Event details
On my Azure Gen2 VM, Secure Boot reports True and the dbx entry is present with non‑volatile attributes:
- Secure Boot enabled: Confirm‑SecureBootUEFI → True
- DBX present: Get‑SecureBootUEFI -Name dbx showing active firmware data
Does this confirm that Secure Boot and the updated Secure Boot revocation list (DBX) have already been applied automatically through Windows Update or the underlying Azure platform firmware?
- Arden_White
Microsoft
For newly created VMs, the virtualized firmware should already have the new certificates in the DB and KEK. The DBX is the disallow list. I don't know what comes in the DBX on a new VM. For long running VMs (multiple years), the VM may not have the new certificates.
If you want to know if the VM is running with the new certificates and the 2023 signed boot manager, you can look at the UEFICA2023Status registry key. It should say Updated.
