Event details

Ask Microsoft Anything (AMA) about updating Secure Boot certificates on your Windows devices before they expire in June of 2026. We recently published the first version of the Secure Boot playbook, o...
Heather_Poulsen
Updated Dec 09, 2025
AMA
dtys123's avatar
dtys123
Copper Contributor
Dec 10, 2025

I have a few questions on this:

1.) We have diagnostic data turned on in our intune environment, but I'm not seeing the registry key "MicrosoftUpdateManagedOptIn". Should I be worried about this? If this key does not exist, MS will not push the certificates down, correct?

2.) When will the certificates come down with Windows Updates? Is there a expected month they will be delivered ?

3.) Am I right to say if the "HighConfidenceOptOut" registry key does not exist, this means we have opted in?

4) if the key "WindowsUEFICA2023Capable" is set to 1 instead of 2? This means the device is still not in a "secure state". The key needs to be set to 2?

Pearl-Angeles's avatar
Pearl-Angeles
Icon for Community Manager rankCommunity Manager
Dec 10, 2025

Thanks for your questions! Below are timestamps for when your questions were answered live. 

Question #1 was addressed by panelists at 1:31.

Question #2 was addressed by panelists at 36:00.

Question #3 was addressed by panelists at 13:31.

Question #4 was addressed by panelists at 45:58.