We are primarily a Dell environment and have deployed the MicrosoftUpdateManagedOptIn configuration across our endpoint devices (~300).

Following the May Update, we’ve executed the monitoring scripts provided:

• Detect-SecureBootCertUpdateStatus

• Aggregate-SecureBootData

Currently, over half of our devices report UEFICA2023Status = InProgress, while AvailableUpdates = 0x0.

From what we can tell, the process appears to be initiated correctly; we are seeing the expected Windows Update indication, but after reboot, the devices remain stuck in an InProgress state.

Based on the documentation, we expected the state progression to move to 0x5944 and eventually complete at 0x4000, but we are not observing that transition.

Questions:

1. Is there an additional step required (post-reboot or otherwise) to allow the process to complete?

2. Is it expected behavior for InProgress to persist with AvailableUpdates = 0x0, or does this indicate the workflow is stalled?

Also, we have a small number of where BucketId = Empty and UEFICA2023Error = 2147942750

We were unable to find clear references for this condition in the https://support.microsoft.com/en-us/topic/secure-boot-db-and-dbx-variable-update-events-37e47cf8-608b-4a87-8175-bdead630eb69.

Questions:

1. Does this error code indicate a known issue or remediation path?

2. Should the BucketId and Confidence Level populate automatically over time, or is there any administrative action required on our side to correct or trigger this?