Solved Reflect Boot Media After UEFI CA 2011 Revocation

starchase · Sep 10, 2025

Once the Microsoft UEFI CA 2011 certificate is revoked and put in the DBX and I need to update Reflects boot media, as I understand it one just creates new media through the Reflect application, right? Since I'm running the free version (I'm not going to pay the subscription fee) must I use the paid version of Reflect to build the rescue disk or does Macriun Reflect have a way for those of us on the free version to update their rescue media?

Failing Macrium's help does Hasleo's program create a rescue media that uses the updated boot certificates?

Failing all that I suppose that the only other solution would be to disable Secure Boot before trying to boot from t he old Reflect rescue media.

John

garlin · Sep 10, 2025

Try this procedure, and let me know if it works:

M: is your mounted Macrium recovery USB.

Code:

ren M:\bootmgr.efi M:\bootmgr-OLD.efi
ren M:\efi\boot\bootx64.efi M:\efi\boot\bootx64-OLD.efi

copy C:\Windows\Boot\EFI_EX\bootmgr_EX.efi M:\bootmgr.efi
copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi M:\efi\boot\bootx64.efi
copy C:\Windows\Boot\DVD_EX\EFI\en-US\efisys_EX.bin M:\efi\microsoft\boot\efisys_ex.bin

mkdir M:\efi\microsoft\boot\fonts_ex
copy C:\Windows\Boot\FONTS_EX\* M:\efi\microsoft\boot\fonts_ex

If it doesn't boot, then you can move the renamed -OLD files back to the original filenames.

starchase · Sep 10, 2025

Thanks. I will do this this evening when my PC is available. Right now Copilot is doing a deep dive for me for some genealogy stuff. And then Marketplace is coming on GPB radio.

gunrunnerjohn · Sep 10, 2025

What are you running Copilot on? Both of your listed machines seem to be pretty low powered for Copilot.

starchase · Sep 10, 2025

garlin said:
Try this procedure, and let me know if it works:

M: is your mounted Macrium recovery USB.

Code:

ren M:\bootmgr.efi M:\bootmgr-OLD.efi ren M:\efi\boot\bootx64.efi M:\efi\boot\bootx64-OLD.efi copy C:\Windows\Boot\EFI_EX\bootmgr_EX.efi M:\bootmgr.efi copy C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi M:\efi\boot\bootx64.efi copy C:\Windows\Boot\DVD_EX\EFI\en-US\efisys_EX.bin M:\efi\microsoft\boot\efisys_ex.bin mkdir M:\efi\microsoft\boot\fonts_ex copy C:\Windows\Boot\FONTS_EX\* M:\efi\microsoft\boot\fonts_ex

If it doesn't boot, then you can move the renamed -OLD files back to the original filenames.

Should I save this as a script and just RUN it?

garlin · Sep 10, 2025

You'd replace M: with whatever drive letter the USB drive gets assigned to.

Ghot · Sep 10, 2025

starchase said:
as I understand it one just creates new media through the Reflect application

Sort of...
You want the instructions under the heading: Create New Macrium Reflect Rescue Media

Found here...

Macrium Reflect X

knowledgebase.macrium.com

starchase · Sep 10, 2025

Thanks Ghot. But Macrium's instructions are just too confusing in that knowledgebase article or they are not including some missing instructions. Ultimately Macrium wanted me to uninstall the free program I've been using and then download the paid version, which I won't do. I guess I will now reinstall the free version - I have a copy of it somewhere on my machine.

KevTech · Sep 10, 2025

I just did the following in this post and all rescue media work fine with 2011 revoked.

Act now: Secure Boot certificates expire in June 2026

UPDATE: https://www.elevenforum.com/t/updating-microsoft-secure-boot-keys-before-expiration-in-june-2026.22477/ Windows IT Pro Blog: Prepare for the first global large-scale certificate update to Secure Boot. The Microsoft certificates used in Secure Boot are the basis of trust for operating...

www.elevenforum.com

starchase · Sep 10, 2025

Thanks KevTech. I did that. I.E., I loaded MiniTool Partition Mgr and changed the is partition which had no letter to read S: and then, which the Rescue USB was still pluggged in, I opened Terminal (Adminitrator) ran the instructions in the link you provided:

Code:

copy S:\EFI\Microsoft\Boot\bootmgfw.efi c:\bootmgfw_2023.efi

Then I went to C: and located the file bootmgfw_2023.efi renamed it to bootx64.efi then replaced the current bootx64.efi file on Rescue USB which was at "D:\efi\boot\bootx64.efi" with the updated file.

I restarted the computer to check that the Rescue Disk would boot and it does.

I must say that when I confirmed that Windows UEFI CA 2023 shows up in EFI DB Certificates I also see that the 2011 certificate is still not banned in the DBX location. So, of course the new Rescue Media will boot.

The real test is when the 2011 certificate becomes invalid whill the Rescue Media do what I'm hoping it will do. Here is the result of me running

Code:

powershell -nop -ep bypass -f Check_EFIBootFileUpdated.ps1

Code:

PS C:\WINDOWS\system32> cd c:\temp
PS C:\temp> powershell -nop -ep bypass -f Check_EFIBootFileUpdated.ps1
Secure Boot: ENABLED

EFI DB Certificates
-------------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Windows UEFI CA 2023

EFI KEK Certificates
--------------------
    Microsoft Corporation KEK CA 2011

EFI DBX Certificates
--------------------

AvailableUpdates: 0x2
---------------------
    Install the updated certificate definitions to the DBX.
Mount the EFI partition to label X:
Validate that X:\EFI\Microsoft\Boot\bootmgfw.efi file is signed by the Microsoft Windows Production PCA 2011 certificate!
Unmount X: EFI partition!

