OEM Archives

Winsage

July 29, 2026

Missed Windows 11 Secure Boot? Don’t panic, Microsoft is still pushing it in the coming months

Microsoft reassured Windows 11 and Windows 10 users that their PCs will continue to boot normally and receive updates even if they have not yet received the new Secure Boot 2023 certificates. The rollout of these certificates is expected to continue over the upcoming months. The initial Secure Boot certificate expired on June 24, 2026, and Microsoft has been replacing older 2011 certificates since 2024. The latest update, KB5101650, transitioned Windows 11 to OS builds 26200.8875 and 26100.8875 for versions 25H2 and 24H2, respectively. The 2023 certificates replace older certificates with modern cryptographic standards, allowing Microsoft to deliver DBX revocation updates without interruption. Devices using the 2011 KEK can only receive DBX updates signed with that key, which is no longer valid after June 24. Microsoft has been rolling out the 2023 certificates for the past two years, and many devices remained in a yellow or red status by the June deadline. To check Secure Boot status, users can navigate to Windows Security > Device Security. A green checkmark indicates successful application of the certificates, while yellow and red alerts indicate compatibility issues or firmware incompatibility. PCs that are older or operating in Legacy BIOS mode will not receive the updates. Windows 10 also receives Secure Boot updates, but enrollment in Extended Security Updates (ESU) is required.

Winsage

July 24, 2026

Microsoft intervenes after LG gets caught installing McAfee adware onto Windows 11 PCs via their monitors

LG monitors were found to automatically install adware when connected to Windows PCs, leading to intrusive popups promoting applications like McAfee. In response to user backlash, Microsoft intervened and confirmed that LG has agreed to stop displaying McAfee ads in monitor popups. The adware was installed through a monitor app that downloaded automatically with the monitor connection, which previously included advertising popups. It is currently unclear if LG will permanently eliminate these ads.

Winsage

July 24, 2026

Microsoft is cracking down on Windows 11 bloatware ads, forces LG to pull McAfee popup

LG will disable the McAfee ad pop-up in its Monitor App Installer following consumer dissatisfaction and Microsoft's intervention. Users reported that the app was silently installed via Windows Update, leading to unsolicited McAfee trial ads. LG stated that McAfee is not installed without user consent and blamed Microsoft's distribution process, but many users experienced the pop-up without prior consent. Microsoft confirmed LG's agreement to disable the pop-up within three days, emphasizing a commitment to improving user experience. The incident highlights concerns over silent installations and the necessity of third-party antivirus software for Windows 11 users.

Winsage

July 19, 2026

Windows 11 Secure Boot is a messy ride on older PCs, and even Microsoft can’t fix it

Microsoft held an OEM Secure Boot Office Hours event with manufacturers like Acer, Asus, Dell, and HP to discuss issues related to the Windows 11 Secure Boot 2023 certificate rollout. Many IT administrators left with unresolved concerns, particularly regarding Secure Boot certificate errors. Participants reported persistent problems, including failures of suggested solutions from official documentation to apply to their hardware configurations. Ed Tittel shared his experience with compliance issues related to CA-2023 certificates, noting that ASUS motherboards sometimes required Secure Boot to be disabled temporarily, while MSI models exhibited erratic behavior. ASRock systems needed manual key resets, and documentation was lacking. Devices from Dell, HP, and Lenovo performed better but still faced staggered rollouts and required multiple reboots for BIOS updates. Specific issues raised included HP's BitLocker recovery loop persisting even with the latest BIOS, challenges with legacy device support from HP, devices showing Secure Boot Status as Unknown, and failures in updating the KEK on HP EliteBooks. Some questions from IT administrators regarding Dell and HP went unanswered during the session. The experiences highlighted a trend of Secure Boot issues across multiple OEMs, not limited to a single vendor. IT administrators are advised to pilot updates on representative hardware, back up BitLocker recovery keys, and consult OEM-specific advisories. The unresolved issues reflect common challenges faced by users, indicating that problems with Secure Boot certificate deployments are widespread across various manufacturers.

Winsage

July 18, 2026

Windows 11 Secure Boot certificates have expired, and Microsoft says what to do next

Microsoft held its OEM Secure Boot Office Hours event on July 15, where engineers collaborated with OEM representatives from companies like Acer, Asus, Cisco, Dell, and HP. IT administrators were able to ask live questions about the Secure Boot 2023 rollout. The discussion thread became a detailed technical record, especially following the expiration of the first certificates three weeks prior. Concerns raised by IT admins included BitLocker recovery loops, stuck confidence ratings, and unhelpful Intune error codes. Key facts include: - Devices offline for long periods will still receive the 2023 certificates upon reconnecting to Windows Update. - Devices with existing 2023 certificates in firmware will switch to the new boot manager after the latest Windows patches are installed. - A new script, Detect-SecureBootCertUpdateStatus.ps1, is available in Windows for checking certificate status. - BIOS updates may reset a device’s confidence rating to unrated, which is normal and does not indicate certificate failure. - Admins should edit the AvailableUpdates registry key, not the AvailableUpdatesPolicy, which is managed by Intune and Group Policy. - A licensing bug affecting AvailableUpdatesPolicy on devices upgraded from Pro to Enterprise was resolved by Microsoft in 2026. - BitLocker recovery is not typically linked to the certificate update process but may relate to firmware or PCR issues. - Dell and HP provided guidance on which BIOS versions include the 2023 certificates for their newer models. - Older HP EliteBook 840 G5 units require a manual update package for the new certificates. - Eligible devices can still receive the 2023 certificates in the future, and Surface devices released from 2024 onward come pre-equipped with them. - Microsoft confirmed that devices running 2011 certificates will not lose the ability to receive the 2023 chain. - The Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011 certificates have expired, with the Microsoft Windows Production PCA 2011 set to expire on October 19, 2026.

