How to check if your Secure Boot certs are updated. (three methods)

Bonzo · Mar 29, 2026

garlin said:
The other script reports that "PCA 2011 (revoked: True)" in the DB category, which implies PCA 2011 was added to the DBX list.

But if you're not familiar with how Secure Boot variables work, you would feel more comfortable seeing an explicit list of DBX certs. That explanation is easier for most people to follow, and doesn't lead to more follow up questions.

Got it, thank you.

Sequence · Mar 29, 2026

garlin said:
This should fix the problems where your Windows locale isn't English.

Hey Garlin,

just for me to get this, as i most of the time have no idea what i am seeing there when reading those outputs:

What exactly will this script do?

I am from Germany btw., wouldn't it be normal to have German text in the output?

garlin · Mar 29, 2026

Windows error messages are provided in your local language. The script should be looking for the error number (0xC0001000), instead of the entire message text. I don't have a copy of Windows in a different language for test purposes.

flhthemi · Mar 29, 2026

This on a Minisforum NAB 9 Mini PC.
Inside this mini PC is an Intel i9-12900HK, Intel Iris XE graphics, 32GB RAM, and a 1TB SSD

garlin · Mar 29, 2026

flhthemi said:
This on a Minisforum NAB 9 Mini PC.
Inside this mini PC is an Intel i9-12900HK, Intel Iris XE graphics, 32GB RAM, and a 1TB SSD

For some reason, your CA 2023 DB certs didn't get added.

First run the commands:

Code:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x1840 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

hdmi · Mar 30, 2026

flhthemi said:
View attachment 167152

This on a Minisforum NAB 9 Mini PC.
Inside this mini PC is an Intel i9-12900HK, Intel Iris XE graphics, 32GB RAM, and a 1TB SSD

To make sure that the bootmanager also gets updated, use
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f (instead of 0x1840). Then after you run the scheduled task (and reboot), you can run both "Check UEFI PK, KEK, DB and DBX.cmd" and "Check Windows state.cmd" as an administrator to check results. Under Current UEFI DB the three red X signs should now be green check marks. The other script should output something like this:

Code:

Checking for Administrator permission...
Running as administrator - continuing execution...

Windows version: 25H2 (Build 26200.8116)

UEFISecureBootEnabled    : 1
AvailableUpdates         : 0x0000
UEFICA2023Status         : Updated
WindowsUEFICA2023Capable : Windows UEFI CA 2023 cert is in DB, system is starting from 2023 signed boot manager

bootmgfw version         : 10.0.28000.317 (WinBuild.160101.0800)
bootmgfw signature CA    :
bootmgfw SVN             : 7.0

bootmgr version          : 10.0.28000.317 (WinBuild.160101.0800)
bootmgr signature CA     :
bootmgr SVN              : 7.0

memtest version          : 10.0.26100.1 (WinBuild.160101.0800)
memtest signature CA     :

The "WindowsUEFICA2023Capable : Windows UEFI CA 2023 cert is in DB, system is starting from 2023 signed boot manager" is the important part in that output. A little over two months from now, without the updated bootmanager, Windows will most likely no longer be able to boot if Secure Boot is enabled.

zbook · Mar 30, 2026

Bonzo said:
Got it, thank you.

From your thread:

About device security settings

Hello, yesterday I was checking my Windows Security settings, and came across this: I have done everything I can so I can either enable this option or remove the "This setting is managed by your administrator". That includes: 1. Using Group Policy, by enabling "Turn on Virtualization Based...

www.elevenforum.com

Code:

Event[7728]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2026-03-28T15:46:44.5580000Z
  Event ID: 1801
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: FURQUIM
  Description:
Updated Secure Boot certificates are available on this device but have not yet been applied to the firmware. Review the published guidance to complete the update and maintain full protection. This device signature information is included here.
DeviceAttributes: BaseBoardManufacturer:Gigabyte Technology Co., Ltd.;FirmwareManufacturer:American Megatrends International, LLC.;FirmwareVersion:F20c;OEMModelNumber:H510M H;OEMModelBaseBoard:H510M H;OEMModelSystemFamily:H510 MB;OEMManufacturerName:Gigabyte Technology Co., Ltd.;OEMModelSKU:Default string;OSArchitecture:amd64;
BucketId: 259b6fa74e9a19d98211f1a309c8ea5386e6a56fc01fc4ba8e55a07f4f6ef7e9
BucketConfidenceLevel: Under Observation - More Data Needed
UpdateType:
For more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.

