UEFI Archives

Winsage

July 20, 2026

Enable BitLocker on Windows 11: 11 Steps, 45 Min [2026]

A stolen laptop can lead to a significant data breach, particularly when taken from public places. Windows 11 has introduced BitLocker, a full-disk encryption feature that became mandatory for Australian businesses in 2026. The Office of the Australian Information Commissioner reported 766 notifiable data breaches in the latter half of 2024, with unauthorized access to devices being a major cause. Full-disk encryption is crucial for compliance with the Essential Eight framework, which mandates data protection on portable devices. BitLocker ensures that data on an encrypted drive becomes unreadable if the drive is removed and connected to another computer. It aligns with the Essential Eight framework, requiring evidence of encryption rather than just claims of protection. There are three types of encryption on Windows 11: Device Encryption, BitLocker Drive Encryption, and File-Level Encryption. BitLocker is available only on Windows 11 Pro and higher editions. To use BitLocker, certain prerequisites must be met, including having Windows 11 Pro or higher, a Trusted Platform Module (TPM) 2.0, UEFI firmware with Secure Boot enabled, and local administrator rights. The process to enable BitLocker involves confirming the edition, checking TPM status, enabling BitLocker through Windows Settings or PowerShell, and backing up the recovery key. Organizations can deploy BitLocker fleet-wide using Microsoft Intune, and additional security measures like TPM+PIN can be implemented for pre-boot authentication. Common pitfalls during BitLocker rollout include skipping recovery key backup and assuming that Home edition machines are covered. Troubleshooting common BitLocker issues involves identifying symptoms and applying appropriate fixes. Advanced tips for enhancing security include suspending BitLocker before maintenance and auditing compliance at the fleet level. BitLocker is integral to protecting data on portable devices, and compliance documentation is essential for proving that every device has an active recovery key.

Winsage

July 20, 2026

Windows 11 Version 26H2 Ships as an Enablement Package With No New Features Over 25H2

Microsoft is set to release Windows 11 version 26H2, an enablement package based on version 25H2, without introducing new features at launch. The update will require only a single restart for devices on versions 25H2 or 24H2, while users on older versions, such as 23H2 or Windows 10, will need a full feature update. Both versions share identical features and are built on the same platform, with version 26H2 using build numbers in the 26300 series. The update process will vary depending on the current version, and version 26H2 will not change hardware requirements. Microsoft plans a gradual rollout of the update, initially as an optional install. Version 26H2 aims to extend support, adding approximately a year to the support timeline, with version 25H2 support continuing until October 2027. Users should verify their current version and back up important files before upgrading.

Winsage

July 19, 2026

Windows 11’s big 2026 update is almost here, and these 10 things you need to know before upgrading could save you time and frustration

Microsoft is set to launch the 2026 Update for Windows 11, known as version 26H2, later this year. This will be the fifth feature update for the operating system. The upgrade from version 25H2 to 26H2 will utilize an Enablement Package (eKB), allowing for a transition similar to a standard monthly cumulative update without requiring a full reinstallation. Users can also upgrade from Windows 10 using an ISO file or Microsoft installation media, which ensures files, applications, and settings remain intact. Upgrading to version 26H2 extends the support lifecycle of devices by an additional year, with Microsoft providing 24 months of support for Home and Pro editions and 36 months for Enterprise and Education editions. Version 25H2 will continue to receive support until October 2027, and users are advised to plan upgrades before this support ends. Windows 11 version 26H2 has the same hardware requirements as version 25H2, which include a 1GHz processor with at least two cores, 4GB of RAM, 64GB of storage, UEFI firmware with Secure Boot, TPM version 2.0, DirectX 12 compatible graphics, and a high-definition display. The rollout of the update will be gradual, following a Controlled Feature Rollout (CFR) strategy, meaning not all devices will receive the update immediately.

