So I am currently just wrapping up the UEFI certificate rollout, and it did not go smoothly. Even after having updated countless BIOS' the last few months, the update rolled itself out on about only 70% of machines. The rest needed manual intervention.

-Some needed May BIOS updates

• Some needed me to manually initiate the trigger (shown below)

• I needed to disable bitlocker manually

• It often took multiple tries.

• I still have machines that say the update is in progress (updating the key in the BIOS), but also that it successfully booted from the new certificate. Not sure what is going on here.

• Hyper-V VM's always needed manual deployment. If on the latest configuration, they updated smoothly.

I started the manual process of by first running the following code, and rebooting twice:

Suspend-BitLocker -MountPoint "C:" -RebootCount 2

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" -Name AvailableUpdates -Value 0x5944

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Most of the time this did not complete properly and I had to do it again, but it seems I didn't need to restart the task.

Suspend-BitLocker -MountPoint "C:" -RebootCount 2

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" -Name AvailableUpdates -Value 0x5944

Sometimes it took several tries of this, with nothing changed, to actually take effect.

With the help of AI, I created a script to check:

$ErrorActionPreference = "Stop"

$sbPath      = "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot"
$servicePath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing"

Write-Output "SECURE BOOT CERTIFICATE CHECK"

try {
    $sbEnabled = Confirm-SecureBootUEFI
    if ($sbEnabled -eq $false) {
        Write-Output "Result: [ERROR] Secure Boot is Disabled on this endpoint."
        exit 2
    }
    Write-Output "[INFO] Secure Boot is currently ENABLED."
} catch {
    Write-Output "Result: [ERROR] System does not support UEFI or Secure Boot is entirely unconfigured."
    exit 3
}

if (Test-Path $servicePath) {
    $statusValue = (Get-ItemProperty -Path $servicePath -Name "UEFICA2023Status" -ErrorAction SilentlyContinue).UEFICA2023Status
    $capableValue = (Get-ItemProperty -Path $servicePath -Name "WindowsUEFICA2023Capable" -ErrorAction SilentlyContinue).WindowsUEFICA2023Capable
    $errorValue = (Get-ItemProperty -Path $servicePath -Name "UEFICA2023Error" -ErrorAction SilentlyContinue).UEFICA2023Error

    Write-Output "[INFO] UEFICA2023Status: $statusValue"
    Write-Output "[INFO] WindowsUEFICA2023Capable: $capableValue"

    if ($errorValue) {
        Write-Output "[WARNING] Secure Boot Update Error Detected: $errorValue"
    }

    if ($statusValue -eq "Updated") {
        Write-Output "Result: COMPLIANT (The Windows UEFI CA 2023 Certificate is successfully applied.)"
        exit 0
    } elseif ($statusValue -eq "PackageInstalled") {
        Write-Output "Result: [ERROR] Stage 1 Complete. Endpoint requires a reboot cycle to write to UEFI nvram."
        exit 5
    } else {
        Write-Output "Result:[ERROR] The 2023 Certificate has not been deployed to this machine."
        exit 4
    }
} else {
    # Check if the baseline Microsoft update staging key is configured
    $availableUpdates = (Get-ItemProperty -Path $sbPath -Name "AvailableUpdates" -ErrorAction SilentlyContinue).AvailableUpdates
    Write-Output "[INFO] AvailableUpdates Mask: $availableUpdates"

    Write-Output "Result: [ERROR] Secure Boot Servicing paths do not exist. KB fixes or update flags are missing."
    exit 9
}

I still have a few machines that are not taking it (probably missing BIOUS updates), but 99% of the ones I've manually tried have worked this way.

I would just plan on a lot of reboots. If it fails, trying again will likely succeed.