Windows Server 202X - Unable to update Windows Boot Manager with the Windows UEFI CA 2023 Certificate

Hello Brian.

Thank you for your answer.

After following your suggestions, the result was unfortunately the same.

The BIOS I'm using is the latest one.

Here are the commands you've suggested:

1)

2)

Restart computer 2x.

3)

Check logs of Event Viewer (events 1796 and 1801). There are no 1796 events.

There are multiple 1801 events, but they are old - probably from when I first started trying to resolve this issue.

4)

Check logs of Event Viewer (events 1808). As you can see below, there are many recent 1808 events.

Event 1808:

This is an informational event that indicates that the device has the required new Secure Boot certificates applied to the device’s firmware. This event will be logged when all needed certificates have been applied to the firmware, and the boot manager has been updated to the boot manager signed by the “Windows UEFI CA 2023” certificate.

5)

BitLocker was (and still is) disabled on all drives as you can see below.

6)

So now, let's check the status of Boot Manager.

7)

Some more system information (maybe useful for debugging) provided below.

I would also like to add that I tested another machine (an ASUS motherboard system running Windows Server 2022), and the behavior is exactly the same.

Is there a way to “force” Windows to apply the new 2023 certificates to the Boot Manager?

Thank you for your help.

Has anyone encountered a similar issue?

Any guidance / suggestion would be appreciated.

Hello again AgostinhoCarvalho, thank you for providing the screenshot, the event logs, and for taking the extra step to test.

The great news is that your systems are actually already updated to the Windows UEFI CA 2023 certificate. You do not need to force the update again.

The discrepancy you are seeing is caused by a known limitation in the cmdlet you are using, with how the updated Windows boot manager is signed. If you look at your PowerShell screenshot, the SignatureType returned is Catalog. The bootmgfw.efi file is dual-signed to ensure backward compatibility. The Get-AuthenticodeSignature parses the catalog signature first and ignores the newly 2023 certificate underneath.

Please run the following alternative checks in your PowerShell:

Get-PfxCertificate -FilePath "S:\EFI\Microsoft\Boot\bootmgfw.efi" | Format-List Subject, Issuer

You should now see the Issuer correctly listed as CN=Windows UEFI CA 2023. (Alternatively, if you copy bootmgfw.efi to your desktop and check the Digital Signatures tab in Properties via the Windows GUI, it will correctly enumerate both signatures).

Windows maintains the true internal status of this multi-stage Secure Boot update in the registry. You can verify your system's compliance by querying the servicing keys:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" | Select-Object UEFICA2023Status, WindowsUEFICA2023Capable

If your system is fully mitigated, you will see UEFICA2023Status as Updated, and WindowsUEFICA2023Capable as 2.

Hello Brian,

Thank you very much for the clarification.

Using your cmdlet does indeed return "Windows UEFI CA 2023" as expected. Perfect!

Do you know why Windows did not also update the copy located at:

C:\Windows\Boot\EFI\bootmgfw.efi

It appears that only the following file was updated:

S:\EFI\Microsoft\Boot\bootmgfw.efi

I was going to attach screenshots, but the AI engine's content filter keeps blocking them.

PS C:\WINDOWS\system32> Get-PfxCertificate -FilePath "S:\EFI\Microsoft\Boot\bootmgfw.efi" | Format-List
Subject      : CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Issuer       : CN=Windows UEFI CA 2023, O=Microsoft Corporation, C=US
Thumbprint   : F3ED77AFE4B3AF38DB5D53CD9D2BA28B9AB65CD1
FriendlyName :
NotBefore    : 3/5/2026 7:56:22 PM
NotAfter     : 3/3/2027 7:56:22 PM
Extensions   : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid...}
PS C:\WINDOWS\system32> Get-PfxCertificate -FilePath "S:\EFI\Boot\bootx64.efi" | Format-List
Subject      : CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Issuer       : CN=Windows UEFI CA 2023, O=Microsoft Corporation, C=US
Thumbprint   : F3ED77AFE4B3AF38DB5D53CD9D2BA28B9AB65CD1
FriendlyName :
NotBefore    : 3/5/2026 7:56:22 PM
NotAfter     : 3/3/2027 7:56:22 PM
Extensions   : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid...}
PS C:\WINDOWS\system32> Get-PfxCertificate -FilePath "C:\Windows\Boot\EFI\bootmgfw.efi" | Format-List
Subject      : CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Issuer       : CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Thumbprint   : CB320963BE64DA2B008DE9C867030771E79EE3F0
FriendlyName :
NotBefore    : 10/16/2025 7:02:07 PM
NotAfter     : 10/17/2026 7:02:07 PM
Extensions   : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid...}
PS C:\WINDOWS\system32> Get-FileHash "S:\EFI\Microsoft\Boot\bootmgfw.efi","C:\Windows\Boot\EFI\bootmgfw.efi" | Select-Object Path, Hash
Path                               Hash
----                               ----
S:\EFI\Microsoft\Boot\bootmgfw.efi 200D1E3A6A0DE342A5091654C0E62A434E38D467ADD78057B60A1FDBFC8EF101
C:\Windows\Boot\EFI\bootmgfw.efi   456DE3C04EA6A39B03964181E23A725E9A27A1097D79D02355CBA0A061BD96C1

I also checked the registry key (like you suggested). Seems to be fine.

PS C:\Users\Administrator> bcdedit /enum bootmgr
Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=S:
path                    \EFI\Microsoft\Boot\bootmgfw.efi
description             Windows Boot Manager
locale                  en-US
inherit                 {globalsettings}
bootshutdowndisabled    Yes
default                 {current}
resumeobject            {486653d0-5b59-11f1-b78f-ea5139246854}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30
PS C:\Users\Administrator>
PS C:\Users\Administrator>
PS C:\Users\Administrator>
PS C:\Users\Administrator> Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" | Select-Object UEFICA2023Status, WindowsUEFICA2023Capable
UEFICA2023Status WindowsUEFICA2023Capable
---------------- ------------------------
Updated                                 2

Thank you very much for your help.

Best regards.