Set-SecureBootUEFI
Sets the Secure Boot-related UEFI variables such as Platform Key, Key Exchange Key, Signature Database and Forbidden Signature Database.
Syntax
Set-SecureBootUEFI
-Name <String>
[-ContentFilePath <String>]
[-SignedFilePath <String>]
-Time <String>
[-AppendWrite]
[-OutputFilePath <String>]
[<CommonParameters>]
Set-SecureBootUEFI
-Name <String>
[-Content <Byte[]>]
[-SignedFilePath <String>]
-Time <String>
[-AppendWrite]
[-OutputFilePath <String>]
[<CommonParameters>]
Description
The Set-SecureBootUEFI cmdlet takes a formatted content object that is created by running the Format-SecureBootUEFI cmdlet and a signed file, combines the twos and attempts to set the package in one of the Secure Boot variables. The supported Secure Boot variables include Platform Key (PK), Key Exchange Key (KEK), Signature Database (DB), and Forbidden Signature Database (DBX).
This cmdlet returns an UEFIEnvironmentVariable object if successful, otherwise displays an error.
This cmdlet runs on both UEFI and BIOS (non-UEFI) computer.If the computer does not support Secure Boot or is a non-UEFI computer, then this cmdlet returns an error displaying the following: Cmdlet not supported on this platform.
If Windows PowerShell® is not run in administrator mode, then this cmdlet returns an error displaying the following: Unable to set proper privileges. Access was denied.
If the signed file supplied to this cmdlet is not valid, then this cmdlet returns an error displaying the following: Incorrect authentication data.
Examples
EXAMPLE 1
@{navigationLink=@{uri=http://go.microsoft.com/fwlink/p/?LinkId=236500; linkText=Windows Software Development Kit (SDK) for Windows 8}; #text=System.Management.Automation.PSObject[]}
This example sets the information obtained from the Format-SecureBootUEFI cmdlet to the DBX UEFI variable. This cmdlet supplies a path to the signed package to be authenticated. The file named GeneratedFileToSign.bin is a digest created by the Format-SecureBootUEFI cmdlet that needs to be signed according to the UEFI specification.
EXAMPLE 2
PS C:\> Set-SecureBootUEFI -ContentFilePath FormattedVariable.bin -SignedFilePath GeneratedFileToSign.bin.p7
Name : dbx
Bytes : {161, 89, 192, 165...}
Attributes : NON VOLATILE
BOOTSERVICE ACCESS
RUNTIME ACCESS
TIME BASED AUTHENTICATED WRITE ACCESS
This example sets the formatted data that was written to file FormattedVariable.bin to the DBX UEFI variable. This cmdlet supplies a path to the signed package to be authenticated.
EXAMPLE 3
PS C:\>$objectFromFormat = ( Format-SecureBootUEFI -Name DB -SignatureOwner 12345678-1234-1234-1234-123456789abc -Time 2011-11-01T13:30:00Z -CertificateFilePath db.cer -FormatWithCert )
PS C:\>$objectFromFormat | Set-SecureBootUEFI
Name : db
Bytes : {161, 89, 192, 165...}
Attributes : NON VOLATILE
BOOTSERVICE ACCESS
RUNTIME ACCESS
TIME BASED AUTHENTICATED WRITE ACCESS
This example creates formatted data that is not signed and sets the unsigned data into the UEFI variable named db.
Parameters
-AppendWrite
Indicates that the contents of the current variable are appended instead of overwritten.
Type: | SwitchParameter |
Aliases: | append |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | True |
Accept wildcard characters: | False |
-Content
Specifies the byte contents of the variable being set.
Type: | Byte[] |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | True |
Accept wildcard characters: | False |
-ContentFilePath
Specifies the file that contains the contents that is being set to the environment variable.
If only the name is specified, then the file must be in the current working directory; otherwise the full path of the file must be specified.
Type: | String |
Aliases: | f |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-Name
Specifies the name of the UEFI environment variable. The acceptable values for this parameter are: PK, KEK, DB, or DBX.
Type: | String |
Aliases: | n |
Accepted values: | PK, KEK, db, dbx |
Position: | Named |
Default value: | None |
Required: | True |
Accept pipeline input: | True |
Accept wildcard characters: | False |
-OutputFilePath
Specifies the name of the file created that contains the contents of what is set. If this parameter is specified, then the content are not actually set, just stored into this file.
The file is created in the specified path location.
Type: | String |
Aliases: | of |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-SignedFilePath
Specifies the signed data that is paired with the contents that are being set to the environment variable.
If only the name is specified, then the file must be in the current working directory; otherwise the full path of the file must be specified.
Type: | String |
Aliases: | s |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-Time
Specifies the timestamp that is used in the signature.
This parameter value should be formatted as follows so that it will be accepted by the DateTime object.
"2011-11-01T13:30:00Z"
Type: | String |
Aliases: | t |
Position: | Named |
Default value: | None |
Required: | True |
Accept pipeline input: | True |
Accept wildcard characters: | False |
Inputs
Microsoft.SecureBoot.Commands.UEFIFormattedVariable
The UEFIFormattedVariable object contains the information for the Name, Time, Content, and AppendWrite parameters.
Outputs
Microsoft.SecureBoot.Commands.UEFIEnvironmentVariable
The UEFIEnvironmentVariable object contains the following properties:
-- Name
-- Guid
-- Bytes
-- Attributes
Related Links
Feedback
https://aka.ms/ContentUserFeedback.
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see:Submit and view feedback for