Event details

It's time for our second Ask Microsoft Anything (AMA) about updating Secure Boot certificates on your Windows devices before they expire in June of 2026. If you've already bookmarked Secure Boot play...
Heather_Poulsen
Updated Jan 29, 2026
AMA
cjsanto's avatar
cjsanto
Copper Contributor
Feb 05, 2026

If I am not mistaken it was mentioned about updating firmware and installing related windows update. My question: Do we need to do both or just update the firmware or install the related Windows update? Thank you.

  • mihi's avatar
    mihi
    Copper Contributor
    Feb 05, 2026

    Both will have different effects. Firmware updates will fix firmware bugs and change the "default db" which is/may be used for Secure Boot if you reset your UEFI settings. OS updates will udpate the "active db" which is used by the current system.

     

    In case there are no firmware bugs related to UEFI variable updates, and you won't mess with your UEFI settings, you only "need" the Windows updates.

    If you only install the firmware updates, you will have to mess with the UEFI settings (reset UEFI settings) for it to take effect for the current system. Not recommended in case BitLocker or TPM are used.