[Urgent] Inquiry About Secure Boot Support and Update Procedure

Question

[Urgent] Inquiry About Secure Boot Support and Update Procedure

염규정 (David Yeom) 20

Dear Microsoft Support Team,

Due to our company’s internal security requirements, we would like to update the Secure Boot certificate on the computer currently being used for our equipment.

The PC specifications are as follows:

[Brand: HP, Model Name: HP EliteDesk 800G2 TWR, Processor type: Intel Core i3-6100 CPU @3.70GHz, Memory: 8GB, Hard DISK: 1T , 1T, OS: Windows 10]

Could you please urgently advise whether the PC will be able to boot normally after the Secure Boot certificate update, and provide the recommended update procedure?

If you have any question or resquest, please contact below email adress please.

[PII removed]

0 comments

Answer accepted by question author

Brian Huynh 3,305 Microsoft External Staff Moderator

Hello David Yeom, thank you for posting in the Microsoft Q&A community.

To directly answer your question: Yes, the PC will boot normally after the Secure Boot certificate update, as long as the device firmware (BIOS) correctly supports and applies the new certificates. If the certificates are not updated before the deadline, the device will still boot and operate, but with a degraded security posture.

Here is the officially recommended approach to perform the update safely:

Ensure the device is fully updated with the latest Windows 10 cumulative updates.
Open PowerShell as an Administrator.
Run the following command to manually trigger the Secure Boot servicing task:

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Restart the computer twice to ensure it boots up with the updated database.

Could you please provide some additional data? First, please open PowerShell as Administrator, run the following command, and share the output:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

(Note: If this returns True, your system has already successfully applied the new certificate).

Second, could you press Windows + R, type msinfo32, press Enter, and let me know the BIOS Version/Date currently installed?

염규정 (David Yeom) 20 Reputation points

2026-06-10T03:06:38.5533333+00:00
Dear Brian Huyng**.**

Thank you for sharing information.

could you provide me how to check secure boot certificate inforamtion currently using?

could you check the method to upgrade secure boot certificate manually?
could you confirm whether we should download the certificates below in microsoft website and then run the following command in PowerShell?

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Please confirm whether this is the correct procedure.
염규정 (David Yeom) 20 Reputation points

2026-06-10T03:08:53.28+00:00

and, If we update secure boot cerificate manually when the computer is not fully updated with the latest Windows 10, Could you please confirm whether this procedure may cause any issues?
Brian Huynh 3,305 Reputation points Microsoft External Staff Moderator

2026-06-10T05:21:24.3466667+00:00
Hello David Yeom, thank you for following up.

To address your questions clearly, I have detailed the explanations below.

Regarding your first question on how to check the currently used Secure Boot certificate information, Windows stores the allowed certificates in a UEFI variable known as the signature database (db). You can read the contents of this variable to see exactly which certificates are installed by opening PowerShell as and running the following command:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -replace '[^\x20-\x7E]', ' '

When you run this, it will output a text string. You will want to look through the output for the names of the certificates. You will likely see Microsoft Windows Production PCA 2011 (the old certificate) and, if the system is fully updated, you will see Windows UEFI CA 2023 (the new certificate).

For your second and third questions regarding manually upgrading the certificates and whether you need to download them directly from the Microsoft website, the short answer is no, you do not need to download the certificates manually from the website.

Microsoft intentionally packages the new Secure Boot certificates directly inside the standard Windows 10 Cumulative Updates (released from February 2024 onwards). The manual method to apply the update is exactly the scheduled task command I provided previously. That command tells Windows to take the certificates already safely staged by Windows Update and inject them into the motherboard's firmware.

If you attempt to update the Secure Boot certificate manually using PowerShell when the computer is not fully updated with the latest Windows 10 patches, it will not necessarily break the computer, but the procedure will simply fail to apply the new keys. This is because the new certificate payload does not exist on the local system until the Windows Updates are installed.

More importantly, it is recommended to install the latest Windows 10 updates first because those updates contain the new Windows Boot Manager files that are signed by the new 2023 certificate. If the firmware and the operating system boot files are not kept in sync through the official Windows Update process, it could theoretically lead to boot issues, though Windows has built-in safeguards to prevent applying the database update if the system is not ready.

