Powershell scripts to analyze 2023 Secure Boot Certificate 2026-06-29

3 Powershell scripts to analyze & remediate UEFI 2023 Boot Certificate. Exit codes are written to work in the N-Able N-Sight RMM dashboard, but can be easily changed as necessary. No warranty implied, use at your own risk!

1) UEFI_ReplacementCertCheck - This check determines if the computer already has the 2023 UEFI Certificate in the Secure Boot DB and the Secure Boot KEK. If this passes, you are done - no further action necessary

2) UEFI_SecureBoot2023AssessmentRouter - This check determines the remediation action for devices that fail the intitial UEFI_ReplacementCertCheck. Exit 0 means device is compliant. Exit 1001 means remediation steps are necessary and the "$NextAction" variable determines the steps. Possible values are:

• Manual technician review required. Confirm UEFI boot mode and Secure Boot PowerShell support. The device may use Legacy BIOS, may not be booted in UEFI mode, or may not support the required cmdlet. Traps & reports KEK and/or SecureBoot DB stores unable to be read.
• Manual Windows servicing repair required before remediation. TASK-MISSING-OR-DISABLED: Microsoft Secure-Boot-Update scheduled task is missing. Repair Windows servicing before attempting certificate remediation.
• Manual Windows servicing repair required: enable or repair the Secure-Boot-Update scheduled task.
  TASK-MISSING-OR-DISABLED: Microsoft Secure-Boot-Update scheduled task exists but is disabled.
• No action required. COMPLIANT: Windows UEFI CA 2023 is present in DB and Microsoft Corporation KEK 2K CA 2023 is present in KEK.
• Manual OEM/BIOS review required. Do not run UEFI_AutoRemediate again until the firmware issue is resolved. FIRMWARE-BLOCKED: TPM-WMI Event 1795 indicates a Secure Boot firmware or platform servicing failure. (BIOS Update is necessary)
• Manual OEM/BIOS review required. Do not run UEFI_AutoRemediate again until the firmware issue is resolved. FIRMWARE-BLOCKED: TPM-WMI Event 1796 indicates a Secure Boot firmware or platform servicing failure. (BIOS Update is necessary)
• Manual OEM/BIOS review required. Do not run UEFI_AutoRemediate again until the firmware issue is resolved. FIRMWARE-BLOCKED: TPM-WMI Event 1802 indicates Windows blocked the Secure Boot update because of a known firmware or hardware condition. (BIOS Update is necessary)
• Manual OEM/BIOS review required. Do not run UEFI_AutoRemediate again until an OEM-authorized KEK update path is available. FIRMWARE-BLOCKED: TPM-WMI Event 1803 indicates the OEM PK-signed KEK required for this device is unavailable. (BIOS Update is necessary)
• Schedule or await a normal reboot, then rerun the certificate check. Do not run UEFI_AutoRemediate again. REBOOT-AND-RECHECK: Certificate update stages are complete, but the final 2023 Windows Boot Manager stage is pending.
• Do not remediate again. Recheck after the next normal reboot and Microsoft Secure-Boot-Update task cycle. UPDATE-IN-PROGRESS: Secure Boot servicing has pending work.
• Manual technician review required. Microsoft reports the workflow complete, but one or more required certificates are still missing. MANUAL-REVIEW: AvailableUpdates is 0x4000, but the live DB and KEK certificate validation remains incomplete. Confirm the decoded firmware certificate stores and applicable OEM requirements.
• Manual technician review required. The Secure Boot AvailableUpdates state could not be determined. MANUAL-REVIEW: Required certificate(s) are missing, but AvailableUpdates is not present or readable.
• Proceed with controlled UEFI_AutoRemediate re-request. CONTROLLED-RETRY-ELIGIBLE: Required certificate(s) are still missing, AvailableUpdates is 0x0000, servicing reports InProgress, no blocking firmware event or servicing error was found, and no prior controlled retry has been recorded. This means the certificate can be loaded by the next "AutoRemediate" script.

3) UEFI_Autoremediate - This script runs Microsoft's Secure-Boot update scheduled task, and reports back the result.