Is there something we can reference to determine if Microsoft is pushing the update to a model yet?

What, if any, impact will this have on SecureBoot enabled devices running a Linux OS?

Is there a timeline when it will be possible to manage Cert Update Settings via Intune (without running into Error 65000)?

Is there a list of device models and firmware versions, that should already get the update through LCU?

we applied this script from here, and after a reboot, the bios was updated.  is this normal behavior?

https://support.microsoft.com/en-us/topic/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates-a7be69c9-4634-42e1-9ca1-df06f43f360d

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Manually reboot the system when the AvailableUpdates becomes 0x4100

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Saw there is a known issue with updating the Secure Boot configuration settings deployed through Microsoft Intune Mobile Device Management (MDM) are currently blocked on Pro editions of Windows 10 and Windows 11.  What do you do if clients are reporting as Professional edition in slmgr, but they are running as Enterprise via subscription.  Currently seeing the 65000 error and Intune is unable to apply the Intune configurations.  Is setting this via remediation script the only option for Intune managed device currently?

have you got screenshots of all vendor OEM bios's of UEFI settings that need to be enabled you say it should be default now but I have seen devices not having UEFI CA Enabled and failing to update correctly. 

Hello,

I have a similar issue:

After deploying the Enable Secureboot Certificate Updates policy via Intune, the following error shows up: 65000.

Also, the event IDs 404 and 827 indicate that the policy is rejected due to licensing or Command failure.

Could you please clarify? Thank you.

Are there specific instructions with how to deploy this remediation using MECM with, maybe, a task sequence? If so, can you please direct them to me?

And as someone else also mentioned, can you also please provide instructions on how to update the boot manager within SCCM for PXE booting? We just recently upgraded our ADK in early August 2025 to 10.0.26100.2454. What else needs to be done or downloaded for SCCM PXE booting?