Set-SecureBootUEFI

Set-SecureBootUEFI
    -Name <String>
    -Time <String>
    [-ContentFilePath <String>]
    [-SignedFilePath <String>]
    [-AppendWrite]
    [-OutputFilePath <String>]
    [<CommonParameters>]

Set-SecureBootUEFI
    -Name <String>
    -Time <String>
    [-Content <Byte[]>]
    [-SignedFilePath <String>]
    [-AppendWrite]
    [-OutputFilePath <String>]
    [<CommonParameters>]

The Set-SecureBootUEFI cmdlet takes a formatted content object that is created by running the Format-SecureBootUEFI cmdlet and a signed file, combines the two and then attempts to set the package in one of the Secure Boot variables. The supported Secure Boot variables include Platform Key (PK), Key Exchange Key (KEK), Signature Database (DB), and Forbidden Signature Database (DBX).

If successful, this cmdlet returns a UEFIEnvironmentVariable object. Otherwise, it displays an error.

This cmdlet runs on both UEFI and BIOS (non-UEFI) computers. If the computer does not support Secure Boot or is a non-UEFI computer, this cmdlet displays the following:

Cmdlet not supported on this platform.

If you do not run Windows PowerShell® in administrator mode, this cmdlet displays the following:

Unable to set proper privileges. Access was denied.

If you supply a signed file to this cmdlet that is not valid, this cmdlet displays the following:

Incorrect authentication data.

PS C:\> $ObjectFromFormat = ( Format-SecureBootUEFI -Name DBX -SignatureOwner 12345678-1234-1234-1234-123456789abc -Algorithm SHA256 -Hash 0011223344556677889900112233445566778899001122334455667788990011 -SignableFilePath GeneratedFileToSign.bin -Time 2011-11-01T13:30:00Z -AppendWrite )
PS C:\> .\signtool.exe sign /fd sha256 /p7 .\ /p7co 1.2.840.113549.1.7.1 /p7ce DetachedSignedData /a /f PrivateKey.pfx GeneratedFileToSign.bin
PS C:\> $ObjectFromFormat | Set-SecureBootUEFI -SignedFilePath GeneratedFileToSign.bin.p7
Name       : dbx
Bytes      : {161, 89, 192, 165...}
Attributes : NON VOLATILE
             BOOTSERVICE ACCESS
             RUNTIME ACCESS
             TIME BASED AUTHENTICATED WRITE ACCESS

This example sets the information obtained from the Format-SecureBootUEFI cmdlet to the DBX UEFI variable.

The first command supplies a path to the signed package to be authenticated. The file named GeneratedFileToSign.bin is a digest created by the Format-SecureBootUEFI cmdlet that needs to be signed according to the UEFI specification.

The second command runs the SignTool.exe tool from the current directory to sign the digest. The SignTool.exe tool can be downloaded from Windows Software Development Kit (SDK) for Windows 8 on MSDN.

The third command sets the information.

PS C:\> Set-SecureBootUEFI -ContentFilePath FormattedVariable.bin -SignedFilePath GeneratedFileToSign.bin.p7
Name       : dbx
Bytes      : {161, 89, 192, 165...}
Attributes : NON VOLATILE
             BOOTSERVICE ACCESS
             RUNTIME ACCESS
             TIME BASED AUTHENTICATED WRITE ACCESS

This command sets the formatted data that was written to file FormattedVariable.bin to the DBX UEFI variable. This cmdlet supplies a path to the signed package to be authenticated.

PS C:\> $objectFromFormat = ( Format-SecureBootUEFI -Name DB -SignatureOwner 12345678-1234-1234-1234-123456789abc -Time 2011-11-01T13:30:00Z -CertificateFilePath db.cer -FormatWithCert )
PS C:\> $objectFromFormat | Set-SecureBootUEFI
Name       : db
Bytes      : {161, 89, 192, 165...}
Attributes : NON VOLATILE
             BOOTSERVICE ACCESS
             RUNTIME ACCESS
             TIME BASED AUTHENTICATED WRITE ACCESS

This example creates formatted data that is not signed and sets the unsigned data into the UEFI variable named db.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

This command accepts a UEFIFormattedVariable object that contains the information for the Name, Time, Content, and AppendWrite parameters.

This cmdlet returns a UEFIEnvironmentVariable object that contains the following properties:

• Name
• Guid
• Bytes
• Attributes