Windows Secure Boot certificate expiration and CA updates | Microsoft Support

Windows Secure Boot certificate expiration and CA updates

support.microsoft.com

garlin · Mar 30, 2026

0x5944 is the generic bitmask for "do all the update CA 2023 tasks at the same time", whereas ~~0x1840~~ works out to:

Code:

0x1000  MS UEFI CA 2023
0x0800  Option ROM
0x0100  update boot manager
0x0040  Windows UEFI CA 2023

The Secure Boot task will skip over any updates that's already completed, but throwing in the 0x4000 can sometimes cause the task to "block". My check script does compute the the shortest bitmask for the unfinished updates, so it can go faster.

CORRECTION: 0x1940 is the right value.

garlin · Mar 30, 2026

zbook said:

Code:

Updated Secure Boot certificates are available on this device but have not yet been applied to the firmware. Review the published guidance to complete the update and maintain full protection.

The event log is stating the UEFI is missing certs which haven't been added (Windows UEFI CA 2023 & Microsoft UEFI CA 2023). The certs are readily available in the SecureBootUpdates folder, waiting for the Secure Boot task to add them.

zbook · Mar 30, 2026

What steps does he need to make so that the entry no longer reoccurs?

garlin · Mar 30, 2026

zbook said:
What steps does he need to make so that the entry no longer reoccurs?

Post #405. From the script's report, DB is missing all 3 CA 2023 certs.

PCA 2011 shouldn't be revoked until that's done, because Secure Boot is currently enabled. If you haven't revoked PCA 2011, it does not (at this time) create a TPM-WMI error for that condition.

zbook · Mar 30, 2026

Bonzo will be able to view your post.

As progress is made in the other thread the event viewer files can be rechecked.

Thx.

hdmi · Mar 30, 2026

garlin said:
0x5944 is the generic bitmask for "do all the update CA 2023 tasks at the same time", whereas ~~0x1840~~ works out to:

Code:

0x1000 MS UEFI CA 2023 0x0800 Option ROM 0x0100 update boot manager 0x0040 Windows UEFI CA 2023

The Secure Boot task will skip over any updates that's already completed, but throwing in the 0x4000 can sometimes cause the task to "block". My check script does compute the the shortest bitmask for the unfinished updates, so it can go faster.

CORRECTION: 0x1940 is the right value.

AFAIK due to how the Windows PI (Plug-in Infrastructure)-task factually works, leaving out the 0x4000 bit can cause the task to not write the updates to the NVRAM, and, leaving out the 0x0004 bit can cause the firmware to refuse the update despite that the KEK is already present. Also AFAIK, leaving out the 0x0004 bit doesn't accelerate the update completion, as the service already scans the NVRAM when the task starts anyway in the first place so, it takes only a fraction of a second before it sees the KEK and moves on to the next update that you specified in the AvailableUpdates DWORD value. Either way, currently 0x5944 is the only officially documented (by Microsoft) value to use for this specific purpose. Even if you're not an IT administrator and you're not relying on Windows Measured Boot, DHA (Device Health Attestation) or preventing BitLocker from going into Recovery mode, at least according to what I have read, using 0x1940 is somewhat risky.

garlin · Mar 30, 2026

0x5944 is the current guidance provided by MS for all enterprise customers, and is the same mask invoked by one of the Secure Boot GPO's. But that was not the first iteration of the official update process.

Prior to 0x5944, the instructions guided users through toggling one bitmask value at time, which made the entire process tedious. I remember those days, which prompted me to write an update script (my version doesn't actually call the PI task since it does all the appends using the SecureBootUpdates .bin files).

When I mean "faster", that part includes tasks like copying the new boot manager. Witness all the posts where someone confirms it can take anywhere from no time to waiting half an hour before all the indicators change.

If MS didn't want IT admins using the different masks, why do they bother documenting it (when this detail wasn't shared back in summer 2025)?

Secure Boot Certificate updates: Guidance for IT professionals and organizations - Microsoft Support

support.microsoft.com

Secure Boot certificate deployment support

In support of the Secure Boot certificate updates, Windows maintains a scheduled task that runs once every 12 hours. The task looks for bits in the AvailableUpdates registry key that needs processing. The bits of interest used in deploying the certificates are in the following table. The Order column indicates the order that the bits are processed.

Order Bit setting Usage
1 0x0040 This bit tells the scheduled task to add the Windows UEFI CA 2023 certificate to the Secure Boot DB. This allows Windows to trust boot managers signed by this certificate.
2 0x0800 This bit tells the scheduled task to apply the Microsoft Option ROM UEFI CA 2023 to the DB.

