firmware update Archives

Winsage

July 20, 2026

Enable BitLocker on Windows 11: 11 Steps, 45 Min [2026]

A stolen laptop can lead to a significant data breach, particularly when taken from public places. Windows 11 has introduced BitLocker, a full-disk encryption feature that became mandatory for Australian businesses in 2026. The Office of the Australian Information Commissioner reported 766 notifiable data breaches in the latter half of 2024, with unauthorized access to devices being a major cause. Full-disk encryption is crucial for compliance with the Essential Eight framework, which mandates data protection on portable devices. BitLocker ensures that data on an encrypted drive becomes unreadable if the drive is removed and connected to another computer. It aligns with the Essential Eight framework, requiring evidence of encryption rather than just claims of protection. There are three types of encryption on Windows 11: Device Encryption, BitLocker Drive Encryption, and File-Level Encryption. BitLocker is available only on Windows 11 Pro and higher editions. To use BitLocker, certain prerequisites must be met, including having Windows 11 Pro or higher, a Trusted Platform Module (TPM) 2.0, UEFI firmware with Secure Boot enabled, and local administrator rights. The process to enable BitLocker involves confirming the edition, checking TPM status, enabling BitLocker through Windows Settings or PowerShell, and backing up the recovery key. Organizations can deploy BitLocker fleet-wide using Microsoft Intune, and additional security measures like TPM+PIN can be implemented for pre-boot authentication. Common pitfalls during BitLocker rollout include skipping recovery key backup and assuming that Home edition machines are covered. Troubleshooting common BitLocker issues involves identifying symptoms and applying appropriate fixes. Advanced tips for enhancing security include suspending BitLocker before maintenance and auditing compliance at the fleet level. BitLocker is integral to protecting data on portable devices, and compliance documentation is essential for proving that every device has an active recovery key.

Winsage

July 18, 2026

Windows 11 Secure Boot certificates have expired, and Microsoft says what to do next

Microsoft held its OEM Secure Boot Office Hours event on July 15, where engineers collaborated with OEM representatives from companies like Acer, Asus, Cisco, Dell, and HP. IT administrators were able to ask live questions about the Secure Boot 2023 rollout. The discussion thread became a detailed technical record, especially following the expiration of the first certificates three weeks prior. Concerns raised by IT admins included BitLocker recovery loops, stuck confidence ratings, and unhelpful Intune error codes. Key facts include: - Devices offline for long periods will still receive the 2023 certificates upon reconnecting to Windows Update. - Devices with existing 2023 certificates in firmware will switch to the new boot manager after the latest Windows patches are installed. - A new script, Detect-SecureBootCertUpdateStatus.ps1, is available in Windows for checking certificate status. - BIOS updates may reset a device’s confidence rating to unrated, which is normal and does not indicate certificate failure. - Admins should edit the AvailableUpdates registry key, not the AvailableUpdatesPolicy, which is managed by Intune and Group Policy. - A licensing bug affecting AvailableUpdatesPolicy on devices upgraded from Pro to Enterprise was resolved by Microsoft in 2026. - BitLocker recovery is not typically linked to the certificate update process but may relate to firmware or PCR issues. - Dell and HP provided guidance on which BIOS versions include the 2023 certificates for their newer models. - Older HP EliteBook 840 G5 units require a manual update package for the new certificates. - Eligible devices can still receive the 2023 certificates in the future, and Surface devices released from 2024 onward come pre-equipped with them. - Microsoft confirmed that devices running 2011 certificates will not lose the ability to receive the 2023 chain. - The Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011 certificates have expired, with the Microsoft Windows Production PCA 2011 set to expire on October 19, 2026.

Winsage

July 14, 2026

Secure Boot certificate updates are broken on some PCs, Microsoft confirms

Microsoft has acknowledged that several older Secure Boot certificates have expired, necessitating updates for Windows 10 and 11 users. A temporary halt in the issuance of new Secure Boot certificates affects specific PCs, particularly various HP models. Most PCs will receive updates automatically through Windows Update, but some may require a firmware update from the manufacturer. Users may see messages indicating that Secure Boot certificate updates are paused or blocked due to known issues or hardware/firmware limitations. Until manufacturers like HP release necessary firmware updates, users cannot update their Secure Boot certificates. Although the immediate risk from expired certificates is low, it is expected to increase over time. Devices with un-updated Secure Boot certificates will continue to function normally, but they will not receive new security updates, making them vulnerable to emerging threats. Essential features that rely on updated security measures may cease to function correctly as new security challenges arise.

