171
Volume Serial Number is AE7E-091C

Directory of I:\sources

11/24/2025 11:42 PM 3,974,063,630 install.swm
11/24/2025 11:42 PM 1,188,719,206 install2.swm
2 File(s) 5,162,782,836 bytes
0 Dir(s) 24,972,345,344 bytes free

garlin · Nov 26, 2025

Are there any install files under H:\sources?

gunrunnerjohn · Nov 26, 2025

garlin said:
This corrected version is now compatible with PS7, and recognizes SWM files. But it assumes the second volume on the MCT-created drive has a valid drive letter.

I get some odd result with that new script. The USB in K: is the Hiren's BootCD with PE.

I inserted my Windows RECOVERY disk and that came up normally and then had a different error on the last line.

Finally, I inserted the Acronis TI 2025 Rercovery disk, and it doesn't see it at all. I can see the disk in Explorer and the boot files are there, but it's ignored by the script. This USB drive also boots with Secure Boot enabled and the 2011 Cert revoked.

fg2001gf11F · Nov 26, 2025

garlin said:
Can you do a dir on the \sources\install*.* files?

Worked on this 26200.6584 too.
I'm sure it was split from an original install.wim in this case too.

garlin · Nov 26, 2025

gunrunnerjohn said:
This is the first time I've seen the 2010 cert mentioned, I didn't realize it existed until now.

Some Linux distros (like Ubuntu) used the PCA 2010 cert, back in the day.

garlin · Nov 26, 2025

gunrunnerjohn said:
I get some odd result with that new script. The USB in K: is the Hiren's BootCD with PE.

Not sure why the uploaded version wasn't the latest file. But it's been re-upped.

gunrunnerjohn said:
Finally, I inserted the Acronis TI 2025 Rercovery disk, and it doesn't see it at all. I can see the disk in Explorer and the boot files are there, but it's ignored by the script. This USB drive also boots with Secure Boot enabled and the 2011 Cert revoked.

The script's primary role is to advise you on Windows install media, and not every possible USB boot drive. What's supposed to contained on the USB and inside the WIM files is well documented by MS.

UEFI typically looks for \EFI\boot\bootx64.efi as the boot file. Whether a bootable recovery or tools USB keeps EFI files in other folders is going to depend on that app's designs. As I've said before, I don't get paid by them so they should get off their *** and do this work themselves.

fg2001gf11F · Nov 26, 2025

garlin said:
Some Linux distros (like Ubuntu) used the PCA 2010 cert, back in the day.

I have 2 machines Dell XPS 8940 that came originally from Dell and they both show that
UEFI DBX Certs
-----------------
Microsoft Windows PCA 2010

fg2001gf11F · Nov 26, 2025

garlin said:
Are there any install files under H:\sources?

@garlin,

Here I just downloaded and created a USB installation media with MCT. It is on the E: drive and it is FAT32.
There is no H: in this case.
I think MCT splits the install.esd into install.swm and install2.swm and the script cannot handle that specific case.

See below:

E:\>cd sources

E:\sources>dir install*.*
Volume in drive E is ESD-USB
Volume Serial Number is C224-9EC3

Directory of E:\sources

11/26/2025 07:17 PM 3,974,063,630 install.swm
11/26/2025 07:17 PM 1,188,719,206 install2.swm
2 File(s) 5,162,782,836 bytes
0 Dir(s) 24,974,852,096 bytes free

garlin · Nov 26, 2025

Try this (from PowerShell):

Code:

$env:TEMP\7z.exe l -ba E:\sources\install.swm

$env:TEMP\7z.exe l -ba E:\sources\install.swm "1\Windows\Boot\EFI_EX\bootmgfw_EX.efi" "Windows\Boot\EFI_EX\bootmgfw_EX.efi"

It should begin listing files from the SWM. Now it works for my SWM, which was split by NTLite.
But I'm wondering if MCT is doing something fishy.

fg2001gf11F · Nov 27, 2025

garlin said:
Try this (from PowerShell):

Code:

$env:TEMP\7z.exe l -ba E:\sources\install.swm $env:TEMP\7z.exe l -ba E:\sources\install.swm "1\Windows\Boot\EFI_EX\bootmgfw_EX.efi" "Windows\Boot\EFI_EX\bootmgfw_EX.efi"

It should begin listing files from the SWM. Now it works for my SWM, which was split by NTLite.
But I'm wondering if MCT is doing something fishy.

This is what I see.

As for MCT I think it splits the install.esd instead of an install.wim, maybe that is the issue?

The ones that I split with DISM from an install.wim seem to show up correctly.

