NewApp Digest
search bot

certificates

Microsoft Defender Adds Dashboard for 2011 Secure Boot Certificates
Winsage
May 3, 2026

Microsoft Defender Adds Dashboard for 2011 Secure Boot Certificates

Microsoft has introduced a feature in the Microsoft Defender dashboard to help IT managers identify devices using 2011 Secure Boot certificates, which expire in June of this year. The recommendation view categorizes devices into three groups: Exposed Devices (trust outdated certificates), Compliant Devices (use new 2023 certificates), and Not Applicable Devices (Secure Boot disabled or unsupported). The dashboard provides a centralized overview of device security status and the distribution of 2023 certificates, allowing filtering by operating system and device context. Devices without the new certificates will still boot but may lack the latest protection during the early boot phase, exposing them to threats. Microsoft does not automatically distribute new certificates via Windows updates on servers, requiring manual action from administrators. The dashboard aids IT teams in prioritizing action on Exposed Devices and exporting data for collaboration.
Windows AI Recall is pushing data destruction upstream
Winsage
April 30, 2026

Windows AI Recall is pushing data destruction upstream

The introduction of Copilot+ PCs has created new complexities in IT asset disposition (ITAD), as these devices may contain a comprehensive, time-stamped archive of user activity, which was not present on corporate laptops two years ago. Microsoft's Recall feature captures user activity screenshots and stores them securely, but recent research by Alexander Hagenah suggests that the safeguards may be ineffective, as his tool can extract sensitive data without breaking encryption. Microsoft defends the security of Recall, stating that observed access patterns align with intended protections. This situation presents challenges for ITAD operators, as pre-collection now constitutes a data-destruction event, requiring devices to be powered down or purged before leaving the client’s environment. Certificates of sanitization must evolve to address the specific destruction of Recall snapshot stores, and conversations with clients should differentiate between managed and unmanaged fleets regarding Recall settings. The presence of Recall shifts some data-destruction responsibilities upstream to clients, complicating traditional ITAD value propositions.
Windows 11 now shows if your Secure Boot certificates are ready for June
Winsage
April 24, 2026

Windows 11 now shows if your Secure Boot certificates are ready for June

Windows 11 has introduced a feature that allows users to verify the status of their Secure Boot certificates directly from system settings, simplifying the process ahead of the June 2026 expiration deadline. This update enhances accessibility and empowers users to maintain system security against vulnerabilities. Secure Boot helps prevent unauthorized software and malware from loading during startup, and confirming certificate status can mitigate risks associated with system breaches.
Microsoft Changes Windows Security After 15 Years—Update By ‘End Of April’
Winsage
April 22, 2026

Microsoft Changes Windows Security After 15 Years—Update By ‘End Of April’

Microsoft is set to expire the Secure Boot authentication certificates that protect Windows PCs from threats upon each restart, with this initiative beginning in April 2023. The update will install new certificates and confirm if user action is necessary, with all devices expected to have the update by the end of April 2026. Users can check their Secure Boot status in Windows Security, where a badge system indicates the status. If the certificates expire, users may be at risk of boot-level malware. Microsoft is enhancing visibility of Secure Boot certificate status to aid user awareness. Users should check their PC by the end of the month to ensure it is updated.
silver Android smartphone
Winsage
April 22, 2026

Microsoft Changes Windows Security After 15 Years—Update By ‘End Of April’

Microsoft is updating the Secure Boot certificates for Windows PCs, which have been in place since 2011. This update will begin with the April security patch rollout and is expected to be fully deployed across PCs by the end of April 2026. Users can check the status of the Secure Boot update by navigating to Windows Security > Device security > Secure Boot, where a color-coded badge will indicate the current status. The update will install new certificates and confirm if user action is necessary. If the badge is red, immediate attention is required. Microsoft is enhancing the visibility of the Secure Boot certificate status within Windows Security to aid users in verifying the update. The certificates will not expire for several more weeks, so users should check their systems by the end of the month.
Microsoft April Update Forces BitLocker Recovery on Servers
Winsage
April 16, 2026

Microsoft April Update Forces BitLocker Recovery on Servers

A recent Microsoft security update, April 2026 KB5082063, has caused issues for administrators of Windows Server 2025 and Windows 11 systems, with many devices entering BitLocker recovery mode after reboot, requiring a 48-digit recovery key. This issue primarily affects enterprise-managed systems with specific TPM Group Policy settings involving PCR7 validation. Similar problems have been reported with updates KB5083769 and KB5082052 on Windows 11. The issue arises from five conditions: BitLocker must be enabled on the OS drive, the Group Policy must include PCR7, the msinfo32.exe tool must show Secure Boot State PCR7 Binding as “Not Possible,” the Windows UEFI CA 2023 certificate must be in the Secure Boot Signature Database, and the device must not be using the 2023-signed Windows Boot Manager. Microsoft suggests two workarounds: removing the TPM validation Group Policy before the update and re-enabling BitLocker, or applying a Known Issue Rollback (KIR) before installation. Skipping the April updates is not advisable due to the addressing of 167 vulnerabilities, including two zero-days. BitLocker recovery issues following updates have been recurring since 2022, with similar incidents reported in August 2022, August 2024, and May 2025, indicating ongoing challenges with Secure Boot certificates and TPM validation bindings in enterprise environments.
Microsoft's latest Windows update now confirms if your PC is Secure Boot-protected
Winsage
April 16, 2026

Microsoft’s latest Windows update now confirms if your PC is Secure Boot-protected

Microsoft has introduced a new feature in Windows 11 and Windows 10 that informs users about the status of Secure Boot as part of the April Patch Tuesday update. This feature includes a visual indicator that shows whether devices have the latest Secure Boot certificates, which protect against bootkit malware. The Secure Boot icon can display in green, yellow, or red, indicating different security statuses: green means secure with no actions needed, yellow indicates a pending safety recommendation, and red signals that immediate attention is required. Users can check their Secure Boot status through Settings in both operating systems. It is important to install the latest Windows updates to ensure devices have the most recent Secure Boot certificates, as older certificates will expire in June. The April updates also address 164 vulnerabilities, including eight classified as critical and two identified as zero-day flaws. Users are advised to prioritize these updates to maintain system security.
Search