EFI Files
---------
Boot Manager [Microsoft Windows Production PCA 2011] on Disk  is allowed.

Boot File [Microsoft Windows Production PCA 2011] on USB (D:) is allowed.
PS C:\temp>

garlin · Sep 10, 2025

Can you do me a favor, and try this updated version of my script (not the same as the one you posted)?

I want to see what the output is for the USB drive. Thanks!

Steve C · Sep 11, 2025

Is there a need to take any action? Surely Microsoft and Macrium will issue updates?

suatcini54 · Sep 11, 2025

garlin said:
Can you do me a favor, and try this updated version of my script (not the same as the one you posted)?

I want to see what the output is for the USB drive. Thanks!

Thanks for your upgraded script. Below is my output after running your script, if you are interested.

By the way, is there a way to update MS Corp KEK CA 2011 to something KEK 2023 and revoke KEK 2011 ? My M/B is too old and Asus will not release updated certificates for it.

garlin · Sep 11, 2025

suatcini54 said:
By the way, is there a way to update MS Corp KEK CA 2011 to something KEK 2023 and revoke KEK 2011 ? My M/B is too old and Asus will not release updated certificates for it.

You can manually import the MS KEK CA 2023 certificate:

1. Download the cert from Microsoft's Secure Boot Objects Github:
https://raw.githubusercontent.com/microsoft/secureboot_objects/refs/heads/main/PreSignedObjects/KEK/Certificates/microsoft corporation kek 2k ca 2023.der

2. Mount the EFI partition, and copy it over:

Code:

mountvol S: /s
copy "'microsoft corporation kek 2k ca 2023.der" S:\EFI

3. From the BIOS, enter Secure Boot setup and enroll a new KEK certificate. You should be given a choice of disk locations, one of them being your EFI partition. Browse the folders and select the copied cert.

4. After confirming the KEK CA 2023 is installed, you can delete the DER file from the EFI partition.

starchase · Sep 11, 2025

garlin said:
Can you do me a favor, and try this updated version of my script (not the same as the one you posted)?

I want to see what the output is for the USB drive. Thanks!

Hi Garlin. Here is my output as requested.

Code:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows

PS C:\WINDOWS\system32> cd c:\temp
PS C:\temp> powershell -nop -ep bypass -f Check_EFIBootFile.ps1
Secure Boot: ON                                                                                                         BitLocker on (C:) OFF                                                                                                                                                                                                                           UEFI KEK Certs                                                                                                          --------------
    Microsoft Corporation KEK CA 2011

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Windows UEFI CA 2023

UEFI DBX Certs
--------------

EFI Files
---------
    Disk 0: Boot Manager [Production PCA 2011] is ALLOWED.

    Registry: WindowsUEFICA2023Capable = 1
        [Windows UEFI CA 2023] is in UEFI DB.

Bootable Media
--------------
    USB D: "MACRIUMBOOT"
        Boot File [Production PCA 2011] is ALLOWED.
There is no matching image.

PS C:\temp>

garlin · Sep 11, 2025

Thanks. Because your DB has both CA 2011 & 2023, and hasn't yet banned 2011, then you can boot from both old or new media.

If you revoked the CA 2011 (by adding it to DBX), then you will have to update the boot files on both Windows and Macrium. Since MS won't force that step until 2026 by the earliest, you're good for now.

You can try replacing the boot file on the Macrium drive with the CA 2023 version, and see if that boots. The worse case is it doesn't, and you can move the backed up boot file into its original filename.

Scott · Sep 15, 2025

starchase said:
The real test is when the 2011 certificate becomes invalid will the Rescue Media do what I'm hoping it will do.

KevTech's method will still work. I have revoked CA 2011 and can boot USB media with Secure Boot on.

Winuser · Sep 15, 2025

The little I have done with the certificates is as far as I'm going to go. Have the old certificates been revoked? I have no Idea. The only thing I do know for sure is that when I run the command posted on another thread on my two desktops it comes back as true. I decided I'm not going any farther and will let MS and any third party programs make the necessary changes. If they don't., I know how to go into the BIOS and turn off and on Secure boot if or when needed.

Steve C · Sep 16, 2025

Winuser said:
The little I have done with the certificates is as far as I'm going to go. Have the old certificates been revoked? I have no Idea. The only thing I do know for sure is that when I run the command posted on another thread on my two desktops it comes back as true. I decided I'm not going any farther and will let MS and any third party programs make the necessary changes. If they don't., I know how to go into the BIOS and turn off and on Secure boot if or when needed.

Same here - users should not have to fiddle with this stuff.

garlin · Sep 17, 2025

Could I get a few volunteers to test this new PS script? I checks your USB boot media, and pretends to copy the right boot file (but nothing gets copied).

Here's the conditions it checks for:

- Running Windows 24H2 or later (26000+)

- July 2025 Monthly Update .4652 or later (as suggested by MS)

- Secure Boot is on

- Your boot file is not allowed by the current combination of DB and DBX certs

If you have already updated your USB drives like @KevTech or @Scott, it's not going to be anything interested.
I'm looking for users who haven't touched their USB recovery drives yet.

Solved Reflect Boot Media After UEFI CA 2011 Revocation

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

Similar threads

My Computers

My Computer

My Computers

My Computers

My Computers

My Computer

My Computers

My Computers

My Computer

My Computers

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer

My Computer