Two different cases examples below:

Dism /Split-Image /ImageFile F:\Temp\install.wim /SWMFile F:\Temp\install.swm /FileSize:3800

Dism /Split-Image /ImageFile F:\Temp\install.esd /SWMFile F:\Temp\install.swm /FileSize:3800

fg2001gf11F · Nov 27, 2025

garlin said:
Try this (from PowerShell):

Code:

$env:TEMP\7z.exe l -ba E:\sources\install.swm $env:TEMP\7z.exe l -ba E:\sources\install.swm "1\Windows\Boot\EFI_EX\bootmgfw_EX.efi" "Windows\Boot\EFI_EX\bootmgfw_EX.efi"

It should begin listing files from the SWM. Now it works for my SWM, which was split by NTLite.
But I'm wondering if MCT is doing something fishy.

Hello again,
I think Copilot explained the reason for the difference with MCT created .swm files.
When they split an install.esd it still creates .swm files but they retain the compression of the original .esd file.
The files created by splitting the install.esd have LZMS compression, while the ones created from an install.wim have LZX or XPRESS compression.
They need to be treated differently depending on the compression.
That can explain why the install.swm created splitting the install.esd by MCT will fail with the script.
Please let me know when you have a fix to deal with both cases. of install.swm
Thanks.

If we split manually, we could do two steps to avoid the .esd compression type.
1) Convert .esd to .wim with
dism /Export-Image /SourceImageFile:C:\sources\install.esd /SourceIndex:1 /DestinationImageFile:C:\sources\install.wim /Compress:max /CheckIntegrity

2) Split
Dism /Split-Image /ImageFile F:\Temp\install.wim /SWMFile F:\Temp\install.swm /FileSize:3800

But MCT splits directly from the install.esd and the compression is maintained on the resulting .swm files.

gunrunnerjohn · Nov 27, 2025

garlin said:
Not sure why the uploaded version wasn't the latest file. But it's been re-upped.

The script's primary role is to advise you on Windows install media, and not every possible USB boot drive. What's supposed to contained on the USB and inside the WIM files is well documented by MS.

UEFI typically looks for \EFI\boot\bootx64.efi as the boot file. Whether a bootable recovery or tools USB keeps EFI files in other folders is going to depend on that app's designs. As I've said before, I don't get paid by them so they should get off their *** and do this work themselves.

Makes perfect sense, I see the Acronis recovery disk went their own way on the boot files. I suspect if I used the Windows-PE version of the recovery, the bootfiles would be in the place you expected.

fg2001gf11F · Nov 27, 2025

garlin said:
But I'm wondering if MCT is doing something fishy.

@garlin,
To prove the point, I converted the install.esd into install.wim and then split into install.swm and install2.swm and made the USB below showing as G:
You can see that in this case your script had no issue with this install.swm.
I think that the problem with the one created by MCT is that the split is done from install.esd directly and the resulting install.swm and install2.swm retain the compression of the original install.esd as suggested by Copilot.
Perhaps you can fix the script to handle that specific case too.
Let me know, thanks.
F.G.

Winuser · Nov 27, 2025

suatcini54 said:
You must use the file in command prompt as admin

powershell -nop -ep bypass -f Path-to-the-script\Check_EFIBootFile.ps1

such as %userprofile%\Desktop\Check_EFIBootfile.ps1 if the file is on your desktop

Hope this helps

I must be doing something wrong. I have tried several ways and can't get it to work. could you explain exactly what one is supposed to do to get it to work?

starchase · Nov 27, 2025

gunrunnerjohn said:
This is the first time I've seen the 2010 cert mentioned, I didn't realize it existed until now.

I just thought I'd mention it, but I see the 2010 cert on my Dell laptop, so perhaps it is another weird Dell thing.

garlin · Nov 27, 2025

starchase said:
I just thought I'd mention it, but I see the 2010 cert on my Dell laptop, so perhaps it is another weird Dell thing.

Dell was heavily involved in Linux-compatible PC's, which would have meant pre-installing PCA 2010 from the factory.

garlin · Nov 27, 2025

This Turkey Day version of the script removes the dependency on 7z.exe, and uses native DISM to search for WIM files. The performance is probably much worse for scanning a WIM, but it should be compatible with MCT.

wabbit · Nov 27, 2025

garlin said:
Dell was heavily involved in Linux-compatible PC's, which would have meant pre-installing PCA 2010 from the factory.

I see the 2010 certs on both my dell systems in the DBX Certs but not on my Geekom mini-PC. Maybe it is a Dell thing.

fg2001gf11F · Nov 27, 2025

garlin said:
This Turkey Day version of the script removes the dependency on 7z.exe, and uses native DISM to search for WIM files. The performance is probably much worse for scanning a WIM, but it should be compatible with MCT.

Thanks for the update.
Here is the output with your Turkey Day version.
E:
Has .swm files created from a .wim

G:
Has .swm files created from a .esd (works with you last version)

Your previous version was getting this error on the same G: drive.

Winuser · Nov 29, 2025

Winuser said:
I must be doing something wrong. I have tried several ways and can't get it to work. could you explain exactly what one is supposed to do to get it to work?

I figured out what I was doing wrong by follow following how others did it in their post. From what I got I'm not sure if my computer is completely updated or not. This is what I get.

How to check if your Secure Boot certs are updated. (three methods)

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

Attachments

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers