Next Secure Boot AMA: June 4 - Save the date!
The first set of tools and steps are now available to help you proactively update your Secure Boot certificates before they start expiring in June...
Updated May 29, 2026
Version 21.0
Blog Post
Hello.
I have this scenario with a Cisco physical server that has UEFI BIOS enabled and Secure Boot enabled. Today, after forcing the CA2023 certificate update using these two instructions (attached), and restarting the machine, we see that we have event ID 1799 indicating that the boot manager successfully signed with the UEFI CA2023. However, there is no event ID 1808 indicating that the entire process completed. Is it necessary to have this confirmation event ID 1808, or is it unnecessary in this case? We do see event ID 1803, which indicates that we don't have KEK2023, and indeed we don't have this KEK certificate, I do have KEK2011 certificate.
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
Thanks.