Windows 2023 UEFI Certificate Authority Firmware Update Nudge (FUN) Utility

The UEFI FUN Utility attached will help drive Windows forward in making changes to the system firmware including certificate databases.

It will also log actions and the current state of the system.

Switches:

-Report Only

-Silent

-Verbose

This utility has been tested on:

Depending on the system state the utility may:

Set the registry value of HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot > AvailableUpdates to 0x5944
Run the scheduled task \Microsoft\Windows\PI\Secure-Boot-Update. This scheduled task usually runs every 12 hours by default

Most systems will need 1-3 reboots to completely finish the update process. FUN will not reboot the system.

User Actions Required
Secure Boot Not Enabled (Enable UEFI Boot, Disable CSM, Enable Secure Boot)	5010
Secure-Boot-Update Scheduled task is not installed	5011
Secure-Boot-Update Scheduled task is currently running, run FUN again after 5 minutes	5021
System state undetermined. Run FUN again after 5 minutes	5031
System state undetermined. Run FUN again after 5 minutes. The process may be stalled and the system firmware may be incapable of permanently storing the CA Certificate update	5032
RestartRequiredForVSMBFSVCAI Reboot Required	5041
RestartRequiredForVSM Reboot Required	5042
RestartRequiredForVSMBFSVCAI and RestartRequiredForVSM Reboot Required	5043

Nudge Status
No further action required	5000
Known Unsupported Motherboard	5005
Nudged with Registry and Scheduled Task	5050
Nudged with Scheduled Task	5051
Nudged disabled but needed	5052

Note: Before deploying this utility, test it on a sample of different computers/servers/virtual machines first for any unexpected adverse effects

Applies to: