OS Engineering on Zubair | Intune | OS Engineering

PowerShell: Check Secure Boot 'Windows UEFI CA 2023' status on a device

Sat, 03 Oct 2026 10:00:00 +0530

The Microsoft Secure Boot certificates from 2011 start expiring in 2026, and devices need the Windows UEFI CA 2023 certificate in their Secure Boot DB before that happens. When you’re tracking this across a large fleet, the first thing you need is a quick, read-only answer per device: is Secure Boot on, and is the 2023 CA already in the DB?

DISM: Inject drivers into a Windows image offline

Sun, 20 Sep 2026 10:00:00 +0530

Adding storage and network drivers to the image offline saves you from the classic “no disks found” or “no network in WinPE” moments on new hardware. The workflow is the same for install.wim and boot.wim.