Winsage

July 18, 2026

Windows 11 Secure Boot certificates have expired, and Microsoft says what to do next

Microsoft held its OEM Secure Boot Office Hours event on July 15, where engineers collaborated with OEM representatives from companies like Acer, Asus, Cisco, Dell, and HP. IT administrators were able to ask live questions about the Secure Boot 2023 rollout. The discussion thread became a detailed technical record, especially following the expiration of the first certificates three weeks prior. Concerns raised by IT admins included BitLocker recovery loops, stuck confidence ratings, and unhelpful Intune error codes. Key facts include: - Devices offline for long periods will still receive the 2023 certificates upon reconnecting to Windows Update. - Devices with existing 2023 certificates in firmware will switch to the new boot manager after the latest Windows patches are installed. - A new script, Detect-SecureBootCertUpdateStatus.ps1, is available in Windows for checking certificate status. - BIOS updates may reset a device’s confidence rating to unrated, which is normal and does not indicate certificate failure. - Admins should edit the AvailableUpdates registry key, not the AvailableUpdatesPolicy, which is managed by Intune and Group Policy. - A licensing bug affecting AvailableUpdatesPolicy on devices upgraded from Pro to Enterprise was resolved by Microsoft in 2026. - BitLocker recovery is not typically linked to the certificate update process but may relate to firmware or PCR issues. - Dell and HP provided guidance on which BIOS versions include the 2023 certificates for their newer models. - Older HP EliteBook 840 G5 units require a manual update package for the new certificates. - Eligible devices can still receive the 2023 certificates in the future, and Surface devices released from 2024 onward come pre-equipped with them. - Microsoft confirmed that devices running 2011 certificates will not lose the ability to receive the 2023 chain. - The Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011 certificates have expired, with the Microsoft Windows Production PCA 2011 set to expire on October 19, 2026.

Winsage

July 10, 2026

Microsoft confirms Secure Boot update failing on some Windows 11 PCs, promises a resolution

Microsoft has acknowledged that some Windows 11 PCs are facing issues with Secure Boot certificate updates, which may fail to install or be blocked. The company is working with PC manufacturers to develop a patch, while users may need to take proactive measures if their certificates are obstructed. Microsoft has temporarily halted the rollout of Secure Boot for certain devices due to complications, and affected users will receive detailed error messages in the Windows Security app regarding their Secure Boot certificates. Secure Boot certificates issued in 2011 have expired, and Microsoft is replacing them with new certificates issued in 2023. Most modern hardware is already utilizing the new certificates, but some devices may have disabled Secure Boot or faulty firmware. Users can check their Secure Boot status in the Windows Security app. HP has confirmed that Secure Boot updates are being blocked on some of its PCs due to a BitLocker issue, which prevents the installation of new certificates. Microsoft has paused Secure Boot certificate updates for devices affected by known issues while collaborating with manufacturers to identify specific devices or firmware complications. A firmware update will be necessary for affected devices, but it is not yet available. The majority of PCs have received the Secure Boot certificates via Windows Update, but compatibility issues may prevent some devices from receiving the update. Older devices or those not among the OEM’s top-selling models may not receive updates if the UEFI firmware is unsupported. Secure Boot is a security feature required for Windows 11, preventing unauthorized software from executing at boot. While an expired Secure Boot certificate does not stop a PC from functioning, it may limit long-term security protection. Microsoft advises users not to disable Secure Boot, as it would compromise security further.

Winsage

July 4, 2026

I found a hidden way to limit RAM on Windows 11, and the results were way more surprising than I expected

Windows 11 allows users to limit RAM usage through the System Configuration tool (msconfig) for testing and troubleshooting purposes. Users can specify the maximum memory in megabytes, but there is no simple option to set a fixed amount like "4GB of RAM." Limiting RAM can degrade performance and may cause applications to become sluggish. To limit RAM, users must navigate to the Boot tab in msconfig, check the Maximum memory option, and enter the desired amount. To restore full RAM access, users need to uncheck the Maximum memory option in the same tool. On some modern systems with UEFI firmware and Secure Boot enabled, the Maximum memory setting may not be accessible, and disabling Secure Boot may be necessary to apply the limit. Disabling Secure Boot can reduce security against boot-level malware.

