Secure boot certificates expire in june 2026

[TwistedHelixis]

I have managed to update most of our clients devices using the reg edit change.

 

Also updated 15 servers. The very last one is stuck on 'In Progress', which annoying.

[flipthebit]

After adding secureboot.admx, enabling the top two settings, and applying it to PCs, once the \Microsoft\Windows\PI\Secure-Boot-Update scheduled task runs (midday?) and the PCs are restarted it'll go from NotStarted to InProgress to Updated with each reboot/scheduled task run.

 

This is with compatible PCs.

Edited May 12 by flipthebit

[MYK-IT]

Noted that Dell have been releasing (critical) BIOS Firmware updates recently that contain "...the new 2023 Secure Boot Certificates" - despite previous versions stating the same!

e.g. OptiPlex SFF 7010. SFF 7020, QCS1250 etc

 

Also found a couple of blogs that explain the reason for this update (June 2026: Secure Boot Certificates are expiring - Help is on the way - Mindcore Techblog) and another detailing how to implement, rollout and monitor via Intune using Remediation Scripts Secure Boot Certificate Update - Making It Happen with Intune Remediations - Mindcore Techblog.

[6Foot3]

I've been using the secure boot update in the settings catalogue on intune and it seems to be working quite well.

[ITGuyNW]

Anyone plodding through this during half term? Seems to be going ok at the moment.

 

If after updates you check the status via powershell and it still says false

 

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

 

then run

 

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

 

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

 

Wait a couple minutes and reboot.

 

 

[Squelch]

I've got about 500 devices and I'm down to 6 that need manual intervention. They are all teacher laptops and are never even switched on much less signed in to.

 

[MYK-IT]

 

Latest Deployment News that may be useful...

 

Quote

On the Windows side, organizations continue preparing for the Secure Boot certificate changes arriving in June and October. Hardware vendors are working hard to release BIOS updates with proper support for the new certificate, but not all firmware releases have been smooth, to put it mildly. For example, HP recently published an advisory covering systems that may enter a BitLocker recovery loop after a BIOS update. Read more here:
https://support.hp.com/us-en/document/ish_14914515-14914500-16.

 

Quote

To support the IT Pro community, we're doing a live re-run of our free Secure Boot 2026 community course on June 18. If you're still working through your secure boot updates, this is a great opportunity to get up to speed. Sign up here:
https://academy.viamonstra.com/courses/mini-course-secure-boot-2026.

 

[gshaw]

On 14/05/2026 at 09:10, MYK-IT said:

Noted that Dell have been releasing (critical) BIOS Firmware updates recently that contain "...the new 2023 Secure Boot Certificates" - despite previous versions stating the same!

e.g. OptiPlex SFF 7010. SFF 7020, QCS1250 etc

 

Also found a couple of blogs that explain the reason for this update (June 2026: Secure Boot Certificates are expiring - Help is on the way - Mindcore Techblog) and another detailing how to implement, rollout and monitor via Intune using Remediation Scripts Secure Boot Certificate Update - Making It Happen with Intune Remediations - Mindcore Techblog.

 

That's interesting, I have a couple of Dell 5040 SFF machines that were freezing 5 mins after boot as mentioned further back in this thread. They didn't have anywhere further to go on BIOS version when I was troubleshooting the other week but maybe they will now!

 

Edit: or maybe not then Microsoft 2011 Secure Boot Certificates Expiration for Out of Scope Platforms for BIOS Updates | Dell US

Edited May 29 by gshaw