MC1268714 Medium
Enable Secure Boot certificate update status in the Windows Security app
Summary AI-generated
Starting April 2026, admins can enable Secure Boot certificate status indicators in Windows Security app; 2011 Secure Boot certs expire June 2026, so update to 2023 certs to stay protected.
Suggested actions AI-generated
- Plan to update Secure Boot certificates by June 2026
- Decide whether to enable certificate status feature
- Review admin guidance for deployment
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1230373 Secure Boot certificate updates: actions required ahead of June 2026 expiration
- MC1185931 Secure Boot playbook for certificates expiring in 2026
- MC1237599 Windows Server Secure Boot playbook for certificates expiring in 2026
- MC1262523 New resources to help organizations prepare for Secure Boot certificate expirations
- MC1226170 Secure Boot status report in Windows Autopatch
- MC1403212 Best practices for deploying Secure Boot certificate updates
Original post from Microsoft
Starting April 2026, the Windows Security app can show users the status of their Secure Boot certificate updates. This experience is disabled by default on enterprise-managed Windows 10 and Windows 11 client devices and Windows Server. If you want to enable this experience for devices in your organization, see the complete guidance at IT admin guide: Secure Boot certificate update status in the Windows Security app.
When will this happen:
- In April 2026, this enhancement brings green, yellow, and red-color badges to Device security > Secure Boot.
- In May 2026, notifications will appear outside the app (such as system alerts).
- In late June 2026, the 2011 Secure Boot certificates begin expiring. Devices need updated 2023 certificates by this date to remain protected and productive.
How this will affect your organization:
This feature is available in Windows 11, Windows 10, Windows Server 2025, Windows Server 2022, and Windows Server 2019. It’s disabled by default on enterprise IT-managed devices. If enabled, visual indicators and warnings can help users know their Secure Boot certificate update status. If action is required, notifications will guide users to take appropriate steps. This isn’t a replacement but a complement to the IT monitoring and deployment guidance in Secure Boot playbook for certificates expiring in 2026.
What you need to do to prepare:
If you don’t wish to enable this feature for users at your organization, no action is required.
On the contrary, please use the registry key guidance in IT admin guide: Secure Boot certificate update status in the Windows Security app. See additional information for more helpful resources.
Additional information:
- See complete information at IT admin guide: Secure Boot certificate update status in the Windows Security app.
- If you enable this feature, share this user-focused KB article with them: Secure Boot certificate update status in the Windows Security app.
- For comprehensive review of Secure Boot certificate updates, visit https://aka.ms/GetSecureBoot.
- For devices that don’t have these certificates applied, use the specific monitoring and deployment methods described in the Secure Boot playbook.
- For Windows Server, see Windows Server Secure Boot playbook for certificates expiring in 2026.