Forum Discussion

GageWilder's avatar
GageWilder
Iron Contributor
Apr 24, 2026

Windows11 Prompts Secure Boot KEK Update Should I Install It?

The system showed a "Secure Boot KEK update" notification. What is this, and is it necessary to install?

 

2 Replies

  • flhenriquez's avatar
    flhenriquez
    Copper Contributor
    Apr 25, 2026

    Yes. Upgrade. A lot of KEK's are expiring this year. A new issue for IT to deal with.

  • flhenriquez's avatar
    flhenriquez
    Copper Contributor
    Apr 25, 2026

    The Secure Boot KEK is a critical UEFI firmware key that authorizes updates to Secure Boot signature databases, ensuring your system only runs trusted pre-boot software.

    What is the KEK?

    The Key Exchange Key (KEK) is part of the Secure Boot key hierarchy in your system’s UEFI firmware, sitting below the Platform Key (PK). It acts as a gatekeeper, authorizing changes to the allowed (DB) and disallowed (DBX) signature databases, which determine which bootloaders and firmware components are trusted or revoked. Without a valid KEK, your system cannot accept new Secure Boot updates, leaving it vulnerable to boot-level malware