Windows11 Prompts Secure Boot KEK Update Should I Install It?

Yes, in most cases you should install the Secure Boot KEK update. It’s a security update that helps protect your system from unauthorized or malicious boot-level software. Microsoft releases these updates to keep Windows 11 devices secure, especially against newer threats. As long as the update is coming through Windows Update or a trusted source, it’s safe to install. Just make sure your system doesn’t lose power during the process, because firmware-related updates should not be interrupted.

Yes. Upgrade. A lot of KEK's are expiring this year. A new issue for IT to deal with.

The Secure Boot KEK is a critical UEFI firmware key that authorizes updates to Secure Boot signature databases, ensuring your system only runs trusted pre-boot software.

What is the KEK?

The Key Exchange Key (KEK) is part of the Secure Boot key hierarchy in your system’s UEFI firmware, sitting below the Platform Key (PK). It acts as a gatekeeper, authorizing changes to the allowed (DB) and disallowed (DBX) signature databases, which determine which bootloaders and firmware components are trusted or revoked. Without a valid KEK, your system cannot accept new Secure Boot updates, leaving it vulnerable to boot-level malware