Event details

Join us in May for our fourth Ask Microsoft Anything (AMA) about updating Secure Boot certificates on your Windows devices before they start expiring in June of 2026. If you've already bookmarked Sec...
Heather_Poulsen
Updated May 18, 2026
AMA
Technical Takeoff
Bhanu2027's avatar
Bhanu2027
Copper Contributor
May 18, 2026

Windows Server 2019 VM: DB entries (Windows & Microsoft UEFI CA 2023) updated successfully, but KEK still shows Microsoft KEK CA 2011. In VM (ESXi), should KEK be updated at hypervisor/firmware level or from inside Windows OS?
Could you please clarify ?

  • IvanCardim's avatar
    IvanCardim
    Icon for Microsoft rankMicrosoft
    May 18, 2026

    To ensure newly created VMs have the new certificates it needs to be updated at the hypervisor level.

    For existing VMs you need to update from inside the Windows OS.