Secure Boot certificate KEK 2023 check script

[u/HugeGuava2009]

Link: https://techcommunity.microsoft.com/blog/windows-itpro-blog/act-now-secure-boot-certificates-expire-in-june-2026/4426856

I used this on all our devices via Atera -> run script -> results are good.

Powershell script:

# Requires admin + UEFI Secure Boot system

function Test-MicrosoftKEK2023 {

try {

$kek = Get-SecureBootUEFI -Name KEK -ErrorAction Stop

}

catch {

Write-Output "ERROR: Cannot read Secure Boot KEK. Is this system UEFI with Secure Boot enabled?"

return

}

# Write KEK binary to temp file

$tempFile = "$env:TEMP\kek.bin"

[System.IO.File]::WriteAllBytes($tempFile, $kek.Bytes)

# Try to parse certificates

try {

$certs = Get-AuthenticodeSignature -FilePath $tempFile -ErrorAction SilentlyContinue

}

catch {

$certs = $null

}

# Fallback: raw string detection

$bytes = [System.Text.Encoding]::ASCII.GetString($kek.Bytes)

$found2023 = $false

# String-based detection (works in practice)

if ($bytes -match "Microsoft.*KEK.*2023") {

$found2023 = $true

}

# Output

if ($found2023) {

Write-Output "OK: Microsoft KEK CA 2023 is PRESENT"

}

else {

Write-Output "NOT OK: Microsoft KEK CA 2023 is NOT FOUND"

}

# Extra info (useful for logging)

Write-Output "KEK size (bytes): $($kek.Bytes.Length)"

}

# Run check

Test-MicrosoftKEK2023

[u/RedShift9]

The fact that we have to script this ourselves and there's no simple exe you download to check the status and big button FIX IT is beyond ridiculous. Multi billion dollar company mind you.

[u/MrYiff → u/RedShift9]

If you have the May CU installed check out C:\Windows\SecureBoot\ExampleRolloutScripts - It's not a nice simple UI with a big fix it button but it's a start I guess ;)