Microsoft held its OEM Secure Boot Office Hours event on July 15, where engineers collaborated with OEM representatives from companies like Acer, Asus, Cisco, Dell, and HP. IT administrators were able to ask live questions about the Secure Boot 2023 rollout. The discussion thread became a detailed technical record, especially following the expiration of the first certificates three weeks prior. Concerns raised by IT admins included BitLocker recovery loops, stuck confidence ratings, and unhelpful Intune error codes.
Key facts include:
- Devices offline for long periods will still receive the 2023 certificates upon reconnecting to Windows Update.
- Devices with existing 2023 certificates in firmware will switch to the new boot manager after the latest Windows patches are installed.
- A new script, Detect-SecureBootCertUpdateStatus.ps1, is available in Windows for checking certificate status.
- BIOS updates may reset a device’s confidence rating to unrated, which is normal and does not indicate certificate failure.
- Admins should edit the AvailableUpdates registry key, not the AvailableUpdatesPolicy, which is managed by Intune and Group Policy.
- A licensing bug affecting AvailableUpdatesPolicy on devices upgraded from Pro to Enterprise was resolved by Microsoft in 2026.
- BitLocker recovery is not typically linked to the certificate update process but may relate to firmware or PCR issues.
- Dell and HP provided guidance on which BIOS versions include the 2023 certificates for their newer models.
- Older HP EliteBook 840 G5 units require a manual update package for the new certificates.
- Eligible devices can still receive the 2023 certificates in the future, and Surface devices released from 2024 onward come pre-equipped with them.
- Microsoft confirmed that devices running 2011 certificates will not lose the ability to receive the 2023 chain.
- The Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011 certificates have expired, with the Microsoft Windows Production PCA 2011 set to expire on October 19, 2026.