Winsage

July 4, 2026

How to Enable Windows 11 CPU Boost

Modern processors can automatically adjust their clock speeds based on demand. Windows 11 includes a feature called CPU boost that allows users to manage CPU performance responsiveness, balancing power efficiency and performance. CPU boost modifies how often Windows prompts the CPU to enter boosted states without changing the maximum turbo speed or hardware limitations. Users can select aggressive settings for improved responsiveness or less aggressive modes for reduced heat and power consumption. To enable CPU boost, users can either modify the Registry Editor or use a command in the Command Prompt. Once enabled, users can configure their preferences in the Control Panel under Power Options. Available boost mode settings include Disabled, Enabled, Aggressive, Efficient Enabled, and Efficient Aggressive, with options varying by CPU model and Windows version. Monitoring performance and system metrics after selecting a mode is recommended.

Winsage

July 1, 2026

An enthusiast ran Windows 11 on a PC from 2003 with DDR1 and AGP, and played Half-Life 2

A modder demonstrated Windows 11 running on a vintage system with a Core 2 Quad Q6600 processor, DDR1 RAM, and an ATI Radeon HD 4650 AGP graphics card, achieving stable performance with games like Half-Life 2 and Crysis. The setup utilized an ASRock ConRoe865PE motherboard with an Intel i865PE chipset and required some "hacking interventions" for hardware compatibility, including launching the AGP 8X interface and activating H.264 video decoding. The Radeon HD 4650 AGP used Windows 7 64-bit drivers from 2012. The modder noted that Windows 11 officially supports BIOS systems via Windows 11 IoT, contributing to its stability on older hardware. The system's performance was enhanced by a Toshiba THNSNJ512GCSU solid-state drive (SSD). Additionally, another modder doubled the performance of a GeForce GTX 1650 by increasing its VRAM to 8 GB, and a different modder compressed GTA V to 2.5 GB.

Winsage

June 29, 2026

OEMs reveal Windows 11 Secure Boot fix after deadline passes, here’s how to update your PC

Major PC manufacturers, including HP, Dell, ASUS, Lenovo, MSI, Acer, Samsung, LG, and Microsoft’s Surface division, have provided guidance on transitioning to new Secure Boot certificates as the expiration of Microsoft’s 2011 certificates approaches. The expiration will occur in three phases: Microsoft Corporation KEK CA 2011 expired on June 24, 2026; Microsoft UEFI CA 2011 expired on June 27, 2026; and Microsoft Windows Production PCA 2011 is set to expire on October 19, 2026. Microsoft has begun rolling out replacement certificates through Windows Update, contingent on OEMs providing compatible BIOS updates. ASUS offers detailed documentation for both consumer and commercial devices, confirming that most users will receive updates automatically. Lenovo provides direct download links for BIOS updates organized by product family and specifies which products will not receive updates. Dell's support article covers its entire product lineup, noting that devices with an End of Service Life before January 1, 2026, will not receive updates. HP outlines a dual-track approach for updates, with specific timelines for commercial PCs. Microsoft's Surface devices receive updates directly from Microsoft, while MSI categorizes guidance based on processor generation for its laptops. Acer emphasizes backing up the BitLocker recovery key and provides a model table for confirmed BIOS release dates. Samsung confirms that all PCs running Windows 10 or 11 will function normally post-expiration, but security updates will cease. LG has released a guide for checking BIOS updates for its PCs. To verify if a PC has the 2023 certificates, users can check the Secure Boot section in Windows Security. A green checkmark indicates successful application, while yellow or red icons indicate pending updates or incompatibility. Microsoft has pushed the certificates to all eligible devices as of June 2026.

Winsage

June 27, 2026

RAM crisis provokes enthusiast to try Windows 11 on DDR1-era hardware — other key vintage components included the Core 2 Q6600 and ATI Radeon HD 4650 AGP

Omores has successfully demonstrated running Windows 11 on a Core 2 Quad Q6600 with a DDR1 motherboard and an ATI Radeon HD 4650 AGP graphics card. The system is stable and capable of running modern browsers, games, and 3D benchmarks, including the demanding game Crysis. Compatibility was achieved by integrating ATI’s Windows 7 64-bit drivers from 2012. Windows 11 operates on older systems without UEFI and only ACPI 1.1, and it officially supports BIOS systems through Windows 11 IoT.