Now that the new certificates are landing in DB, the KEK is updating, and the boot manager is being re-signed — the "deployment phase" seems well underway for most of us.

My question is about the timing of the next steps : do the optional ones (old certificate revocation in DBX, SVN update, SBAT, new DBX, ...) have an announced schedule yet? Or are we still waiting for a signal from Microsoft?

On my side, I've been building a PowerShell + XAML utility — initially developed for Lenovo devices, but designed to work on other hardware as well — that lets you visualize all Secure Boot certificate stores, the registry keys and Event IDs that Microsoft asks us to monitor, all without Intune or MDM.

Can't wait to integrate these next steps as soon as they're clarified! 😊