COMMAND EVERYTHING.

Set-SecureBootUEFI

Sets the Secure Boot-related UEFI variables.

PowerShell · Risk: High · Documentation Verified

Last verified: 2026-10-26

Microsoft SecureBoot reference: Sets the Secure Boot-related UEFI variables. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.

Set-SecureBootUEFI -Name <String> [-ContentFilePath <String>] [-SignedFilePath <String>] -Time <String>
 [-AppendWrite] [-OutputFilePath <String>] [<CommonParameters>]

Copied 0 times

Required permissions

Use an account with the target resource permissions documented for Set-SecureBootUEFI. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.

Supported environments

Windows / SecureBoot · Windows Server 2025 documentation; feature/module prerequisites apply

Parameters

-AppendWrite: Indicates that the contents of the current variable are appended instead of overwritten.
-Content: Specifies the byte contents of the variable that is being set.
-ContentFilePath: Specifies the file that contains the contents that is being set to the environment variable. If you specify only the name, the file must be in the current working directory. Otherwise, specify the full path of the file.
-Name (required): Specifies the name of the UEFI environment variable. The acceptable values for this parameter are: PK, KEK, DB, and DBX.
-OutputFilePath: Specifies the name of the file created that contains the contents of what is set. If you specify this parameter, instead of setting the variable, the cmdlet stores the contents in this file. The file is created in the specified path location.
-SignedFilePath: Specifies the signed data that is paired with the contents that are being set to the environment variable. If you specify only the name, the file must be in the current working directory. Otherwise, specify the full path of the file.
-Time (required): Specifies the timestamp that is used in the signature. Format this value as follows so that it is accepted as a DateTime object: "2011-11-01T13:30:00Z"

Prerequisites

Windows with the SecureBoot module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.

Security considerations

This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.

Examples

Example 2: Set the DBX UEFI variable by using a signed package

Set-SecureBootUEFI -ContentFilePath FormattedVariable.bin -SignedFilePath GeneratedFileToSign.bin.p7

This command sets the formatted data that was written to file FormattedVariable.bin to the DBX UEFI variable. This cmdlet supplies a path to the signed package to be authenticated. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.

Sources

https://github.com/MicrosoftDocs/windows-powershell-docs/blob/b7645dd8c687139b28e845119da30ec670526507/docset/winserver2025-ps/SecureBoot/Set-SecureBootUEFI.md

https://learn.microsoft.com/powershell/module/secureboot/set-securebootuefi?view=windowsserver2025-ps

Personal collections

Explain or customize this command with AI

Related commands