Secure Boot Office Hours for virtualized environments - Windows Tech Community

Event details

Navigating Secure Boot certificate updates in virtualized environments? Drop in to Secure Boot Office Hours and ask your questions live in the comments. For one hour, experts will be available to dis...

Heather_Poulsen

Updated Jul 07, 2026

Occasional Reader

Jul 08, 2026

Hello!

On some Servers we are seeing "True" and a registry status of "InProgress". Are these machines updated?

(vSphere 8 - Hardware version 21)

Thanks in advance

Copper Contributor

Jul 08, 2026

If i understand correctly, you are saying KEK2023 true and registry status IN progress. Please elaborate if that's not the case

ando1
Occasional Reader
Jul 08, 2026
Yes, exactly. I couldn't post the commands, it was blocked.
- Ramakumar
  Copper Contributor
  Jul 08, 2026
  https://support.microsoft.com/help/5088864
  https://support.microsoft.com/help/5094123
  try above also pls refer to this https://support.microsoft.com/en-us/topic/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates-a7be69c9-4634-42e1-9ca1-df06f43f360d
  can sometimes take ~24 hours to “take effect”.
  
  To speed up/force the update faster, either reboot the device (a couple times for good measure) or use the Task-scheduler
  reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /fStart-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
  Open regedit, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot, and ensure the AvailableUpdates value is 0x4100.
  Reboot (so bootmanager can be applied)
  Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
  - Ramakumar
    Copper Contributor
    Jul 09, 2026
    https://support.microsoft.com/help/5088864
    https://support.microsoft.com/help/5094123
    try above