Winsage

July 10, 2026

Microsoft confirms Secure Boot update failing on some Windows 11 PCs, promises a resolution

Microsoft has acknowledged that some Windows 11 PCs are facing issues with Secure Boot certificate updates, which may fail to install or be blocked. The company is working with PC manufacturers to develop a patch, while users may need to take proactive measures if their certificates are obstructed. Microsoft has temporarily halted the rollout of Secure Boot for certain devices due to complications, and affected users will receive detailed error messages in the Windows Security app regarding their Secure Boot certificates. Secure Boot certificates issued in 2011 have expired, and Microsoft is replacing them with new certificates issued in 2023. Most modern hardware is already utilizing the new certificates, but some devices may have disabled Secure Boot or faulty firmware. Users can check their Secure Boot status in the Windows Security app. HP has confirmed that Secure Boot updates are being blocked on some of its PCs due to a BitLocker issue, which prevents the installation of new certificates. Microsoft has paused Secure Boot certificate updates for devices affected by known issues while collaborating with manufacturers to identify specific devices or firmware complications. A firmware update will be necessary for affected devices, but it is not yet available. The majority of PCs have received the Secure Boot certificates via Windows Update, but compatibility issues may prevent some devices from receiving the update. Older devices or those not among the OEM’s top-selling models may not receive updates if the UEFI firmware is unsupported. Secure Boot is a security feature required for Windows 11, preventing unauthorized software from executing at boot. While an expired Secure Boot certificate does not stop a PC from functioning, it may limit long-term security protection. Microsoft advises users not to disable Secure Boot, as it would compromise security further.

Winsage

June 24, 2026

Windows 11 Secure Boot update released to all, hours ahead of expiry

Microsoft has begun rolling out the Secure Boot 2023 certificate update for eligible Windows 11 and Windows 10 PCs ahead of the expiration of the original certificates on June 24, 2026. The update includes additional device targeting data to increase coverage for automatic updates. Devices receive the new certificates after demonstrating successful update signals. The original Secure Boot certificates were issued in 2011, with expiration dates set for June 24, 2026, June 27, 2026, and October 19, 2026. Microsoft has been distributing replacement 2023 certificates since 2024, with the June 2026 update expanding eligible devices significantly. Users can check their Secure Boot status through the Windows Security app or System Information. If a PC did not receive the update, it will still function normally but may not receive future boot-level security updates. Multiple restarts after updates are expected behavior, and the SecureBoot folder in Windows is not malware. Windows 10 users in the Extended Security Updates program are also receiving the Secure Boot update. The expiration of the Microsoft Corporation KEK CA 2011 on June 24 means no new Secure Boot revocation payloads can be signed with the old key, but existing signed payloads will continue to function.

Winsage

June 15, 2026

Microsoft released the Windows 11 Secure Boot update for all PCs, how to verify yours

Microsoft has expanded the rollout of the Secure Boot 2023 certificate update to more Windows 11 and Windows 10 devices with the June 2026 Patch Tuesday update (KB5094126). This update aims to ensure that most supported consumer PCs are classified as high confidence, meaning necessary certificates are either installed or will be applied automatically. Secure Boot is a firmware security feature that verifies the software attempting to load during the startup process, blocking unauthorized software. The certificates supporting Secure Boot, issued in 2011, are expiring in stages starting June 24, 2026, prompting Microsoft to deploy replacement certificates. Most home users do not need to take manual action as the updates will occur automatically via Windows Update. Users can check their Secure Boot certificate status in the Windows Security app. A yellow warning indicates pending compatibility data, while a red alert suggests a firmware incompatibility requiring a BIOS update. Multiple reboots during the update process are normal, and a new SecureBoot folder in Windows is for staging cryptographic files. Older PCs may experience longer update times, and some may not receive updates due to firmware issues. HP users should check for BIOS updates if encountering BitLocker recovery loops. IT administrators should monitor device classifications and manually initiate updates for devices not in the high confidence category. Devices with Secure Boot disabled cannot receive updates, leaving them vulnerable. The expiration of the Microsoft Corporation KEK CA 2011 certificate on June 24 does not immediately affect device functionality, but it limits Microsoft's ability to sign new bootkit blacklist updates.

