Event details
Can you confirm please, is event ID 1808 absolute confirmation that the certs are all in place and there's nothing left to do. Thanks.
- Mabel_Gomes
Microsoft
Yes, correct. Event ID:1808 confirms that the device has the required new Secure Boot certificates applied to the device’s firmware and there is no other action required in this certificate update process.
I can say Event ID 1808 is not absolute confirmation. I have seen systems have the cert and not have that EventID
- Mabel_Gomes
Event ID 1808 used to be logged on every startup. As a result, if Boot Manager or certificates were updated after the device had already booted, Event ID 1808 would not appear until the next restart.
Starting with the April 2026 Windows security update, this behavior has changed. Event ID 1808 is now logged a soon as the update is applied.
Ok so I've been using a SCCM baseline to report compliance based on the presence of 1808 (looking back 7 days in event log, to ensure I capture a reboot). Does this mean with your April change I'm going to start losing compliant machines from my reporting, because already updated (compliant) machines will no longer be reporting 1808?
Or have I misunderstood your comment and 1808 does log each reboot and the change was merely just to the timing of the logging of the event at the moment the certs are updated?