If 0x4000 is also set, then the scheduled task will check the DB and will only apply Microsoft UEFI CA 2023 if it finds Microsoft Corporation UEFI CA 2011 already in the DB.
3 0x1000 This bit tells the scheduled task to apply the Microsoft UEFI CA 2023 to the DB.

If 0x4000 is also set, then the scheduled task will check the DB and will only apply Microsoft Option ROM UEFI CA 2023 if it finds Microsoft Corporation UEFI CA 2011 already in the DB.
2 & 3 0x4000 This bit modifies the behavior of the 0x0800 and 0x1000 bits to only apply the Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023 if the DB already has the Microsoft Corporation UEFI CA 2011.

To ensure that the device’s security profile remains the same, this bit only applies these new certificates only if the device trusted the Microsoft Corporation UEFI CA 2011 certificate. Not all Windows devices trust this certificate.
4 0x0004 This bit tells the scheduled task to look for a Key Exchange Key signed by the device’s Platform Key (PK). The PK is managed by the OEM. OEMs sign the Microsoft KEK with their PK and deliver it to Microsoft where it is included in the cumulative updates.
5 0x0100 This bit tells the scheduled task to apply the boot manager, signed by the Windows UEFI CA 2023, to the boot partition. This will replace the Microsoft Windows Production PCA 2011 signed boot manager.

Bonzo · Mar 30, 2026

zbook said:
From your thread:

About device security settings

Hello, yesterday I was checking my Windows Security settings, and came across this: I have done everything I can so I can either enable this option or remove the "This setting is managed by your administrator". That includes: 1. Using Group Policy, by enabling "Turn on Virtualization Based...

www.elevenforum.com

Code:

Event[7728] Log Name: System Source: Microsoft-Windows-TPM-WMI Date: 2026-03-28T15:46:44.5580000Z Event ID: 1801 Task: N/A Level: Error Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: FURQUIM Description: Updated Secure Boot certificates are available on this device but have not yet been applied to the firmware. Review the published guidance to complete the update and maintain full protection. This device signature information is included here. DeviceAttributes: BaseBoardManufacturer:Gigabyte Technology Co., Ltd.;FirmwareManufacturer:American Megatrends International, LLC.;FirmwareVersion:F20c;OEMModelNumber:H510M H;OEMModelBaseBoard:H510M H;OEMModelSystemFamily:H510 MB;OEMManufacturerName:Gigabyte Technology Co., Ltd.;OEMModelSKU:Default string;OSArchitecture:amd64; BucketId: 259b6fa74e9a19d98211f1a309c8ea5386e6a56fc01fc4ba8e55a07f4f6ef7e9 BucketConfidenceLevel: Under Observation - More Data Needed UpdateType: For more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.

Windows Secure Boot certificate expiration and CA updates | Microsoft Support

Windows Secure Boot certificate expiration and CA updates

support.microsoft.com

garlin said:
Post #405. From the script's report, DB is missing all 3 CA 2023 certs.

PCA 2011 shouldn't be revoked until that's done, because Secure Boot is currently enabled. If you haven't revoked PCA 2011, it does not (at this time) create a TPM-WMI error for that condition.

Thank you! I'll run the commands and recheck my Event Viewer. I thought this event happened before I fully updated the certificates, but it seems that I was wrong.

garlin · Mar 30, 2026

Bonzo said:
Thank you! I'll run the commands and recheck my Event Viewer. I thought this event happened before I fully updated the certificates, but it seems that I was wrong.

While you can browse the TPM-WMI logs, it's much simpler to run a designed script which actually checks for the certs', instead of inferring what happened based on event logs. It's a more efficient use of your time.

Bonzo · Mar 30, 2026

garlin said:
While you can browse the TPM-WMI logs, it's much simpler to run a designed script which actually checks for the certs', instead of inferring what happened based on event logs. It's a more efficient use of your time.

You're right, thanks. It seems to be ok now?

garlin · Mar 30, 2026

You're done with updates and revocation.

Bonzo · Mar 30, 2026

garlin said:
You're done with updates and revocation.

Thank you very much.

Phirevixen · Mar 30, 2026

Garlin, dumb question: When I run your script

Then it throws this error:

TPM-WMI Event ID 1796 The Secure Boot update failed to update SBAT with error Unknown HResult Error code: 0x800700c1

How to check if your Secure Boot certs are updated. (three methods)

Active member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Jack of all trades – master of none

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Jack of all trades – master of none

My Computers My Computers

At a glance

At a glance

Well-known member

Secure Boot certificate deployment support ​

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

Secure Boot certificate deployment support

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer