Event details

Navigating Secure Boot certificate updates in virtualized environments? Drop in to Secure Boot Office Hours and ask your questions live in the comments. For one hour, experts will be available to dis...
Heather_Poulsen
Updated Jul 07, 2026
Office Hours
ando1's avatar
ando1
Occasional Reader
Jul 08, 2026

Hello!

On some Servers we are seeing "True" and a registry status of "InProgress". Are these machines updated?

(vSphere 8 - Hardware version 21)

Thanks in advance

  • Prabhakar_MSFT's avatar
    Prabhakar_MSFT
    Icon for Microsoft rankMicrosoft
    Jul 08, 2026

    Hello ando1​ , Are you referring to True output for Windows UEFI CA 2023 or Microsoft UEFI CA 2023 certs? on VMWare based VMs, KEK certificate installation currently fails and Broadcom is collaborating with Microsoft to bring support for KEK certificate update in the future update. Please follow the KB article    https://knowledge.broadcom.com/external/article/423893/secure-boot-certificate-expirations-and.html From Broadcom for guidance and updates 

  • Ramakumar's avatar
    Ramakumar
    Copper Contributor
    Jul 08, 2026

    If i understand correctly, you are saying KEK2023 true and registry status IN progress. Please elaborate if that's not the case

    • ando1's avatar
      ando1
      Occasional Reader
      Jul 08, 2026

      Yes, exactly. I couldn't post the commands, it was blocked.

      • Ramakumar's avatar
        Ramakumar
        Copper Contributor
        Jul 08, 2026

         https://support.microsoft.com/help/5088864

        https://support.microsoft.com/help/5094123 

        try above also pls refer to this https://support.microsoft.com/en-us/topic/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates-a7be69c9-4634-42e1-9ca1-df06f43f360d

        can sometimes take ~24 hours to “take effect”.
         
        To speed up/force the update faster, either reboot the device (a couple times for good measure) or use the Task-scheduler

        • reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /fStart-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
        • Open regedit, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot, and ensure the AvailableUpdates value is 0x4100.
        • Reboot (so bootmanager can be applied)
        • Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"