Event details

It's time for our fourth Ask Microsoft Anything (AMA) about updating Secure Boot certificates on your Windows devices before they expire in June of 2026. If you've already bookmarked Secure Boot play...
Pearl-Angeles
Updated Apr 15, 2026
AMA
acamachor's avatar
acamachor
Copper Contributor
Apr 23, 2026

Hello, can we use this 3 instructions to force the Windows Servers to update the CA2023 certificate?

- reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

- Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

- And restart the server two times.

  • mihi's avatar
    mihi
    Brass Contributor
    Apr 23, 2026

    If

    • The server patch level is at least mid 2025
    • The machine has UEFI Secure Boot enabled
    • There are no known blocks for the hardware configuration

    These three instructions will update to CA2023 certificates. Make sure to wait at least 5 minutes before each restart so that all the actions to be performed have been finished.