I will continue to follow up on this thread to ensure your deployment plan is completely resolved. If this helps clarifying, please consider hitting "Accept answer" to help other members with same issues.

Official Microsoft Documentation for reference: learn.microsoft.com/en-us/windows/security/hardware-security/secure-boot/update-secure-boot-certificates
염규정 (David Yeom) 20 Reputation points

2026-06-10T09:01:55.0866667+00:00

Thank you for sharing informations.

In addition, our system uses either a USB port or a LAN port for the camera connection and controller.

Regaring with communication with systems, Could there be any possible issues with these connections after the Secure Boot update?

Thank you.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Brian Huynh 3,305 Reputation points Microsoft External Staff Moderator

2026-06-11T02:14:32.1066667+00:00

Hello David Yeom, thank you for providing the detailed results of your pilot test.

Based on the procedure you executed, it appears that Windows 11 correctly staged the new Secure Boot payload, but the motherboard's UEFI firmware (BIOS) rejected or ignored the update during the reboot sequence. This is a behavior on older hardware when the firmware either lacks support for the OS-level injection or is locked down by OEM policies.

To isolate exactly why the certificate is failing to apply, we need to inspect the hand-off logging between Windows and the BIOS. Please open Event Viewer and navigate to Windows Logs > System. Filter the log for Event ID 1795 (Secure Boot variable update failure) or Event ID 1796 (Secure Boot variable update success). If you see Event ID 1795 logged shortly after your reboots, please share the exact error code or message it provides.

Regarding the BIOS/UEFI settings you should check, please reboot the machine into the BIOS setup. Navigate to the Secure Boot configuration and check if it is set to "Standard Mode" or "Custom Mode". On some enterprise systems, the BIOS must be toggled to "Custom Mode" to allow the operating system to write new variables to the database.

Furthermore, I recommend verifying the exact BIOS version you are running. Since the HP utilizes Intel processor—which is traditionally outside the officially supported processor list for Windows 11—there is a possibility of an architectural incompatibility between the Windows 11 Secure Boot servicing stack and this firmware. If your BIOS is not up to date, the best workaround is to install the latest BIOS update provided by HP, enter the BIOS Secure Boot menu, and select "Restore Factory Keys" or "Clear Secure Boot Keys". This forces the motherboard to load the newest default database directly from the OEM.

Finally, to completely reassure you regarding your USB and LAN camera connections: there will be absolutely no communication issues or interruptions with these devices after the Secure Boot update. Secure Boot is strictly an early-boot security framework designed to verify bootloaders, OS kernels, and pre-boot EFI Option ROMs before Windows starts. Once Windows 11 has fully booted, standard USB and LAN communications are handled exclusively by standard Windows device drivers, which do not rely on the Secure Boot database certificates.
염규정 (David Yeom) 20 Reputation points

2026-06-11T02:41:40.43+00:00

Just to confirm, does this mean that Secure Boot is completely unrelated to equipment communication?

Is there any Microsoft official document where I can confirm this information?

Also, I understood that when Windows is installed after February 2024, the new Secure Boot certificates are included during the installation. Can this also be confirmed in any Microsoft official document?

Thank you for your support. I will accept the answer.

Additionally, may I ask if you are an official Microsoft employee?
Brian Huynh 3,305 Reputation points Microsoft External Staff Moderator

2026-06-11T03:09:14.56+00:00
Yes, you are absolutely correct. Secure Boot is completely unrelated to equipment communication during normal system operation.

Secure Boot is strictly a pre-boot security feature. Its only job is to verify the digital signatures of the bootloader, UEFI drivers, and the OS kernel before Windows starts. Once the motherboard firmware validates these components and hands over control to the operating system, the Secure Boot process is officially finished. From that exact moment forward, standard Windows device drivers handle all communication with your USB and LAN ports, including your cameras and controllers. Because of this architectural design, updating the Secure Boot certificates will not interrupt or interfere with your devices in any way.

You can verify this directly in the official documentation. In the Microsoft Learn article on Secure Boot, under the How it works section, it explicitly states: "When the PC starts, the firmware checks the signature of each piece of boot software... If the signatures are valid, the PC boots, and the firmware gives control to the operating system."

