I missed the beginning of this meeting. Did you address if Windows update will automatically update certificates after the 2011 certificates expires given updates that resolve other secure boot boot loader related issues won't be installed if the 2023 certs aren't installed?

Hello :)

In Intune I've set 

Configure High Confidnece Opt Out - Disabled
Configure Microsoft Update Managed Opt In = Enabled

The only policy I haven't enabled is... 

Enable SecureBoot Certificate Updates = Enabled (as this will actually force the certificates to deploy). As we don't have a way to easily target this ie there is no entra group property Secure Boot ready = yes that we can make a group for and deploy, it is either deploy to all, or manual groups which will take ages in a huge environment. 

As I understand, with the top two policies, the devices are being checked for confidence and when it is high, Microsoft are switching the reg key to set the update to happen. Is this correct or I mis understand? 

I have the remediation check running which is checking compliance however most are Confidence = Under Observation - More Data Needed and it's Not Started. These are all devices like Dell Latitude 5550, 5430, 5450, etc etc nothing obscure. 

Is there something more I should be doing at this point? BIOS updates are being done, Secure boot is on so not sure why it still isn't moving forward?

Thank you. :)

How to I know if a particular computer is "high confidence" and likely to get an automatic security update from microsoft?  We have many systems that have compatible FW but still not receiving the 2023 updates including systems bought in 2025/2026.

There was a mention that the April update would address BitLocker recovery issues caused by the Secure Boot update.We have been experiencing BitLocker recovery issues, and it has been very difficult to identify a clear pattern from Event Viewer that would tell us exactly when BitLocker should be suspended to prevent recovery after reboot.Do you know exactly what Microsoft changed to prevent these recovery events?

we're updating BIOS on all devices, as requested by vendor and using Intune CSP for all devices enrolled in Intune as below: 

Configure High Confidence Opt Out = Disabled.

Configure Microsoft Update Managed Opt In = Enabled

Enable Secureboot Certificate Updates = (Enabled) Initiates the deployment of new Secure Boot certificates and related updates

Is this supported also on Win10 LTSC 1809? 

What would be the best option for devices NOT in Intune (like Process Control) or LTSC 1809

Hi, and thank you for your time and expertise. I use the MS Inventory/Dashboard for the update process. The Microsoft scripts for detection and aggregation currently work during initialization for a large number of devices. However, I have noticed that changes made to the device itself—such as enabling Secure-Boot or updating the firmware—are not recorded in the new device files (even after 2-3 days and multiple reboots). Are there any specific limitations from Microsoft that prevent the device files or dashboard from updating?

Is Secure Boot strictly needed on VMs? What happens with VMs with Secure Boot set as True and PK = null if nothing is done? And what about the case of TPM without secure boot over Windows 11?

What is the WinCS key and what is its exact purpose? What value triggers the updates? 

Is revoking the old 2011 certificate an action we would need to take, or would that be handled entirely by Microsoft? If Microsoft will handle it, do you know when that is expected to happen, 2026 or 2027?