Event details
114 Comments
For anyone who's asking: event 1799 (TPM-WMI) tells you "Boot Manager signed with Windows UEFI CA 2023 has been installed".
stephc_msftMicrosoft
One of the biggest 'grey areas' is how to handle EXISTING aka long running gen2 Hyper-V VM's.
There are many reports that updating the OS inside the VM cant do the uefi related aspect
(sorry dont have the details to hand)
ANd is that important
Fresh VM's created on an updated HV host will be ok and will have the correct firmware.
Ditto about updating uefi boot VM's on other virtualization plaforms (if using secure boot for the VM)
eg in VMWareYes, that has been our experience as well. Hyper-V VMs created before a certain date will not take the 2023 KEK cert (the Windows UEFI CA 2023 cert gets added fine, and the boot manager replaced with the 2023-signed one). It would be nice to know that this will be fixed soon.
If a Device is new i.e a Surface Pro 10. should we expect it has a certificate then no need to update? what value should we except?
if availableupdates is set to 0x0
UEFICA2023Status - notstarted
prabhv1982Surface Pro 10 for business and Surface Pro 10 with 5G come default with the updated certificates. You can refer to Surface Secure Boot Certificates - Microsoft Support for details on surface devices that come with updated certificates pre-installed in UEFI. You can review the TPM-WMI event 1808 (This event means device has all certificates) or 1801 (Means device is missing certs and need to be updated) in System event log. Refer to Secure Boot Certificate updates: Guidance for IT professionals and organizations - Microsoft Support for details on how to monitor if device has updated certificates.
I deployed the new Settings Catalog options via Intune as described here. The deployment failed with no conflicts just error devices in Intune.
Build 26200.7296
- Configure High Confidence Opt Out
- State = Disabled, Result = ✅ Succeeded
- Configure Microsoft Update Managed Opt In
- State = Enabled, Result = ❌ Failed
- Enable Secureboot Certificate Updates
- State = Enabled, Result = ❌ Failed
Is this not available yet?
Hey David, chiming in here as I had the same issue. Pretty sure those two settings for Opt in and Enable the certs is broken, see here for workarounds: https://evil365.com/intune/SecureBoot-Cert-Expiration/#option-3---self-managed-rollout-using-intune-policies
I personally used a detection/remediation script to do this.
- Configure High Confidence Opt Out
Hi,
My registry keys show the following values:
UEFI2023Status = Not started
WindowsUEFICA2023Capable = 0
Endpoints are managed via MECM and built via PXE boot. How do I ensure that PXE boot is utilising the newer cert?
Please can you indicate a generalised approach for me to investigate?
Many Thanks,
We have this too! I know the MS team said in the webinar they will come back on this point, I hope they do as the NotStarted status doesn't seem to be covered anywhere... Ours are managed by Intune (inc. Windows Updates) and built by Autopilot
With the new Windows events being generated, for Windows Server SKUs (primarily VMs) without Secure Boot enabled, why are Microsoft-Windows-TPM-WMI events - specifically event 1801 - being generated? The device with secure boot disabled at the hyper visor layer doesn't update nor meet the requirements.
We successfully deployed the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\MicrosoftUpdateManagedOptIn (DWORD value 0x5944) via Proactive Remediation and tested applying it through Intune Settings Catalog with the following settings:
- Enable Secure Boot Certificate Updates: Enabled
- Configure High Confidence Opt Out: Disabled
- Configure Microsoft Update Managed Opt In: Enabled
However, the Settings Catalog configuration fails. We want to replace the script by using a device configuration profile. Is setting this registry key alone sufficient to enable Secure Boot updates, or should the additional settings above also be applied?
Is there any sort of reporting that we could use to better monitor where the certificates have not yet been updated?
Does the certificate update come in a specific update classification?
Will this update to Secure Boot cert trigger a BitLocker recovery event? Is it recommended to suspend BDE prior to updating the cert?