Winsage

July 15, 2026

Dell PCs are shutting down after Windows 11’s July update, Microsoft admits and blocks it

Microsoft has blocked the Windows 11 July 2026 update (KB5101650) on certain Dell PCs due to issues causing unexpected shutdowns, diminished performance, excessive heat, and battery drain. The problems are linked to the Intel Innovation Platform Framework Processor Participant driver, which affects power management. The complications stem from an optional June 2026 update (KB5095093) that introduced changes impacting the performance of some Dell PCs. Microsoft has not provided a list of affected models but is working with Dell to resolve the issue. The July update has been preemptively blocked from installation on incompatible devices, and a resolution is expected soon.

Winsage

July 13, 2026

Watch out Windows users, a Secure Boot update has been blocked on Windows 11 PCs due to failing on some devices — here’s how to check if you’re affected

Microsoft has blocked Secure Boot updates on certain Windows 11 devices due to complications in transitioning from the 2011 Secure Boot certificate to the 2023 certificate. The rollout of the 2023 certificate has faced challenges, particularly on devices with firmware issues. HP is issuing a BIOS update to help with the installation of the latest Secure Boot certificate, and Microsoft is providing an update for users to verify their Secure Boot status. Users are advised to check for pending Windows updates and consult their OEM’s Secure Boot support page for compatibility information.

Winsage

July 12, 2026

This unofficial PowerShell script for improving Windows 11 gets a useful driver feature

This weekend, discussions emerged reflecting user frustration with Windows 11 and Microsoft products, particularly regarding updates. A recent cumulative update introduced a customizable Start menu but also fixed a bug that was consuming users' storage. Microsoft has mandated that users cannot ignore these updates, contributing to dissatisfaction. Many users are opting for third-party applications like Files and Win11Debloat as alternatives to the native Explorer app. The latest version of Win11Debloat, released on July 11, 2026, includes features to prevent automatic installation of unwanted OEM apps with drivers, a reboot warning for certain functions, and various fixes and enhancements. Notable additions include support for WhatIf in Get.ps1, disabling Windows Notifications, and improvements in handling registry-backup load failures. The app is available on its official GitHub repository or through the Neowin software stories page.

Winsage

July 10, 2026

Microsoft confirms Secure Boot update failing on some Windows 11 PCs, promises a resolution

Microsoft has acknowledged that some Windows 11 PCs are facing issues with Secure Boot certificate updates, which may fail to install or be blocked. The company is working with PC manufacturers to develop a patch, while users may need to take proactive measures if their certificates are obstructed. Microsoft has temporarily halted the rollout of Secure Boot for certain devices due to complications, and affected users will receive detailed error messages in the Windows Security app regarding their Secure Boot certificates. Secure Boot certificates issued in 2011 have expired, and Microsoft is replacing them with new certificates issued in 2023. Most modern hardware is already utilizing the new certificates, but some devices may have disabled Secure Boot or faulty firmware. Users can check their Secure Boot status in the Windows Security app. HP has confirmed that Secure Boot updates are being blocked on some of its PCs due to a BitLocker issue, which prevents the installation of new certificates. Microsoft has paused Secure Boot certificate updates for devices affected by known issues while collaborating with manufacturers to identify specific devices or firmware complications. A firmware update will be necessary for affected devices, but it is not yet available. The majority of PCs have received the Secure Boot certificates via Windows Update, but compatibility issues may prevent some devices from receiving the update. Older devices or those not among the OEM’s top-selling models may not receive updates if the UEFI firmware is unsupported. Secure Boot is a security feature required for Windows 11, preventing unauthorized software from executing at boot. While an expired Secure Boot certificate does not stop a PC from functioning, it may limit long-term security protection. Microsoft advises users not to disable Secure Boot, as it would compromise security further.

Winsage

July 10, 2026

Microsoft’s new Windows 11 recovery tool is the ultimate Undo button

On July 19, 2024, at 12:09 AM EDT, 8.5 million Windows PCs, including devices from half of the Fortune 500 companies and the leading U.S. cybersecurity agency, experienced a catastrophic failure due to the Blue Screen of Death, leading to reboot loops. IT teams had to physically access each machine to resolve the issue by removing a problematic CrowdStrike file. CrowdStrike released an automated remediation tool three days later, on July 22. Microsoft pledged to improve Windows' resilience, introducing Quick Machine Recovery nearly a year later. Microsoft unveiled a new recovery feature called Point-in-time Restore, which allows users to revert their PCs to a previous state when functioning correctly. This feature generates daily snapshots of the entire system using the Volume Shadow Copy Service, retaining the three most recent snapshots and consuming minimal disk space (typically 2% of the system drive). Users can access the restore point through the Windows Recovery Environment after three failed startups, with the restoration process taking 30 to 45 minutes. Point-in-time Restore differs from System Restore, which creates less comprehensive snapshots and preserves document files. Point-in-time Restore is automatically enabled for systems with at least 200 GB drives in retail or OEM editions of Windows Home or Pro, while it must be manually activated for smaller drives. In Windows 11 Enterprise edition, it is disabled by default and may require administrative approval to activate. The feature intelligently manages disk usage, discarding older snapshots as needed, but users must enter a BitLocker recovery key if their system drive is encrypted. Users are warned about the risk of losing unsaved work when applying a restore snapshot, and reversing the operation is not straightforward.