Event details
177 Comments
Hello.
For Virtual Machines running with Windows Server 2012 R2, 2016, 2019, 2022 with all the Windows updates applied until April 2026, this VMs are in Vmware 8.0.3.0, if the update process for the CA2023 certificate is not executing automatically, do I need to update some kind of Bios in Vmware or in the VM itself to get enough confidence and get the updates of CA2023 run automatically? Or if I force the process with the key in registry, schedule the update and restart several times the server, do I need some kind of update in Vmware or in the VM itself?
Thanks.
Yesterday I had a test in a similar scenario. Windows 2025 fully up to date and VMware 8.0.2.
Setting the AvailableUpdates registry value to 0x5944 and running manually the Secure-Boot-Update scheduled task, after two run and two reboots I could see the DB updated with the new 2023 certificates. After these reboots I had AvailableUpdates=0x4004 and running the scheduled task again and rebooting the VM again did not change it anymore, the KEK could not be updated (I can see only event id 1801 in the registry, no other errors).
So I guess that if the VM finds the PK null, as is common in VMware environments today, the automatic process could not be completed (https://knowledge.broadcom.com/external/article/423893/secure-boot-certificate-expirations-and.html). PK and KEK must be updated manually as described in the Broadcom KB https://knowledge.broadcom.com/external/article/423919. Only after PK and KEK are up to date the automatic process can be completed and DB and Bootloader can be updated by the Microsoft scheduled task.
Hello. I've go a query re: Hotpatch and Secure Boot certificate updates. At around 17 minutes in the AMA it's mentioned that Secureboot certs are not applied with Hotpatch updates. We were informed several weeks ago that the default Autopatch configuration for Intune managed devices is being changed this month, so that Hotpatch is turned on by default. Does this mean that for those devices, they will not apply Secureboot certs to UEFI firmware until another baseline is released a few months down the line? If so, then that would seem like really bad timing and would potentially change our approach to allowing Hotpatch to be turned on by default. Will we be forced to apply them via CFR if so? Can you clarify please, thanks.
It is already possible to deploy the latest Bucket confidence data to a machine without having to install the update it came with (avoiding the reboot). This is commonly used to use the Bucket confidence data shipped with a monthly non-security update without applying the rest of the changes.
https://support.microsoft.com/en-us/topic/a-closer-look-at-the-high-confidence-database-32382469-4505-4ed4-915b-982eff09b5d2#bkmk_deploying_to_other_versions
This will not include fixes of the servicing components (like the one shipped in April that addressed some Bitlocker recovery scenarios) but if your goal is to always use the latest bucket confidence data, it should solve your situation without having to fallback to regular LCU that require a restart.
Hello, I made a test in Windows Server 2022, executed this 2 commands in powershell:
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
Then restart the server 4 times, the new certificate was downloaded but I am getting this message UEFI2023Status: Capable, KEKLastUpdateErrorReason: Firmware_MissingKEKInPackage, what this means the certificate is downloaded but not applied correctly?
Thanks.
It means that your firmware vendor has not provided a signed KEK to Microsoft (signed with the firmware's platform key). You have two options
- Contact your firmware vendor (probably fruitless)
- Check if there is a firmware update available, install it
- If the issue persists after installing the firmware update, and the firmware update is supposed to include the new certificates in the Default DB reset secure boot settings so that the default DB is used. Don't forget to suspend Bitlocker if you use it with TPM.
- Heather_Poulsen
Community Manager
Thank you to everyone who posted questions in advance or joined today's AMA live. We'll host our next edition on May 18. To add it to your calendar, visit Ask Microsoft Anything: Secure Boot - May 18, 2026
You mentioned the ConfidenceLevel registry value being useful to see which devices are under observation to potentially become high confidence in the future. There are also registry values showing an error state if one occurs when attempting the certificate update. Can the Intune Secure Boot status report get those values added to it so the report helps us determine which devices need manual intervention?
Bitlocker:
I am not sure if this has been answered. What is the expected behavior when it comes to enterprise deployment and the prompting of bitlocker recovery keys? Will customers be prompted for entering bitlocker keys due to the changes in BIOS?Bitlocker recovery key prompts are never expected to happen if the user does not tamper with their device or (inadvertently) boots from different boot media. During secure boot updates, Bitlocker recovery prompts have happened due to firmware bugs which should be remediated by now by Microsoft (until new ones pop up).
Need a way to update all secure boot certs without booting Windows. securebootrecovery.efi utility exists, but only updates Windows UEFI CA 2023 as far as I know. Need to be sure that mechanism to update bootloader related components can still be forced after updating all certs beforehand.
Does failing to complete the Secure Boot 2023 transition impact Microsoft Defender for Endpoint protections or visibility,
Not expected.
Will you answer questions missed/skipped in the meeting please? 🙏 Thank you!
We have approx. 60k devices, split across Intune and Legacy (Config Manager). A LOT of the older devices are on old BIOS versions - are we ok to deploy the certs using remediation scripts (setting applicableUpdates to 5944 on devices that have Secure Boot). We want to do this so we have control over the rollout. Will the certs remain if we subsequently update the vendor BIOS on these machines ?
Secure Boot state including certificates is not to be touched by firmware updates. So the certificates should remain.
Of course, bugs may require that you manually enter firmware setup and reset settings after a firmware update. In this case, the certificates may be gone if not included in the default DB already.
