29/03/2026
So, the latest thing you should do that Microsoft aren't really making much noise about is updating the 'Secure Boot certificates' on your Windows PC...
Microsoft are updating the 'Secure Boot certificates' that expire in just a few weeks, June 2026, ensuring continued protection against boot-level threats for Windows devices. Devices should receive these 2023 certificate updates automatically via Windows Update. If not updated, devices may lose security protections, affecting features like BitLocker and safe booting.
The thing is, for what ever reason lots of PCs, including two of mine haven't picked them up. A few videos have popped up on YouTube as the panic sets in, warning of doom and gloom. But there is an easy check to see if you are up-to-date, and an easy fix if you're not.
First, run the following PowerShell/terminal command as an Administrator and verify that the DB has been successfully updated:
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
This command should return 'true' not 'false'. If it's true you're good to go. If not...
1.
Set the regkey to perform the update to the DB. To do this, open a Command Prompt window as an Administrator, type each of the following commands separately, and then press Enter:
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x40 /f
2.
Then:
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
3.
Run the following PowerShell command again as an Administrator and verify that the DB has been successfully updated. This command should return True:
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
(Note: A restart might be required if the Virtual Secure Mode feature is enabled on the device. Such as Credential Guard, Device Guard, or Windows Hello).
Good luck.