Regarding your second question, this is also correct. Starting with the Windows Cumulative Updates released on February 13 2024, Microsoft intentionally included the new Windows UEFI CA certificate payload directly within the standard update packages. If a device has installed the February 2024 update (or any newer cumulative update since then), the new certificates are staged on the local hard drive, waiting for the scheduled task to inject them into the BIOS/UEFI.

You can verify this in the official Microsoft guidance for updating Secure Boot certificates. In the Deployment sections, the documentation confirms: "Windows updates released on and after February 13, 2024, include the ability to apply the new certificate to the UEFI signature database (DB)."

I hope these references provide your team with the assurance needed to proceed safely.

Official Microsoft Documentation:

Secure Boot Overview and How it Works: https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-secure-boot

Updating Secure Boot Certificates: https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-security/update-secure-boot-certificates
염규정 (David Yeom) 20 Reputation points

2026-06-11T06:58:58.16+00:00

Are all Windows installations after 2024 using the Windows UEFI CA 2023 certificate?

Also, the link below does not open.

Thank you.
Brian Huynh 3,305 Reputation points Microsoft External Staff Moderator

2026-06-11T07:31:52.3633333+00:00

No, not all Windows installations after 2024 are strictly using the new Windows UEFI CA 2023 certificate yet.

The original Secure Boot certificate—Microsoft Windows Production PCA 2011—does not expire until 2026. If Microsoft were to suddenly force all 2024/2025 Windows installations to exclusively use the new 2023 certificate, millions of older devices would fail to boot, because their motherboard firmware does not inherently trust the 2023 certificate yet.

So, if you install Windows 11 right now from a 2024 or 2025 ISO, the operating system has the new certificate ready, but it is still relying on the older 2011 certificate to boot safely until the motherboard confirms it has successfully saved the 2023 certificate into its Secure Boot database.

If your motherboard continues to reject the automatic Scheduled Task update, your device is still booting perfectly fine right now because it is falling back on the 2011 certificate.

I have updated the link to Updating Secure Boot Certificates, please check.
염규정 (David Yeom) 20 Reputation points

2026-06-11T08:29:09.9666667+00:00

Thank you for your kindly information.

I wonder where can I finde that "Windows updates released on and after February 13, 2024, include the ability to apply the new certificate to the UEFI signature database (DB)."? Is it included in 24H2 version ?

2 additional answers

Your answer

염규정 (David Yeom) 20 Reputation points

2026-06-10T03:06:38.5533333+00:00

Dear Brian Huyng**.**

Thank you for sharing information.

could you provide me how to check secure boot certificate inforamtion currently using?

could you check the method to upgrade secure boot certificate manually?
could you confirm whether we should download the certificates below in microsoft website and then run the following command in PowerShell?

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Please confirm whether this is the correct procedure.
염규정 (David Yeom) 20 Reputation points

2026-06-10T03:08:53.28+00:00

and, If we update secure boot cerificate manually when the computer is not fully updated with the latest Windows 10, Could you please confirm whether this procedure may cause any issues?
염규정 (David Yeom) 20 Reputation points

2026-06-10T09:01:55.0866667+00:00

Thank you for sharing informations.

In addition, our system uses either a USB port or a LAN port for the camera connection and controller.

Regaring with communication with systems, Could there be any possible issues with these connections after the Secure Boot update?

Thank you.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
염규정 (David Yeom) 20 Reputation points

2026-06-11T02:41:40.43+00:00

Just to confirm, does this mean that Secure Boot is completely unrelated to equipment communication?

Is there any Microsoft official document where I can confirm this information?

Also, I understood that when Windows is installed after February 2024, the new Secure Boot certificates are included during the installation. Can this also be confirmed in any Microsoft official document?

Thank you for your support. I will accept the answer.

Additionally, may I ask if you are an official Microsoft employee?
염규정 (David Yeom) 20 Reputation points

2026-06-11T06:58:58.16+00:00

Are all Windows installations after 2024 using the Windows UEFI CA 2023 certificate?

Also, the link below does not open.

Thank you.
Brian Huynh 3,305 Reputation points Microsoft External Staff Moderator

2026-06-11T07:31:52.3633333+00:00

No, not all Windows installations after 2024 are strictly using the new Windows UEFI CA 2023 certificate yet.

The original Secure Boot certificate—Microsoft Windows Production PCA 2011—does not expire until 2026. If Microsoft were to suddenly force all 2024/2025 Windows installations to exclusively use the new 2023 certificate, millions of older devices would fail to boot, because their motherboard firmware does not inherently trust the 2023 certificate yet.

