Hi community, SochiOgbuanya​ Ashis_Chatterjee​, 

I am providing my PowerShell script below, which makes diagnosing the state across computers easier. It can be used locally or remotely, as a remediation script in Intune, or for exporting events. If you do not need all events, you can customise the script.

When using Event Viewer or Azure Monitoring, this XPath syntax can be used to fetch all relevant events.

In Event Viewer, you can create a custom view on a specific computer to monitor these events.

<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">*[System[Provider[@Name='Microsoft-Windows-TPM-WMI'] and (Level=1  or Level=2 or Level=3 or Level=4 or Level=0 or Level=5) and (EventID=1032 or EventID=1033 or EventID=1034 or EventID=1036 or EventID=1037 or EventID=1043 or EventID=1044 or EventID=1045 or EventID=1795 or EventID=1796 or EventID=1797 or EventID=1798 or EventID=1799 or EventID=1801 or EventID=1808)]]
  </Select>
  </Query>
</QueryList>

function Get-SecureBootDbxEvents {
<#
.SYNOPSIS
Collects Secure Boot DBX–related TPM-WMI events from the System event log,
grouped by Event ID, with optional diagnostics, time filtering, and export.

.DESCRIPTION
This function retrieves TPM-WMI events associated with Secure Boot DBX update
processing, as referenced in Microsoft KB5016061.  
To ensure reliable performance on systems with large event logs, each Event ID
is queried in parallel using thread jobs, avoiding the 256‑event limitation of
Get-WinEvent.

The function supports optional diagnostics for Secure Boot, DBX, and TPM
readiness, UTC-normalized time filtering, remote computer targeting, and
structured export of collected events.

.PARAMETER ComputerName
Specifies the target computer to query.  
Defaults to the local machine.

.PARAMETER StartTime
Returns only events with a TimeCreated value greater than or equal to the
specified timestamp.  
The timestamp is normalized to UTC to ensure consistent filtering across
systems and time zones.

.PARAMETER ExportCsv
Specifies a file path for exporting all collected events in CSV format.

.PARAMETER ExportJson
Specifies a file path for exporting all collected events in JSON format.

.PARAMETER Diagnostics
Runs Secure Boot, DBX, and TPM readiness checks before event collection.

.EXAMPLE
Get-SecureBootDbxEvents -StartTime (Get-Date).AddDays(-7)

Retrieves all Secure Boot DBX–related TPM-WMI events from the past seven days.

.EXAMPLE
Get-SecureBootDbxEvents -Diagnostics -Verbose

Runs diagnostics and displays detailed progress information.

.EXAMPLE
Get-SecureBootDbxEvents -ComputerName SERVER01 -Diagnostics -Verbose

Runs diagnostics and collects events from a remote server.

.NOTES
Event IDs are derived from Microsoft KB5016061.  
Requires read access to the SYSTEM event log and the
Microsoft-Windows-TPM-WMI provider.

.LINK
https://github.com/cjee21/Check-UEFISecureBootVariables

Related project to identify the current state around Secure Boot

.LINK
https://techcommunity.microsoft.com/users/karl-we/289393?wt.mc_id=mvp_338345

Contact the author

.LINK
https://support.microsoft.com/topic/secure-boot-db-and-dbx-variable-update-events-37e47cf8-608b-4a87-8175-bdead630eb69?wt.mc_id=mvp_338345

Microsoft Guidance on related Event IDs

.LINK
https://techcommunity.microsoft.com/blog/windows-itpro-blog/secure-boot-playbook-for-certificates-expiring-in-2026/4469235#community-4469235-_option2?wt.mc_id=mvp_338345

Microsoft Guidance on Secure Boot Deployment 

.VERSION
1.2.1

# Version History (Semantic Versioning)
# MAJOR version — increment when making incompatible changes
# MINOR version — increment when adding functionality in a backward-compatible manner
# PATCH version — increment when making backward-compatible bug fixes

1.2.1
- Added additional outputs about Secure Boot state after the output of logfiles

1.2.0
- Output per EventID to avoid hitting the maximum item count
- Added per‑ID statistics (count, first, last)
- Added color‑coded severity output
- Grouped output per EventID
- Remote computer support

1.1.0
- Added CSV and JSON export options
- UTC-normalized StartTime filtering

1.0.0
- Initial release with:
  - Secure Boot / DBX / TPM diagnostics
#>

    [CmdletBinding()]
    param(
        [string]$ComputerName = $env:COMPUTERNAME,
        [datetime]$StartTime,
        [string]$ExportCsv,
        [string]$ExportJson,
        [switch]$Diagnostics
    )
    #region Event IDs from KB5016061
    # These are the documented Secure Boot DBX update and remediation events.
    $EventIds = @(
        1032, 1033, 1034, 1036, 1037,
        1043, 1044, 1045,
        1795, 1796, 1797, 1798, 1799,
        1801, 1808
    )
    #endregion Event IDs from KB5016061

