PowerShell: Using the -Decoded parameter in Get-SecureBootUEFI

Introduction

The Get-SecureBootUEFI PowerShell cmdlet retrieves UEFI Secure Boot variables such as PK, KEK, DB, and DBX. These variables normally return raw binary data, which can be difficult to interpret directly.

The new -Decoded parameter provides a more accessible view of this information.

What does the -Decoded parameter do?

When you use the -Decoded parameter, the cmdlet displays the contents of Secure Boot databases in a human-readable format. Instead of raw bytes, it decodes and presents the underlying data, including certificates, hashes, and associated metadata stored in UEFI authenticated variables.

With the -Decoded parameter, the output includes readable certificate information such as:

• Subject (for example, Microsoft Windows Production PCA 2011)

• Algorithm and version

• Serial number

• Validity period

This makes it easier to:

• Inspect Secure Boot items such as certificates, hashes, and public keys

• View certificate properties such as subject, issuer, and validity dates

• More easily understand what is trusted in PK, KEK, and DB, and what is revoked in DBX without additional parsing

Example

Command usage in PowerShell​​​​​​​:

Command returns:

When to use it

Use the -Decoded parameter when you need to analyze or validate Secure Boot configuration, rather than retrieve their raw values.

Learn more

For full cmdlet details, parameters, and additional examples, see the Get-SecureBootUEFI documentation.