Secure Boot Certificates Expired in 2026: Check Your Office PCs

What expired and when

Secure Boot is a feature of the PC's UEFI firmware that only lets trusted, signed software run while the computer starts, before Windows loads. It checks signatures against certificates stored in the firmware. Since Windows 8, almost every Windows PC has carried the same Microsoft certificates, issued in 2011. Microsoft's support article KB5062710 lists the dates:

Microsoft's Windows IT Pro post says physical PCs and virtual machines on supported Windows 10, Windows 11 and Windows Server 2012 to 2025 are affected: in practice, every Windows system released since 2012.

Will my PCs stop working?

No. Microsoft states that devices without the 2023 certificates will continue to start and operate normally, and standard Windows updates will keep installing. The risk is quieter: those PCs can no longer receive new protections for the early boot process. That means updates to Windows Boot Manager, the Secure Boot allowed and blocked databases, revocation lists, and fixes for newly found boot-level vulnerabilities.

Boot-level malware (a "bootkit") loads before Windows and before your antivirus, which is why it is hard to detect and remove. Microsoft also notes that, over time, missing certificates may affect features that rely on Secure Boot trust, such as BitLocker hardening and third-party boot loaders.

How to check a PC in five minutes

Run these checks on each Windows PC, signed in as a local administrator. On a small office of five to ten PCs this is a quick job.

1. 1

   Check Secure Boot is on

   Press Windows key + R, type msinfo32 and press Enter. In System Information, find Secure Boot State. It should say On. If it says Off or Unsupported, Windows cannot install the new certificates on that PC.

2. 2

   Install all pending Windows updates

   Open Settings, Windows Update, and install everything including optional quality updates, then restart. The certificate rollout is delivered through monthly Windows updates.

3. 3

   Read the UEFICA2023Status value

   Open Registry Editor and go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing. The UEFICA2023Status value shows NotStarted, InProgress or Updated. Updated is the goal.

4. 4

   Look for an error value

   In the same key, a UEFICA2023Error value only appears if deployment failed. If it exists, note the code and check the PC maker's support site for a firmware (BIOS/UEFI) update.

5. 5

   Check Event Viewer

   In Windows Logs, System, event ID 1808 means the new certificates are applied. Event ID 1801 means some certificates or the 2023 boot manager are not applied yet.

These registry values and event IDs come from Microsoft's Windows Server Secure Boot playbook and the Windows 365 Secure Boot article, which use the same keys for Windows PCs.

If a PC is not updated: firmware first

Microsoft says most Windows devices receive the new certificates automatically, and rolls them out gradually, grouping devices with similar hardware and firmware. If a PC is still on NotStarted after the latest updates, the usual reasons are below.

• Old firmware. Microsoft's IT Pro post says to apply the PC maker's latest firmware before the certificates, because OEM firmware is the foundation for Secure Boot updates to apply correctly. Get BIOS/UEFI updates from Dell, HP, Lenovo, ASUS or Acer's support site, or their update app.
• Diagnostic data turned off. Microsoft uses Windows diagnostic data to decide when to send the update to each device group. Office PCs with diagnostic data blocked by policy may not be picked up automatically.
• Managed by IT policy. For IT-managed devices, Microsoft documents a registry setting (MicrosoftUpdateManagedOptIn, any non-zero value) that lets Microsoft manage the Secure Boot updates, and an AvailableUpdates value of 0x5944 to deploy all certificates directly.
• Unsupported Windows. Windows 10 support ended in October 2025; Microsoft points those PCs to Extended Security Updates or an upgrade.

Ask whoever manages your PCs before setting registry values on many machines at once. On fleets managed with Microsoft Intune, the same settings can be pushed by policy instead of by hand.

Which older PCs may need replacing

A PC that has no firmware update from its maker, and fails to take the new certificates, can keep working but will not get future boot protections. Whether that matters depends on what the PC is used for.

When you do replace machines, our business laptop buying guide covers what to look for. For the wider update routine, see our guide on software updates and patching for small businesses.

Do it yourself or get help?

For a handful of PCs, the five checks above are a manageable afternoon. Keep a simple list per machine:

If you would rather see the status of every device from one screen, device management helps. Our guide on setting up Intune for a small business explains the basics. IT Sorted is a Singapore-based team of developers with over 10 years of experience: our Device Encryption & Management package (S$490) enrols up to 10 devices in Intune or Google endpoint management with automatic update rules and BitLocker recovery keys stored in your account, and our Antivirus & Endpoint Protection Rollout (S$390) adds a device-by-device protection check.