Secure Boot CA2023¶
Invoke-SecureBootRemediation.ps1¶
Synopsis: Audits and remediates expiring Secure Boot certificates (CA 2023) on Windows Servers — physical machines, Hyper-V VMs, and VMware VMs.
The original 2011 Secure Boot certificates, stored in UEFI firmware (the KEK and DB databases), expire during 2026 (per Microsoft KB5062710). Once expired, a server keeps booting but stops receiving new boot-chain protections — Boot Manager updates, DBX revocations, and mitigations for newly discovered boot-level vulnerabilities — which gradually weakens anything that relies on Secure Boot trust, including BitLocker hardening and third-party bootloaders.
Having the new certificates in KEK/DB isn't enough on its own: the update only
counts as complete once AvailableUpdates is 0x0/0x4000,
UEFICA2023Status is Updated, and — critically — Boot Manager
(bootmgfw.efi) itself has been verified to use the 2023 CA, which only takes
effect after a reboot; the script checks this directly on the file.
Requires Windows PowerShell 5.1+ as Administrator and a Windows build from 2025-10-14 or later (KB5066835 — without it, the servicing registry keys and scheduled task don't exist yet; the script detects and reports this). No external modules.
The script never reboots the server on its own (except with -AutoRestart).
Each run detects the current state, shows a 4-section report (prerequisites,
certificates, registry, events), and asks before applying remediation; you
then reboot manually and rerun until the status is fully done — the update is
staged across multiple reboots, so this can take more than one pass. If
BitLocker is bound to TPM/PCR7, changing Boot Manager can trigger a recovery
prompt — the script flags this, so verify the recovery key before rebooting.
Tags: SecureBoot, Certificates, Remediation, Security, Windows, Microsoft
Parameters:
| Parameter | Description |
|---|---|
(none) |
Interactive: detect, ask, then remediate. |
CheckOnly |
Detection and status report only, plus an exit code (0 = done, 1 = action needed, 2 = blocked). No changes, no prompt — for RMM/monitoring. |
WhatIf |
Shows what remediation would do, without making any changes. |
AssumeYes |
Skips the confirmation prompt and applies remediation right away, if applicable. |
Force |
Runs remediation even if the required certificates are already present. |
AutoRestart |
Once Boot Manager is staged and waiting for reboot, restarts the server automatically without asking. Reboots immediately. |
EspDriveLetter <X> |
Drive letter for temporarily mounting the ESP while verifying Boot Manager (default S). Change it if S: is already in use on that server. |
Examples:
.\Invoke-SecureBootRemediation.ps1 -CheckOnly
Status check only, for monitoring/RMM — no changes, no prompt.
.\Invoke-SecureBootRemediation.ps1 -WhatIf
Preview of what remediation would do, without making any changes.
.\Invoke-SecureBootRemediation.ps1 -AssumeYes -AutoRestart
Unattended remediation with an automatic reboot once Boot Manager is staged.
Notes
-CheckOnly exit codes: 0 = done, 1 = action needed, 2 = blocked (failed
prerequisite, Secure Boot disabled/unsupported, etc.).
Log: %ProgramData%\SecureBootCA2023\SecureBootRemediation.log.