    #region Time filter normalization
    # Detect whether StartTime was explicitly provided.
    $HasStartTime = $PSBoundParameters.ContainsKey('StartTime')

    # Convert StartTime to UTC for consistent filtering across systems.
    $StartTimeUtc = $null
    if ($HasStartTime) {
        $StartTimeUtc = $StartTime.ToUniversalTime()
    }
    #endregion Time filter normalization

    #region Diagnostics
    if ($Diagnostics) {
        Write-Verbose "Running Secure Boot, DBX, and TPM diagnostics on $ComputerName..."

        # Secure Boot state (local only)
        if ($ComputerName -ne $env:COMPUTERNAME) {
            Write-Warning "Diagnostics are local-only (Confirm-SecureBootUEFI/Get-SecureBootUEFI). Remote diagnostics not supported."
        }

        try {
            Write-Host "Secure Boot Enabled:" (Confirm-SecureBootUEFI) -ForegroundColor Green
        } catch {
            Write-Warning "Secure Boot state could not be determined."
        }

       try {
            Write-Host "New Secure Boot CA2023 deployed in Firmware / Windows Bootloader:" -ForeGroundColor Green
            [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
        } catch {
            Write-Warning "Secure Boot state could not be determined."
        }

       try {
            Write-Host "Secure Boot CA2023 Status:"  -ForeGroundColor Green
            Get-ChildItem HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot
        } catch {
            Write-Warning "Secure Boot state could not be determined."
        }
        # DBX variable
        try {
            $dbx = Get-SecureBootUEFI -Name dbx
            Write-Host "DBX Bytes:" $dbx.Bytes.Length  -ForegroundColor Green
        } catch {
            Write-Warning "DBX variable could not be retrieved."
        }

        # TPM state
        try {
            $tpm = Get-Tpm -ComputerName $ComputerName
            Write-Host "TPM Present:" $tpm.TpmPresent
            Write-Host "TPM Ready  :" $tpm.TpmReady
            Write-Host "TPM Version:" $tpm.ManufacturerVersion
        } catch {
            Write-Warning "TPM state could not be retrieved."
        }

        Write-Host ""
    }
    #endregion Diagnostics

    #region Parallel Fetch
    Write-Verbose "Fetching events per Event ID in parallel from $ComputerName..."

    # Thread-safe collection for results
    $Results = [System.Collections.Concurrent.ConcurrentBag[object]]::new()

    # Store job handles
    $Jobs = @()

    foreach ($EventID in $EventIds) {

        # Start a thread job for each Event ID
        $Jobs += Start-ThreadJob -ArgumentList $EventID,$ComputerName,$HasStartTime,$StartTimeUtc -ScriptBlock {
            param(
                [int]$EventID,
                [string]$ComputerName,
                [bool]$HasStartTime,
                $StartTimeUtc
            )

            # Build filter for Get-WinEvent
            $Filter = @{
                LogName      = 'System'
                ProviderName = 'Microsoft-Windows-TPM-WMI'
                Id           = $EventID
            }

            # Add StartTime only if provided
            if ($HasStartTime) {
                $Filter.StartTime = [datetime]$StartTimeUtc
            }

            # Query events and return selected fields
            Get-WinEvent -ComputerName $ComputerName -FilterHashtable $Filter -ErrorAction SilentlyContinue |
                Select-Object TimeCreated, Id, LevelDisplayName, Message
        } # end ScriptBlock
    } # end foreach EventID

    # Collect results from all jobs
    foreach ($job in $Jobs) {
        $out = Receive-Job -Job $job -Wait -AutoRemoveJob
        if ($out) {
            foreach ($evt in $out) {
                $Results.Add($evt)
            }
        }
    }
    #endregion Parallel Fetch

    #region Output Handling
    if (-not $Results.Count) {
        Write-Warning "No TPM-WMI events found for the specified criteria."
        return
    }

    # Group and sort events by Event ID
    $Grouped = $Results | Sort-Object Id, TimeCreated | Group-Object Id

    foreach ($Group in $Grouped) {
        $Events = $Group.Group | Sort-Object TimeCreated

        Write-Host ""
        Write-Host "===== Event ID $($Group.Name) ====="
        Write-Host "Count:" $Events.Count
        Write-Host "First:" $Events[0].TimeCreated
        Write-Host "Last :" $Events[-1].TimeCreated
        Write-Host ""

