I know this AMA is focused on Windows Server, but I am hoping the team can clarify the Windows Security status behavior for Secure Boot certificate updates.

On a supported Windows 11 device, Windows Security shows that Secure Boot is on, but the automated Secure Boot certificate update cannot complete because of hardware or firmware limitations, and it says to contact the manufacturer.

The OEM support article lists the model as supported for the new Secure Boot certificates, but the OEM download page does not yet show an obvious newer firmware package for the device. Windows Update has installed an optional firmware-related update, but the Windows Security warning remains after multiple restarts.

My questions are:

1. Can this Windows Security warning appear temporarily while a supported device is still waiting for the correct Windows Update / OEM firmware rollout, or does it always mean the device is truly blocked?
2. For consumer Windows 11 devices, what is the safest way to distinguish “eligible but still waiting” from “manufacturer action required”?
3. Should users avoid manual BIOS changes and wait for Windows Update / Optional Updates unless the OEM provides specific guidance?
4. Is there a recommended Windows Security status message or event log location that confirms whether the Secure Boot certificate update is pending, failed, blocked, or fully applied?

I am trying to follow the Microsoft-recommended update path without making unnecessary firmware changes.

Hi guys 👋, if we used Intune/Microsoft's CFR to update our Secure Boot certificates on devices, and the Intune SB report status shows the certificates are green/"up to date" for each device record, does the "up to date" status include revocation of the old 2011 boot managers (DBX)? If not, when will Microsoft revoke them please? And could you share instructions to revoke them manually ourselves sooner if needed please? Thank you! 🙏