Event details
Currently there's only a GPO (ADMX) to do the update of the certificates. Are you also working on a GPO (ADMX) for the "revocation" (dbx) of the 2011 certificates?
MicrosoftHi ClientAdmin​,
Not at this time no as we have no plans on adding these certs to DBX since they are needed to validate existing boot critical components signed by these certs. Adding these certs to DBX now would completely break Windows unless we intended to update and re-sign all boot critical components with the new certs but we have no plans on doing this since there is no value in doing this.
- Jason_Sandys
Quick follow-up caveat here: revoking the PCA cert (by adding it to DBX) is something we are recommending in the long run. This is the cert used to sign the boot loader (and only the boot loader) as there is an attack vector here as was exploited some past attack(s). To be clear, this is only for the PCA cert and does not materially change my answer above.