Does failing to complete the Secure Boot 2023 transition impact Microsoft Defender for Endpoint protections or visibility,

Will you answer questions missed/skipped in the meeting please? 🙏 Thank you!

We have approx. 60k devices, split across Intune and Legacy (Config Manager). A LOT of the older devices are on old BIOS versions - are we ok to deploy the certs using remediation scripts (setting applicableUpdates to 5944 on devices that have Secure Boot). We want to do this so we have control over the rollout. Will the certs remain if we subsequently update the vendor BIOS on these machines ?

Something interesting yesterday, device asking for BitLocker Recover Key, due to "Secure Boot policy has unexpectedly changed". Is this expected for some devices?

Hi,

We have already completed the BIOS update roll-out across all PC models in our environment.

In parallel, we are deploying the Secure Boot CA 2023 certificate upgrade using a Microsoft Intune configuration profile. Due to the very slow adoption rate observed during monitoring—both through Intune policy status and Secure Boot compliance reports—we have also introduced a remediation script to support the deployment.

Despite these efforts, the increase in deployed devices remains limited. This behavior may be related to policy application constraints or required system restarts. According to several references, the Secure Boot update process may require up to two device restarts before the changes are fully applied and reported.

Questions:

1- what is the Best way to complete the task, is to go with Registry settings and schedule the task, or with Config profile over Microsoft Intune?
2- Will the May Patch Tuesday update scheduled for May 12 guarantee a resolution of this issue and help increase the deployment and compliance numbers?

Updating the firmware, can it impact on other drivers? Any observations at this point?

We are considering a script that sets HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot\AvailableUpdates to 0x5944 and starts the \Microsoft\Windows\PI\Secure-Boot-Update task.

Can you confirm exactly what this does, and what the risks are of doing this manually or at scale?

I missed the beginning of this meeting. Did you address if Windows update will automatically update certificates after the 2011 certificates expires given updates that resolve other secure boot boot loader related issues won't be installed if the 2023 certs aren't installed?

Hello :)

In Intune I've set 

Configure High Confidnece Opt Out - Disabled
Configure Microsoft Update Managed Opt In = Enabled

The only policy I haven't enabled is... 

Enable SecureBoot Certificate Updates = Enabled (as this will actually force the certificates to deploy). As we don't have a way to easily target this ie there is no entra group property Secure Boot ready = yes that we can make a group for and deploy, it is either deploy to all, or manual groups which will take ages in a huge environment. 

As I understand, with the top two policies, the devices are being checked for confidence and when it is high, Microsoft are switching the reg key to set the update to happen. Is this correct or I mis understand? 

I have the remediation check running which is checking compliance however most are Confidence = Under Observation - More Data Needed and it's Not Started. These are all devices like Dell Latitude 5550, 5430, 5450, etc etc nothing obscure. 

Is there something more I should be doing at this point? BIOS updates are being done, Secure boot is on so not sure why it still isn't moving forward?

Thank you. :)