Event details
197 Comments
Are there any updates regarding ESXi VMs failing to install the KEK certificate? From research Broadcom and Microsoft were looking into this
Would there be any changes required in the WDAC policies since we have policy updated with anything to be allowed signed by the cert Microsoft Windows Production PCA 2011. So when this is going to be replaced with new PCA 2023 cert, should we update our WDAC policy with the new cert?
Answered at 54:45
If the devices don't have updated certificates after June 2026, will there be need to disable secure boot, so they to be able to boot?
Our devices are shipped with OEM Windows Pro and are later upgraded to Windows Enterprise via Intune policy. On a large subset of these devices, the Intune configuration profile used to opt devices into Microsoft‑managed Secure Boot certificate updates is failing with Intune error 65000, and corresponding event logs indicate the policy is being rejected by licensing rather than by Secure Boot or firmware state.
My question is:
- Is this a known and acknowledged issue when Secure Boot certificate updates are applied to devices that have undergone OEM Pro → Enterprise conversion via Intune? and what what is the workaround?
Do you use Hotpatching? We still get error 65000 on those Intune policy settings too. Rumours are it's because of Hotpatch. We've resorted to using Group policy instead.
I am currently experiencing this issue as well and working with Microsoft through an open support case.
To kick off Secure Boot cert updates, do we have to set the registry value (or Intune policy that sets it)?
If the Boot Cert is not updated, and an attempt to install a CU that contains updates to the Secure Boot - will the entire CU KB fail to install?
No.
- Updates to DBX will be applied after the reboot by the scheduled task anyway.
- CUs will continue to ship two boot managers, one for 2011 cert and one for 2023 cert. The update will install the 2011 boot manager (without the new fixes) if the 2023 cert is not present.
Simonb1Microsoft
Any particular attention point or difference on the process for Azure Confidential Compute virtual machines?
Answered at 31:15
Is there an Official Rollback option incase of any booting issues after updating?
Answered at 43:00
In order to do the secure boot certificates updates, do I need to follow the vendor's steps on updating secure boot certificate? For example, dell has a website that states pre-requisites that it need tpm 2.0 and windows server 2022 or later then able to update the secure boot certificate. Is it necessary to follow or I can proceed to update the secure boot certificate via registry keys or the playbook that you provided?
Answered at 34:00
In response to the answer, this is the website url: https://www.dell.com/support/kbdoc/en-us/000402373/poweredge-server-bios-update-guidelines-for-microsoft-secure-boot-certificates
Is there a tool that can help us to check whether the server is ready for secure boot certificate update also perform the update for us?
Will the clients still boot after June if no steps are taken?
YES.
