The Update BureauSecure Boot is a check that runs when your PC starts: it lets only trusted software load before Windows. To tell trusted from untrusted, it relies on certificates stored in the PC's firmware. The Microsoft certificates issued in 2011 began expiring in June 2026, and Microsoft is replacing them with a new set from 2023.
Do I need to do anything?
On most personal PCs, no. Windows Update delivers the 2023 certificates automatically, as part of the normal monthly updates. Keep Windows updated and let it restart when it asks.
Some PCs also need a firmware update (BIOS/UEFI) from the manufacturer before the new certificates can be applied. If Windows tells you so, check the support page of your PC's manufacturer; firmware updates may only exist for models that are still supported.
Do not turn Secure Boot off to get rid of a warning: it removes the protection against malware that starts before Windows.
How to check your PC
Open Windows Security › Device security › Secure Boot. Since April 2026 a badge shows the state of the certificate update:
| Badge | Meaning |
|---|---|
| Green | Protected, nothing to do |
| Yellow | A recommendation: the update is not complete yet |
| Red | Something needs your attention now |
A green badge alone does not prove the certificates are updated: look for the text "Secure Boot is on and all required certificate updates have been applied. No further certificate changes are needed." Since May 2026 Windows can also show notifications outside the app.
Dismissing the warnings is possible, but not recommended while the certificates are not updated.
What happens if my PC doesn't get the new certificates
- It keeps starting and working normally, and regular Windows updates keep installing.
- It can no longer receive new protections for the startup process: updates to Windows Boot Manager, to the Secure Boot lists of trusted and blocked software, and fixes for new flaws in the boot chain (for example BitLocker bypasses).
- Some third-party components that depend on Microsoft's Secure Boot trust may fail to update.
Over time, a PC in this state becomes less protected against attacks on the startup process.
For IT administrators
- On devices managed by an organization, the Windows Security badges are off by default; they can be turned on by policy.
- Microsoft Defender has an assessment that lists exposed and compliant devices, and Windows Autopatch has a Secure Boot status report.
- Microsoft's guidance covers Intune, Group Policy and registry-based deployment, servers and virtual machines, and firmware from device manufacturers.
Sources
Edited by the site editor. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake