Event details
274 Comments
I update the servers to the point where I see the following Reg entries..
- Both Active and Default DBs show both 2023 and 2011.
- AvailableUpdates show 0x00004000
- WindowsUEFICA2023Capable registry key was set to 2
- UEFICA2023Status registry key shows “Updated”
- For Server OS I see the following:
- Server 2019/2022 I see Event ID 1808 in system log
- Server 2025 I see event 1799 in system log
Both events say that the UEFI CA 2023 was installed successfully….so does that mean the system is up to date?
However, if we run the command below, I get the return code “00” …is that a problem???
- $pk = Get-SecureBootUEFI -Name PK
- $bytes = $pk.Bytes
- $cert = $bytes[44..($bytes.Length-1)]
- [IO.File]::WriteAllBytes("PK.der", $cert)
- certutil -dump PK.der
You can view PK and KEK certificates, as well as DB and DBX certificates and hashes, using my PowerShell script Get-UEFICertificate PowerShell script. You can install it from the PowerShell gallery here.
Install-Script -Name Get-UEFICertificate -Scope CurrentUser
GitHub: https://github.com/richardhicks/uefi.
Not sure why you are trying to manually extract a certificate from the PK variable with some magic offsets. I don't know if that will work every time.
But you are lucky, March updates, Get-SecureBootUEFI learned a new -decoded switch which can decode the PK for you.
Follow up on earlier SCCM boot.wim questions:
Can we continue using the boot.wim with 2011 cert past June 2026?
Will that work successfully with devices that only have 2011 cert?
Will devices that have 2023 cert already require a boot.wim that has 2023 cert once June 2026 has passed?
(We have thousands of devices in storage, and need to know sooner, rather than later, if they need to get updated pre-June 2026)- Jason_Sandys
Microsoft
Nothing changes instantly in June or when the certs expire. The boot critical components signed by these certs are still trusted and valid and devices will continue to boot fine as the certs themselves are still "trusted".
Answers
- Yes, the old certs are still trusted as noted.
- Yes, same reason.
- No, device will trust both old and new certs.
Note that a better path though is to begin your Intune and Autopilot journey.
- Pearl-Angeles
Community Manager
Your 3rd question was addressed at 49:00 during the live AMA.
I manually updated the registry on a device, set it to 22852, and forced the Scheduled Task to start, waited 30 seconds and forced a reboot, and the server (server 2019 VM in hyperv with the latest march patches) and it restarted several more times on its own before it settled down and showed updated. Not sure if several reboots are going to be required every time, of if me forcing things my running the scheduled task had this effect.
Oke so we’re pretty much trying to get it in control. So I am wondering the PK (platform key) isn’t present in our hypervisor version at this moment. What does this mean for the whole chain?
cause we have a well guided plan aligned with Microsoft their approval. But after running the workflow 0x5944 , en you go to 0x4100 and after a while you get the 0x4000. This means the flow is done. After this you have the remaining 0x280 (revocation of PCA2011 , and applying SVN). After this you are done.
reading the march update there is this line:
KB5079473
Secure Boot] With this update, Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Devices receive the new certificates only after demonstrating sufficient successful update signals, maintaining a controlled and phased rollout.
could you tell us more about this? - my guess is that you need telmetry on to have this nice feature/support?
You need somebody else with your exact hardware configuration (bucket id) to have telemetry on. The HighConfidenceBuckets cab file is included in the update, so all devices that have same bucket ID will receive the update, even if that individual device has telemetry off or is not even connected to the Internet.
Does Server 2025 automagically comply?
Both fresh install & Server 2022 update?
- Pearl-Angeles
Your questions were also answered at 47:15 during the live AMA. For more info, go to aka.ms/SecureBootForServer
- Ashis_Chatterjee
No, Server 2025 does not automagically comply. They will need to be updated using the methods outlined Secure Boot guidance
Will Microsoft apply the new certs in newer GA releases? Cause when download a fresh image form the VLK repo this is still shipped with PCA 2011
VMware has not yet released an updated virtual hardware/BIOS package for this issue (only manual steps). Do we need to worry about the virtual hardware/Bios update offered by VMware if we’re already seeing the “Updated”/ WindowsUEFICA2023Capable =2 results we’re getting now within the registry? We also get the result of “True” using the verification command - ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).Bytes)) -match "Windows UEFI CA 2023". From a compliance perspective, does this mean we’re covered? For that matter, do we even need to rename the NVRAM File?
We’ve also noticed that on some of our Server 2025 systems, even when the certificates seemingly updates itself successfully, the Secure Boot scheduled task fails with a “file not found” error. Is there a way to correct this? We are not sure how to address this. It appears to be a built‑in, “solid‑state” task.
Hello, I have deployed the secure boot remediation through Intune and I see event ID 1801 that says the certificates are available but not applied and the BucketConfidenceLevel shows Need more data. Do i need to take any action on that ?
- Pearl-Angeles
Thanks for participating in this AMA! Your question was answered at 29:37.
Can Secure Boot certificates be updated when Secure Boot is disabled? Microsoft’s AvailableUpdates process errors out unless Secure Boot is enabled. If a device won’t boot Windows with Secure Boot on, how can we bring it into compliance?
- Pearl-Angeles
Your question was answered during the live AMA at 42:14. Follow aka.ms/GetSecureBoot for the latest updates and new tools/guides.
- Ashis_Chatterjee
If Secure Boot is disabled, the device is compliant. Secure Boot certificate update compliance is applicable only to devices that have Secure Boot enabled
Looks like there have been reports online of users receiving driver updates that are requiring bitlocker keys to be entered after reboot. Is this expected behavior? If the certs were already installed via policy still get prompted from driver updates?
Is there a way to know what driver updates in Intune actually have the drivers that potentially can cause bitlocker keys to be entered? Naming conventions in Intune for drivers are a bit difficult to decipher.
- Pearl-Angeles
Thanks for your question! This topic was covered at 33:02 during the live AMA.
What happens in June when the current Secure Boot certificates expire? Will devices with Secure Boot still boot if their EFI partition is signed with the 2011 certificate? If so, how long past June will they continue to boot, and will they eventually stop?
- Ashis_Chatterjee
Yes, it will continue to boot. There is no specific date when it will stop booting.
