A device that still carries the 2011 Secure Boot certificates keeps starting after they expire, according to Microsoft, and that’s exactly why this job is easy to leave until it’s awkward. Microsoft’s pages describe no boot failure on the day, so nothing forces a decision. What does happen is that those machines can no longer receive new protection for the earliest stage of boot, and in a mixed estate of laptops, servers and virtual machines, closing that gap is a firmware question as much as a Windows one.
What’s expiring, and when
Microsoft’s certificate expiration page lists three 2011 certificates, each with a replacement, and the dates fall in two clusters: the first two within days of each other in June and the third in October.
| 2011 certificate | Expires | 2023 replacement | What it does |
|---|---|---|---|
| Microsoft Corporation KEK CA 2011 | 24 June 2026 | Microsoft Corporation KEK 2K CA 2023 | Signs updates to the DB and DBX |
| Microsoft UEFI CA 2011 | 27 June 2026 | Microsoft UEFI CA 2023, and Microsoft Option ROM UEFI CA 2023 | Third-party boot loaders and EFI applications, and third-party option ROMs |
| Microsoft Windows Production PCA 2011 | 19 October 2026 | Windows UEFI CA 2023 | Signs the Windows boot loader |
A machine is affected if it holds any of the old versions, and both the DB and the KEK need the 2023 certificates. In practice that means the update has to reach the firmware, which Windows can only do with the firmware’s cooperation. Without it, the page says, a device carries on booting and installing ordinary Windows updates but can’t receive new boot manager updates, DB and DBX updates or revocation lists.
Finding out what you have
Start with whether Secure Boot is on at all, because Microsoft’s IT professional guidance says the update steps don’t apply if it isn’t. Confirm-SecureBootUEFI run in PowerShell returns True when it’s on, and the page suggests your management tooling for doing that across a fleet.
For status, the documented signals are a registry value and two events. UEFICA2023Status, under HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing, reads NotStarted, InProgress or Updated, according to the registry key article. In the System log, event 1801 means the new certificates haven’t reached the firmware, and event 1808 means the device has them along with a boot manager signed by the Windows UEFI CA 2023. The event reference lists the rest, and the IT guidance links a sample inventory script, which you should read before you run it anywhere.
The part people skip is grouping what you find. The IT guidance suggests building a sample by manufacturer, model and BIOS version and date, and testing four or more devices from each unique category. We’d treat this grouping as the real inventory, because the result is likely to be decided by the firmware family and not by the Windows build. For a small office, a spreadsheet of model, firmware version and status for each machine is enough to work from. Once you have several hardware families, or a mix of physical and virtual machines, the grouping decides your pilot, and it’s worth having your management tooling report the registry value and events rather than collecting them by hand.
What depends on your hardware vendor
The troubleshooting page on Microsoft Learn says to update firmware first, particularly on older models, and lists outdated firmware as a higher-risk case (along with updates that don’t apply correctly), with BitLocker recovery prompts (including repeated ones), startup hangs and machines that won’t boot. So the questions that only a vendor can answer are worth asking early, and in writing: is there a firmware release for this model that supports the update, and is it still supported at all?
The event log will flag some of the machines in trouble, but not all of them. Events 1795, 1802 and 1803 each point to the manufacturer: a firmware error, a known firmware or hardware issue, and no PK-signed KEK found. A machine that shows none of them hasn’t been shown to be safe. The page also says older devices that the manufacturer no longer supports may not process the update correctly, and suggests replacement where the firmware can’t be fixed. That’s a budget conversation, so it’s better to have it before October.
Servers, virtual machines and templates
Windows PCs can get the 2023 certificates through Microsoft’s managed routes (the cumulative-update high-confidence group, or the opt-in Controlled Feature Rollout, which needs diagnostic data), but Microsoft says you can’t rely on them to cover a whole fleet. Windows Servers don’t get the rollout at all, according to the Windows Server blog, so someone has to start the update on every in-scope server. The post says many newer server and virtual machine versions, built since 2024 and almost all of those released in 2025, are already preconfigured with the 2023 certificates. It lists no models, so you still need to check rather than assume.
For virtual machines, the IT guidance describes two routes. The platform supplier can provide updated virtual firmware, which suits new machines, and long-running ones can be updated through Windows if the virtual firmware supports it. Ask your platform vendor which applies, because we can’t tell you from outside. Templates are the quiet trap. Microsoft’s guidance for Azure Virtual Desktop says to update a Secure Boot-enabled source image and check UEFICA2023Status before generalising it. Images without Trusted Launch can’t receive the certificates through the image, so there the update has to be applied inside each deployed machine. So check every template platform rather than assume: after cloning, look at UEFICA2023Status and the firmware on a clone.
If you dual-boot Linux, or run it in a guest with Secure Boot on, be careful. The expiry table says the UEFI CA 2011 signs third-party boot loaders, which, as far as we can tell, usually includes distribution loaders. Microsoft’s pages give no Linux procedure, so take that question to your distribution vendor before you touch a machine you can’t easily recover.
Updating, and testing first
The Microsoft Learn page lists Intune, registry keys, Configuration Service Provider settings and Group Policy as supported methods. Microsoft’s pages don’t agree on whether Group Policy and the CSP are available yet, so check the current state of the method you intend to use. Don’t mix methods on one device. With the registry method, setting AvailableUpdates to 0x5944 is the documented trigger. A scheduled task then works through the certificates in order and finishes with the new boot manager, which waits for a restart. Allow about 48 hours and at least one restart per device.
BitLocker deserves its own check. Event 1032 means the BitLocker configuration would force recovery if the update were applied, and Microsoft’s remedy is to suspend protection on the system drive for two restart cycles and then re-enable it. Suspending the protector switches the drive’s BitLocker protection off for that period, so plan it, agree it and check it against Microsoft’s current steps before anyone does it. Before any pilot, make sure you can retrieve a recovery key for each machine in it, because the first time a machine asks for one shouldn’t be the moment you learn you can’t find it.
For the pilot, Microsoft advises including several manufacturers, several firmware versions and BitLocker-enabled devices, then confirming a successful status, no boot problems and no unexpected recovery prompts. It also advises monitoring before you deploy and expanding in stages. We’d add two habits: include one machine per template or image, and keep console or out-of-band access to anything you can’t walk up to.
The work sits awkwardly between patching, firmware and hardware replacement, which is how jobs like it get lost, and it suits the kind of recurring routine that continuing support is arranged around. Outside help is justified mainly when nobody owns the conversation with the firmware or virtual platform vendors, or when a pilot would touch machines you can’t easily recover.
If you’re not sure which of your models will turn out to have no firmware answer, or what a pilot across your physical and virtual machines should include, get in touch and we can work through it with you.
