@pm67310 If I try Rufus with an ISO from Microsoft the following warning appears: Rufus detected that the ISO you have selected contains a UEFI bootloader that has been revoked and that will produce a "Security Violation" screen, when Secure Boot is enabled on a fully up to date UEFI system. - If you obtained this ISO image from a non reputable source, you should consider the possibility that it might contain UEFI malware and avoid booting from it. - If you obtained it from a trusted source, you should try to locate a more up to date version, that will not produce this warning. There is not a more up to date version of the ISO. If I run this script, select the ISO and Verify Signature (2011 vs 2023), I get: Certificate (Issuer CN) detected: Microsoft Windows Production PCA 2011 OUTDATED: Bootloader signed by 'Microsoft Windows Production PCA 2011'. If I perform a media update, select Windows_UEFI2023.iso and Verify Signature (2011 vs 2023), I get: Certificate (Issuer CN) detected: Windows UEFI CA 2023 VALID: Bootloader signed by 'Windows UEFI CA 2023'. However, if I try Rufus again with Windows_UEFI2023.iso, the same message as above appears. Shouldn't the script fix this problem?
This update tool doesn't check for the boot manager's SVN version If you have executed the PCA 2011 revocation, there will be a SVN registered in the DBX. When booting, the Windows boot manager will confirm if its own SVN number (found in the EFI file's .rsrc region) matches or is higher than the DBX's SVN number. If not, the boot manager will voluntarily exit with a violation error. This is done to prevent rollbacks of the boot manager to an earlier (and more vulnerable) file version. So it's not simply a matter of confirming if the boot manager has a Windows UEFI CA 2023 cert. You can use the Get-SecureBootSVN cmdlet (available on W10/11 systems to examine a boot file's SVN. Code: Get-SecureBootSVN -BootManagerPath C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi FirmwareSVN : 9.0 BootManagerSVN : 9.0 StagedSVN : 9.0 ComplianceStatus : Compliant (Boot Manager SVN meets staged SVN) BootManagerPath : C:\Windows\Boot\EFI_EX\bootmgfw_EX.efi Get-SecureBootSVN -BootManagerPath bootmgfw_EX.efi FirmwareSVN : 9.0 BootManagerSVN : 7.0 StagedSVN : 9.0 ComplianceStatus : Not compliant BootManagerPath : C:\Users\12LBTURKEY\Downloads\bootmgfw_EX.efi