        # Color-coded severity output
        foreach ($Evt in $Events) {
            $Color = switch ($Evt.LevelDisplayName) {
                'Critical'    { 'Magenta' }
                'Error'       { 'Red' }
                'Warning'     { 'Yellow' }
                'Information' { 'Cyan' }
                default       { 'Gray' }
            }

            Write-Host ("[{0}] {1} - {2}" -f $Evt.TimeCreated, $Evt.LevelDisplayName, $Evt.Message) -ForegroundColor $Color
        }
    }

    # Export CSV if requested
    if ($ExportCsv) {
        Write-Verbose "Exporting results to CSV: $ExportCsv"
        $Results | Sort-Object Id, TimeCreated |
            Export-Csv -Path $ExportCsv -NoTypeInformation -Encoding UTF8
    }

    # Export JSON if requested
    if ($ExportJson) {
        Write-Verbose "Exporting results to JSON: $ExportJson"
        $Results | Sort-Object Id, TimeCreated |
            ConvertTo-Json -Depth 5 | Out-File -FilePath $ExportJson -Encoding UTF8
    }

    # Return sorted objects for pipeline use
    $Results | Sort-Object Id, TimeCreated
    #endregion Output Handling

} # end function Get-SecureBootDbxEvents

This topic comes right in place to share what I saw on a old computer from 2013.

I read carefully the blog page on the topic: Updating Microsoft Secure Boot keys | Windows IT Pro blog

and the registry key settings: 

https://support.microsoft.com/en-us/topic/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates-a7be69c9-4634-42e1-9ca1-df06f43f360d#articlefootersupportbridge=communitybridge

If I understand properly, the task

Start-ScheduledTask -TaskName “\Microsoft\Windows\PI\Secure-Boot-Update”

is trying to update the UEFI with the new certificates. It is correct?

BUT the whole is missing a critical scenario: what if the UEFI do NOT support the update of certificates?

On my mainboard from 2013, an Asrock Z87E-ITX, with last bios 2.5 from 2018, out of support from Asrock for years already, running the task is having a very strange behavior on Windows 10 Pro:

• if the wifi is off, I get an error 1801 with "Updated Secure Boot certificates are available on this device but have not yet been applied to the firmware"
• if the wifi is on, the computer is freezing completely (exactly 5 min after start, matching the delay of the trigger in the task), nothing is written is any logs, as if the task trying to touch the UEFI will reach a critical address.

In the bios/UEFI on this machine, there is no way whatsoever to manage the keys and certificates. No way to read (and less to write). It seems Asrock did not implement the SecureBoot completely there...
And there is NO TPM chip on that board...

So next question: what if the certificates are not updated in the UEFI? Should not the update within Windows be enough? 

What manual actions are required on Windows Server operating systems (2012 through 2022) for Secure Boot certificate renewal?
I am using SCCM/Microsoft Endpoint Manager to deploy OS updates to these servers. Some documentation indicates that no manual intervention is required and that the certificates should renew automatically. However, in our environment, the Secure Boot certificates have not been renewed yet.

so looking for the clear instructions.

Please correct the error/misunderstanding regarding the GPO "Automatic Certificate Deployment via Updates"

Automatic Certificate Deployment via Updates
Enabled = HighConfidenceOptOut = 1
Disabled = HighConfidenceOptOut = 0

https://support.microsoft.com/en-us/topic/group-policy-objects-gpo-method-of-secure-boot-for-windows-devices-with-it-managed-updates-65f716aa-2109-4c78-8b1f-036198dd5ce7

>> correct description!

#######

Secure Boot playbook for certificates expiring in 2026
>> incorrect description at the End! (Should be "Enabled")

Thank you so much for this AMA

• Q1A) What happens to VMware UEFI VMs, as well as Hyper-V, Azure Local and Azure generation 2 VMs that are isolated from the Internet?
  Q1B) What is the step-by-step procedere to change their Secure Boot root certificate at scale? Especially the Platform Key (PK)?
  
  
• Q2: Is there any dependency on the root hardware for VMware ESXi hosts or Hyper-V hosts and the certificate change?
  
  
• Q3A) What happens to end user devices at home or work or physical servers which will not or never receive any UEFI firmware updates after the old root cert, especially PK expires?
  
  Answer for Q3A: 

  The device will continue to boot and function normally. However, it will no longer receive future security fixes for Windows boot manager updates or Secure Boot, compromising the security of the device. Source: General Questions, Q4

• Q3B) Will devices with the old expired (insecure) Root Certificate still be functional and booting Windows or other OSes using Secure Boot?
  If yes, how is it ensured and secure that they boot with an expired (or even tampered) certificate?
  If no, do you have a step by step guide how to remediate a relevant amount of these outdated systems at scale?
  
