Act now: Secure Boot certificates expire in June 2026
In the coming months, Microsoft will be rolling out updated Secure Boot certificates needed to ensure a secure startup environment of Windows. Current certificates will start expiring in June 2026 on all Windows systems released since 2012, except for 2025 Copilot+ PCs. This also affects third-party operating systems. Start by checking on the latest available firmware from original equipment manufacturers (OEMs) and enabling Windows diagnostic data. Visit the Secure Boot certificate rollout landing page for guidance for personal devices and IT-managed systems. When will this happen: In the coming months, the following updated certificates will be rolling out: Microsoft Corporation KEK 2K CA 2023, Microsoft Corporation UEFI CA 2023, Microsoft Option ROM UEFI CA 2023, Windows UEFI CA 2023 June 2026, the following certificates will expire: Microsoft Corporation KEK CA 2011 and Microsoft Corporation UEFI CA 2011 (or third-party UEFI CA) October 2026, the following certificate will expire: Microsoft Windows Production PCA 2011 How this will affect your organization: Most supported Windows systems released since 2012, including the long-term servicing channel (LTSC), are affected. Not affected are Copilot+ PCs released in 2025. Affected third-party OS includes MacOS. However, it’s outside the scope of Microsoft support. For Linux systems dual booting with Windows, Windows will update the certificates that Linux relies on. Unless prepared, affected physical and virtual machine (VM) devices will: Lose ability to install Secure Boot security updates after June 2026. Not trust third-party software signed with new certificates after June 2026. Not receive security fixes for Windows boot manager by October 2026. What you need to do to prepare: First, check on the latest available firmware from original equipment manufacturers (OEMs). Then, allow Microsoft to manage Windows updates, including Secure Boot updates: Configure your organizational policies to allow at least the “required” level of diagnostic data. Allow Microsoft to manage Secure Boot-related updates for your devices by setting the following registry key: Registry path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot Key name: MicrosoftUpdateManagedOptIn Type: DWORD DWORD value: 0x5944 (opt in to Windows Secure Boot updates) If you prefer not to enable diagnostic data, please take this anonymous readiness survey. Additional information: Read Act now. Secure Boot certificates expire in June 2026. Bookmark Secure Boot certificate rollout landing page. Consult guidance for Windows devices for businesses and organizations with IT-managed updates. For unmanaged scenarios, see Windows devices for home users, businesses, and […]
The post Act now: Secure Boot certificates expire in June 2026 appeared first on M365 Admin.
Published on:
Learn moreWe can help you with Act now: Secure Boot certificates expire in June 2026
If you want help implementing, troubleshooting, or improving this product, contact us and we’ll point you in the right direction.
Related posts
Intune: Windows Health Attestation Migration to Microsoft Azure Attestation
Microsoft Intune will migrate Windows Health Attestation compliance evaluation from the current Device Health Attestation (DHA) service to Mic...
Dynamics 365 Commerce – Print receipts using Adyen payment terminal printers
We are announcing the ability to print receipts using the built-in printer on supported Adyen payment terminals in Dynamics 365 Commerce. This...
Outlook: Multi Account Search
Users will be able to see results from multiple mailboxes interweaved in a single ranked list and will be able to do standard mail actions. Pr...
Dynamics 365 Field Service: Manage rental service demand with work order requests
Rental organizations need to coordinate commercial rental activity, equipment availability, asset condition, and service execution across mult...
Microsoft Teams: Schedule Channel Meetings from Outlook Calendar
Users will be able to schedule Microsoft Teams channel meetings directly from Outlook Calendar. This streamlines meeting creation and helps ke...
Microsoft 365 admin center: Optional Public CDN Support in Brand Center Setup
We are updating the Brand Center setup experience so that administrators can set up Brand Center without enabling Public CDN. Today, Public CD...
Dynamics 365 Field Service: Book Work Orders with Multiple Requirements
Dispatchers can now select which resource requirement to schedule when booking a work order that has multiple requirements. The new Book exper...
Brand Skill support now available in PPT Copilot [Web]
Brand managers can upload custom presentation skills as Markdown files to Brand Kit for use with Copilot in PowerPoint Web, enabling consisten...
Brand Skill support now available in PPT Copilot [Desktop]
Brand managers can now upload custom presentation skills as Markdown files to Brand Kit for use with Copilot in PowerPoint Desktop, enabling c...