function checkSecureBoot {
  if ((Get-Command Confirm-SecureBootUEFI -ErrorAction  SilentlyContinue) -ne $null) {
    try {
      return Confirm-SecureBootUEFI
    }
    catch {
      return $false
    }
  }
  return $false
}

if (CheckSecureBoot) {
  Write-Host "SecureBoot: ON" 
} else {
  Write-Host "SecureBoot: OFF"
  exit 0
}

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" -Name "AvailableUpdates" -Value 0x40
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
  Write-Host "Updaed SecureBoot DB! please reboot twice."
exit 0