Event details
MicrosoftHi!
I hope this server playbook helps answer your question:
https://aka.ms/SecureBootForServer
The modules necessary for the Secure boot updates are already delivered through monthly cumulative updates for Windows Server OS. Unlike PC clients, the Secure boot cert update needs to be manually triggered by IT Administrators, and the server playbook shares the best practices on how to plan and manage this transition safely.
I believe some of us get confused, between getting the certificate itself (which is part of Feb CU?), and getting the secure boot using the updated certificate.
- Arden_White
Hi YHR,
The Secure Boot certificates themselves have been included in cumulative updates since May 2025, along with Windows support to apply those certificates to firmware. Installing the CU makes the certificates available, but it does not automatically mean Secure Boot is using them. Applying the certificates to firmware is a separate step that is intentionally controlled. Because it is not possible to test every combination of device model and firmware, the rollout is being done cautiously and gives IT teams control to validate devices and manage deployment across their fleet before broad enablement.
Arden