  Answer for Q3B:
  The device will continue to boot and function normally. However, it will no longer receive future security fixes for Windows boot manager updates or Secure Boot, compromising the security of the device. Source: General Questions, Q4.
  
  You might need to update the devices manually when the OS is still supported. How-To: Michael Niehaus (PS Module) / Gunnar Haslinger (Guide), please use Edge for in-line translation.
  
  
• Q3C) When the (Windows or Linux) OS deployed the new keys into the Firmware, and the PK remains outdated (CA2011), then the customer / user updates the Firmware, will Windows boot?
  Asking because often Firmware (UEFI / BIOS Updates) reset the keys or entering setup phase. When I understand this correctly the PK key is outdated and revert the updates made by the OS.
  What is your guidance here?
  
  Answer to Q3C:
  Resetting the DB / KEK after it has been updated with a BIOS reset / Secure Boot Reset or BIOS Update that does not contain the CA2023 PK might tamper Secure Boot - as designed - 
  Windows will stop booting due to the Secure Boot Violation. This might trigger Bitlocker, Windows Hello (PIN) and other features.
  Source: Customer / IT Managed Systems Q1 & Q7, ref to Bitlocker / Windows Hello (PIN) - based on own tests.
  
  
• Q4) Could you please describe, if any, the dependency between the OS level update process in the Windows, Windows Server or Azure Local OS and the UEFI firmware?
  
  Answer to Q4:
  For Windows Server, Hyper-V things should go well as Microsoft will try to update both DB and KEK in the VM. Before that a workaround was required.
  Source: Customer / IT Managed Systems Q5 / General Question Q7
  
  
  
• Q5) What happens to older OS that are receiving ESU, or do not receive ESU? Theoretically all devices since Windows Server 2012 R2, 8.1 could be configured with UEFI OS  Secure Boot.
  
  Answer to Q5:
  Windows OS with ESU are considered supported / eligible systems. Unsupported OSes will not receive any updates. They remain bootable but Secure Boot becomes insecure. See Q3.
  
  
• Q6A) Is there any obligation for OEMs and ISV - especially including retail mainboard manufacturers, such as MSI, Asus, Asrock, Gigabyte, Medion, Huawei, Intel etc.- to update their UEFI firmwares?
  
  Answer to Q6A:
  Appears there is no eligibity for OEMs or ISV / Retail to provide updates. Source: Please consult OEM pages. Retail is missing out. I am asking for further clarification, esp. for non OEM systems, or OEM systems that are unlisted.
  
  Q6B) what is their timeline?
  
  Q6C) will this include all mainboard models and chipsets, which still could run CPUs, certified for Windows 11? 
  Context: Thinking about some million of custom build (workstation) computers or gaming computers out there that are not "OEM" and eventually not managed by organizations.
  
  
• Q7) How can we ensure that default Windows RE partitions across the board, or custom Windows PE images are updated and compliant with the new Secure Boot root cert?
  
  
• Q8) Are Linux distros adopting this change?
  Context:
  When Microsoft adapted Secure Boot there was a large fallout with Linux distros which didn't support UEFI at all in grub /Kernel. Thankfully this has changed so no one has to turn off Secure Boot for using Windows and Linux on the same hardware.
  
  Preliminary note:
  My own tests are not running good! When Windows 11 has updated Secure Boot, Distros with older CA2011 certs cause a boot violation (as per design).
  
  
• Q9) Are other vendors adopting the change? 
  Context:
  Other vendors in business and non business bootable devices, including backup vendors, partition tools, driver and firmware updater - ISOs or USB creation tools by HPE, Dell, Seagate, Samsung etc.
  My concern is that they will keep using the expired UEFI root certs, which could deny booting.
  
  Macrium Reflect X is the first product I see that has implemented a choice for the new or old root certificate for Windows RE /PE rescue media.
   
  

  
  added Q3C, having a better understanding.
  added answers and sources, as per current availability pre this AMA event.

Is it valid to check for EventID 1808 to confirm that all certificates are updated ?

For devices that don't use autopatch (on networks not connected to Internet) will the CU have the information bundled in it to automatically kick off the high confidence deployment?

From January CU release notes:

Windows quality updates include a subset of high confidence device targeting data that identifies devices eligible to automatically receive new Secure Boot certificates

This seems to indicate applying the CU on its own is enough for this subset of devices, Windows Update/Autopatch connectivity not needed?

Hey guys 👋,

In the last Secure Boot AMA (https://techcommunity.microsoft.com/event/windowsevents/ama-secure-boot/4472784) someone asked about the UEFICA2025Status Reg Key showing an unexpected status of "NotStarted". You responded to say you would investigate and advise what to do in this situation. We have this in our environment. When will we be told what to do please?

Hi, any news/eta of the reporting capabilities in Intune to see which devices have the new cert?

thks