Winsage

June 8, 2026

Microsoft answers what you must do as Windows 11 Secure Boot deadline hits in days

The expiration date of the original Microsoft Secure Boot KEK certificate is June 24, 2026. Microsoft held a live "Ask Microsoft Anything" session on June 4 to address concerns regarding this deadline. The expiration affects the KEK key, while the DB key remains valid until October. After June 24, Microsoft will not be able to sign new DBX payloads, which are necessary for revoking compromised bootloaders. Devices without the new KEK may miss future revocations, leading to decreased security but will not stop booting immediately. The June Patch Tuesday update is expected to classify most systems as high confidence. IT administrators are advised to use the Intune monitoring report for device status and updates. Devices in a "temporarily paused" status require OEM firmware updates. Administrators should not delay manual rollouts for devices outside the high confidence classification. Secure Boot must be enabled to update certificates, and re-enabling it later can pose risks. Older models may receive high confidence classification faster than newer ones due to statistical requirements. In PXE boot environments, caution is needed when updating bootloaders. The Secure Boot update mechanism is consistent across Windows 10 and 11, and event logs are important diagnostic tools. Key event log entries include 1801, 1802, and 1803, which indicate various device statuses and issues. Microsoft provides resources at aka.ms/GetSecureBoot for further guidance.

Winsage

May 28, 2026

Your Windows PC has a security deadline in June 2026

A Secure Boot certificate refresh is being deployed across supported Windows devices via Windows Update. The Secure Boot certificates from 2011 will begin to expire in June 2026, prompting Microsoft to introduce new 2023-dated certificates to maintain security. Most users will require minimal action if their PCs are updated, but older devices may face challenges. The current certificates include: - Microsoft Corporation KEK CA 2011: expires June 24, 2026 - Microsoft UEFI CA 2011: expires June 27, 2026 - Microsoft Windows Production PCA 2011: expires October 19, 2026 The new certificates will remain valid until 2038, with plans for post-quantum cryptography around 2030. While PCs using the 2011 certificates will continue to function, they will lose access to new security protections, making them vulnerable to emerging threats. A notable example of such a threat is the BlackLotus bootkit, which exploited vulnerabilities to bypass Secure Boot. Microsoft's rollout strategy involves a staged update process that typically takes around 48 hours and may require restarts. Users are advised to keep Windows updated and check their Secure Boot status. Known issues may arise for older PCs, systems that bypassed Windows 11 requirements, Legacy BIOS systems, and custom firmware configurations. IT teams managing devices should inventory their systems, monitor specific event IDs, test updates, and document devices that cannot be updated.

Winsage

May 26, 2026

A recent HP laptop BIOS bug is leaving high-end Windows 11 PCs stuck in an endless BitLocker recovery loop

HP laptop owners, especially those with EliteBooks, ProBooks, and ZBook workstations, are experiencing issues after a recent BIOS firmware update via Windows Update, leading to system freezes and Blue Screen of Death errors. HP has acknowledged the problem and is investigating it, noting that Microsoft’s 2023 certificates may not apply correctly during this issue. Users are advised to check the UEFICA2023Status and UEFICA2023Error registry values to assess the update process. If the UEFICA2023Status is "In Progress" for too long and UEFICA2023Error is greater than 0, the update has failed. HP recommends disabling automatic updates to avoid the problematic BIOS update and has provided a manual workaround for the BitLocker Recovery loop. Users can also revert to a stable BIOS version, though this may be challenging and may require specific hardware.

Winsage

May 12, 2026

Logitech MX Master 4 update lets you feel Windows 11 through haptics

The Logitech MX Master 4 has integrated haptic feedback on Windows 11, enhancing user experience with tactile feedback through a recent software update. This feature is available for users on Windows 11 Insider Build 26300.8155 and requires the latest firmware update for Logi Bolt, version 5.5.30. The integration allows users to feel their interactions with the PC, marking a trend in incorporating haptic technology into various devices and software.