So, if you install Windows 11 right now from a 2024 or 2025 ISO, the operating system has the new certificate ready, but it is still relying on the older 2011 certificate to boot safely until the motherboard confirms it has successfully saved the 2023 certificate into its Secure Boot database.

If your motherboard continues to reject the automatic Scheduled Task update, your device is still booting perfectly fine right now because it is falling back on the 2011 certificate.

I have updated the link to Updating Secure Boot Certificates, please check.
염규정 (David Yeom) 20 Reputation points

2026-06-11T08:29:09.9666667+00:00

Thank you for your kindly information.

I wonder where can I finde that "Windows updates released on and after February 13, 2024, include the ability to apply the new certificate to the UEFI signature database (DB)."? Is it included in 24H2 version ?

Answer 1

염규정 (David Yeom) 20

Dear Microsoft Support Team

I want to get advise from human

I downloaded Microsoft Corporation KEK 2K CA2023, Micfrosoft UEFI CA, Microsoft Option ROM UEFI CA202 certicates for uptate from microsoft web page

I wonder next step to upgreat secure boot certificate.

If you have questions or any request, please contact below adress.

Thankyou

0 comments

Answer 2

The described HP EliteDesk 800 G2 running Windows 10 can continue to boot normally after Secure Boot certificate updates, provided the update process completes successfully and the device firmware correctly applies the new certificates.

If Secure Boot certificates are not updated before the older 2011 certificates begin expiring in June 2026, the device will still start and operate normally and will continue to receive standard Windows updates. However, it will no longer receive new Secure Boot protections for early boot components (for example, Windows Boot Manager, Secure Boot databases, revocation lists, or mitigations for new boot-level vulnerabilities). Over time, this reduces protection and may affect scenarios that rely on Secure Boot trust, such as BitLocker hardening or third‑party bootloaders.

For supported Windows 10 devices that share diagnostic data and are “managed by Microsoft,” Secure Boot certificates are delivered via Windows Update. The updated 2023 Secure Boot certificates are included in the May 13, 2025 cumulative updates (LCU) and later, but they are not applied automatically; additional steps are required to complete deployment.

Recommended high‑level procedure for an IT‑managed Windows 10 device:

Ensure the device is running a supported version of Windows 10 and is fully updated with the latest cumulative updates (May 13, 2025 or later) that include the 2023 Secure Boot certificates.
Follow the IT guidance in “Windows Secure Boot certificate expiration and CA updates” (referenced as https://aka.ms/getsecureboot in the documentation) to:
- Identify whether the device still uses 2011 Secure Boot certificates.
- Apply the Secure Boot Active Variable updates through the OS so that the new 2023 certificates are used for boot validation.
Monitor deployment status:
- Check Secure Boot certificate status and system event logs for indicators such as Event ID 1801 or related events that show whether certificate remediation has been applied.
- Verify that the UEFICA2023Status registry value reflects an Updated state, where applicable.
If the device is older or OEM firmware is outdated and the OS‑based update does not apply correctly, coordinate with HP to obtain any required firmware/BIOS updates that refresh the Secure Boot default variables in firmware.

If Secure Boot is disabled on the device, it will not receive the new Secure Boot certificates in firmware and will remain vulnerable to boot‑level malware because Secure Boot protections are not enforced. In that case, enable Secure Boot in firmware (UEFI) after ensuring certificates and keys are correctly provisioned according to OEM guidance.

For customer/IT‑managed fleets where OEM firmware updates may not be available, Microsoft’s guidance indicates two paths:

Where devices are managed by Microsoft with diagnostic data sharing and are on supported OS versions, Microsoft will attempt to update Secure Boot certificates through Windows Update.
For customer/IT‑managed devices, administrators should use the documented Secure Boot certificate expiration and CA update procedures to apply the new certificates on validated devices that can safely take the updates. In cases where updates do not apply due to firmware issues, follow HP’s firmware guidance.

If Secure Boot certificates were to expire without being updated, Secure Boot protection would be degraded, but as long as the device meets requirements for newer OS versions (for example, Windows 11) it would still be possible to upgrade, assuming other hardware prerequisites are met.

References: