How to check if your Secure Boot certs are updated. (three methods)

garlin · Mar 30, 2026

Phirevixen said:
TPM-WMI Event ID 1796 The Secure Boot update failed to update SBAT with error Unknown HResult Error code: 0x800700c1

SBAT is the Linux equivalent of a SVN number, used to revoke older Linux boot loaders. It's written to your UEFI's variables (much like the Secure Boot keys). Windows doesn't depend on the SBAT (since it uses SVN), but Linux systems would care.

Error code 0x800700c1 translates to ERROR_BAD_EXE_FORMAT.

Typically the fixes are to start over, by resetting your UEFI back to factory defaults to clear all the UEFI variables. Then repeat whatever process you did to update the certs. Hopefully if the Secure Boot task has to write the SBAT again, it can finish without errors.

To get the Secure Boot task to update SBAT would have required you setting AvailableUpdates value as 0x400.

By default, my update script doesn't do a SBAT update since I don't know if you have a Linux setup or not. And right now, there's no explicit guidance from MS whether you must install the SBAT, on a Windows-only PC. If the guidance changes later this year, I'll rewrite the update script but it doesn't touch the SBAT unless you specially add the "-SBAT" option on the command line.

Phirevixen · Mar 30, 2026

garlin said:
SBAT is the Linux equivalent of a SVN number, used to revoke older Linux boot loaders. It's written to your UEFI's variables (much like the Secure Boot keys). Windows doesn't depend on the SBAT (since it uses SVN), but Linux systems would care.

Error code 0x800700c1 translates to ERROR_BAD_EXE_FORMAT.

Typically the fixes are to start over, by resetting your UEFI back to factory defaults to clear all the UEFI variables. Then repeat whatever process you did to update the certs. Hopefully if the Secure Boot task has to write the SBAT again, it can finish without errors.

To get the Secure Boot task to update SBAT would have required you setting AvailableUpdates value as 0x400.

By default, my update script doesn't do a SBAT update since I don't know if you have a Linux setup or not. And right now, there's no explicit guidance from MS whether you must install the SBAT, on a Windows-only PC. If the guidance changes later this year, I'll rewrite the update script but it doesn't touch the SBAT unless you specially add the "-SBAT" option on the command line.

I don't have Linux, but I have WSA installed from Github.

garlin · Mar 30, 2026

WSA and WSL both run inside a Virtual Machine. They don't need access to the UEFI. I honestly don't know why you have this error, but other folks online have reported the same thing.

Phirevixen · Mar 30, 2026

garlin said:
WSA and WSL both run inside a Virtual Machine. They don't need access to the UEFI. I honestly don't know why you have this error, but other folks online have reported the same thing.

Well, as you could see the script output looks fine. Maybe I should leave well enough alone. I was just curious why it does that all the sudden.

hdmi · Mar 30, 2026

garlin said:
0x5944 is the current guidance provided by MS for all enterprise customers, and is the same mask invoked by one of the Secure Boot GPO's. But that was not the first iteration of the official update process.

Prior to 0x5944, the instructions guided users through toggling one bitmask value at time, which made the entire process tedious.

Yes, Enterprise customers don't want to break the Windows chain of trust, and, Microsoft made several changes to what factually happens under the hood when these updates are applied. This mainly is why 0x5944 is currently the only officially recommended value.

garlin said:
I remember those days, which prompted me to write an update script (my version doesn't actually call the PI task since it does all the appends using the SecureBootUpdates .bin files).

When I mean "faster", that part includes tasks like copying the new boot manager. Witness all the posts where someone confirms it can take anywhere from no time to waiting half an hour before all the indicators change.

If you want to keep it as reliable as possible, your only choice is to just wait it out.

garlin said:
If MS didn't want IT admins using the different masks, why do they bother documenting it (when this detail wasn't shared back in summer 2025)?

In a way, it was still only a "work in progress" kind of thing back then. A few short moments later, I witnessed the emergence of the "please hold my beer and watch this" parade. IIRC, each bit in the AvailableUpdates bitmask is cleared after the update that the bit represents is applied, either until all the bits are cleared or until an error occurs that prevents the mask from continuing to be processed any further. So, that part of the documentation is still needed to understand the result in case of an error or in case auditing is enabled for the value.

garlin said:
Secure Boot Certificate updates: Guidance for IT professionals and organizations - Microsoft Support

support.microsoft.com

flhthemi · Mar 30, 2026

hdmi said:
To make sure that the bootmanager also gets updated, use
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f (instead of 0x1840). Then after you run the scheduled task (and reboot), you can run both "Check UEFI PK, KEK, DB and DBX.cmd" and "Check Windows state.cmd" as an administrator to check results. Under Current UEFI DB the three red X signs should now be green check marks. The other script should output something like this:

Code:

Checking for Administrator permission... Running as administrator - continuing execution... Windows version: 25H2 (Build 26200.8116) UEFISecureBootEnabled : 1 AvailableUpdates : 0x0000 UEFICA2023Status : Updated WindowsUEFICA2023Capable : Windows UEFI CA 2023 cert is in DB, system is starting from 2023 signed boot manager bootmgfw version : 10.0.28000.317 (WinBuild.160101.0800) bootmgfw signature CA : bootmgfw SVN : 7.0 bootmgr version : 10.0.28000.317 (WinBuild.160101.0800) bootmgr signature CA : bootmgr SVN : 7.0 memtest version : 10.0.26100.1 (WinBuild.160101.0800) memtest signature CA :

The "WindowsUEFICA2023Capable : Windows UEFI CA 2023 cert is in DB, system is starting from 2023 signed boot manager" is the important part in that output. A little over two months from now, without the updated bootmanager, Windows will most likely no longer be able to boot if Secure Boot is enabled.

garlin said:
For some reason, your CA 2023 DB certs didn't get added.

First run the commands:

Code:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x1840 /f powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

I assume, and I hate doing that, that these are two different commands each run using cmd as admin?

Thanks for the help and info!

garlin · Mar 30, 2026

Those are two separate command lines.

Normally you enter them into CMD, but if you're in PowerShell already, the second line isStart-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

flhthemi · Mar 31, 2026

Ok so I ran the 1st 2 commands
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x1840 /f<br>
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Then the 3rd one
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f
(instead of 0x1840)

Rebooted and ran
Check UEFI PK, KEK, DB and DBX.cmd as admin

Here's what I got back....

.

Then I ran Check Windows state.cmd
And got this:

garlin · Mar 31, 2026

You're done with adding CA 2023 certs, but revocation has not happened.

If you don't want to wait for MS to revoke CA 2011, run the task again with AvailableUpdates = 0x282

flhthemi · Mar 31, 2026

garlin said:
You're done with adding CA 2023 certs, but revocation has not happened.

If you don't want to wait for MS to revoke CA 2011, run the task again with AvailableUpdates = 0x282

Thanks! But I think I'll wait on MS just to see how it goes on my Minis...
I have several other PCs some are not W-11 compliant but are running just fine on 23H2. Would I use the same commands as I have used on the Minis on all of them or does BIOS and PC motherboard make a difference??

garlin · Mar 31, 2026

flhthemi said:
I have several other PCs some are not W-11 compliant but are running just fine on 23H2. Would I use the same commands as I have used on the Minis on all of them or does BIOS and PC motherboard make a difference??

There is no universal answer, it depends on your OEM's choice of BIOS versions.

Some will provide you an updated BIOS which has CA 2023 certs built-in.
Some don't provide you an updated BIOS, but have co-operated with MS to sign a KEK CA 2023 for their BIOS.
Some don't provide any of the above, but have a BIOS which manual key enrollment is possible.
Some old BIOS'es have problems with key enrollment and Setup Mode (clearing the certs) is the only workable option.

You start with an optimistic view, and check if they've shipped a BIOS update since around 2022. The closer the firmware date is to 2026, the more likely updated certs are part of the BIOS.

Next you see if the check script thinks your BIOS might be supported (a signed KEK has been identified in MS's repository).

Failing both options, you check if your BIOS has key enrollment. If that's not an option, you go for Setup Mode.

As they say, your results will vary.

Sequence · Apr 1, 2026

garlin said:
This should fix the problems where your Windows locale isn't English.

Hi Garlin,

here the newest output:

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) ON
Get-UefiDatabaseSignatures : Das Argument für den Parameter "Variable" kann nicht überprüft werden. Das Argument ist NULL oder leer, oder ein Element der Argumentauflistung
enthält einen NULL-Wert. Geben Sie eine Auflistung an, die keine NULL-Werte enthält, und führen Sie dann den Befehl erneut aus.
In C:\Downloads\SecureBoot-CA-2023-Updates fixed\2\Check_UEFI-CA2023.ps1:325 Zeichen:57
+ ... (Get-SecureBootUEFIVar $Variable | Get-UefiDatabaseSignatures).Signat ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidData: (:) [Get-UefiDatabaseSignatures], ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationError,Get-UefiDatabaseSignatures

ERROR: Failed to read UEFI Secure Boot settings.
Es ist nicht möglich, einen Index auf ein NULL-Array anzuwenden.

garlin · Apr 1, 2026

Sorry. I tried to replace the error handling code across all the different places in the script with a single function, and it wasn't successfully.
Back to a more traditional fix.

TrebleTA · Apr 2, 2026

Hi all.
So I've done all the test's etc before, and with your help, I have it all set up, but notice that there are 2 with cross's, I know its part of the OEM side and I wanted to contact gigabyte, as I have seen others with a gigabyte board with the same, but thought I would ask what you's think, can the default be updated by us, anything I should say to gigabyte when asking about this, as I don't think there be any more bios updates for my board after this?

Thanks in advance

garlin · Apr 2, 2026

TrebleTA said:
Hi all.
So I've done all the test's etc before, and with your help, I have it all set up, but notice that there are 2 with cross's, I know its part of the OEM side and I wanted to contact gigabyte, as I have seen others with a gigabyte board with the same, but thought I would ask what you's think, can the default be updated by us, anything I should say to gigabyte when asking about this, as I don't think there be any more bios updates for my board after this?

You can give feedback to Gigabyte, but they're not going to change it.

The official guidance to OEM's says the Microsoft UEFI CA 2023 (used for Linux) and the Option ROM are optional. Vendors can decide to include or skip them as factory defaults. As long as you're provided a working KEK CA 2023, any of the MS-issued CA 2023 certs can be applied to a system.

If you were to reset to factory defaults or have some terrible BIOS flashing accident, you can always temporarily disable Secure Boot and re-apply those two certs again from Windows, Those certs are shipped with every copy of an updated Windows.

Fabler2 · Apr 3, 2026

Don't know if this has been posted previously but Defender now shows the state of secure boot.

Windows, computers and Technology

Sequence · Apr 3, 2026

garlin said:
Sorry. I tried to replace the error handling code across all the different places in the script with a single function, and it wasn't successfully.
Back to a more traditional fix.

Hey Garlin,

this one seems to look better:

---

Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) ON

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DBX Certs
--------------
(NONE)

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.

Registry: WindowsUEFICA2023Capable = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

SkuSiPolicy.p7b (for VBS) is MISSING. [OPTIONAL]

REQUIRED ACTION
===============

To revoke the [PCA 2011] cert, run the commands:

manage-bde -Protectors -Disable C: -RebootCount 1
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x282 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

PS C:\Downloads\SecureBoot-CA-2023-Updates fixed\3>

garlin · Apr 3, 2026

Thanks for the confirmation.

TrebleTA · Apr 4, 2026

garlin said:
You can give feedback to Gigabyte, but they're not going to change it.

The official guidance to OEM's says the Microsoft UEFI CA 2023 (used for Linux) and the Option ROM are optional. Vendors can decide to include or skip them as factory defaults. As long as you're provided a working KEK CA 2023, any of the MS-issued CA 2023 certs can be applied to a system.

If you were to reset to factory defaults or have some terrible BIOS flashing accident, you can always temporarily disable Secure Boot and re-apply those two certs again from Windows, Those certs are shipped with every copy of an updated Windows.

So I have passed this on to gigabyte as I did have that info already, from earlier in this thread, they have passed it on to there bios team to check, so now to wait and see.

Sequence · Apr 5, 2026

garlin said:
Thanks for the confirmation.

Could i leave it like that, or will there still be work to do?

How to check if your Secure Boot certs are updated. (three methods)

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Jack of all trades – master of none

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer