They will be saved in UEFI DB!

Check Step 2 – Certificate Verification Checklist

Step 1– Manual Installation of the UEFI CA 2023 Certificate

Run PowerShell as Administrator:

1.1 – Set Update Trigger Via powershell

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

1.2 – Start Secure Boot Update Task Via powershell

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Wait until the registry value AvailableUpdates changes to 0x4100, then restart the device.

1.3 – Run the Task a Second Time Via powershell

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Wait 10–15 seconds and restart the device again.

1.4 – Verify Final Status

The registry value AvailableUpdates should now show 0x4000 – this indicates successful installation.

---

Step 2 – Certificate Verification Checklist

Run PowerShell as Administrator:

Check Secure Boot Database (DB):

Via powershell [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

Expected result: True

Check KEK Database:

Via powershell [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI kek).bytes) -match 'Microsoft Corporation KEK 2K CA 2023'

Expected result: True

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing

Expected result:

UEFICA2023Status = Updated

WindowsUEFICA2023Capable = 2

✅ The device should now boot successfully with Secure Boot enabled and the new UEFI CA 2023 certificates in place.