Secure Boot Key update

Yesterday when I was using my Beelink Sei12 MiniPC running Windows 11 Pro, there was suddenly an update message requiring me to Restart the PC. I was surprised since I had paused updates for five weeks. Anyway I restarted my PC and then looked into the Windows Update History to find out what update was installed. It said "Secure Boot Allowed Key Exchange Key (KEK) update". Does it mean the new keys have been installed? Has any one else got this update? (I have not yet got this update on my Dell Inspiron 3280, running Windows 11 Home.)

Wonder what happens with Win 11 on unapproved equipment?? And will these keys update on my newer PC's automatically?

Have a read here

flhthemi said:

Wonder what happens with Win 11 on unapproved equipment?? And will these keys update on my newer PC's automatically?

Click to expand...

Mine are ALL unapproved and are fully 23 compliant now.

I'm sure this article will answer your question.

Well...I'm on 23H2 so I guess until I update to at least 24H2 it won't happen VIA WU.

Thank you @FreeBooter. Yes, I was aware that the keys will be automatically updated but unaware the gradual roll out starts in Jan 2026. What surprised me is it was pushed into even when updates were paused for five weeks .

"Starting with the January 2026 Security Update, Microsoft has begun a gradual rollout of a new certificate that will allow your computer to continue booting correctly and receive security updates."

jumanji said:

It said "Secure Boot Allowed Key Exchange Key (KEK) update". Does it mean the new keys have been installed? Has any one else got this update? (I have not yet got this update on my Dell Inspiron 3280, running Windows 11 Home.)

Click to expand...

Yes, I have seen it on just one of my machines. It multi-boots RTM 25H2 and various Insider builds as native boot vhdx. I got it in the Dev build, but the 2023 KEK now seems to be available for all installed version of Windows.
KB5074157 Windows 11 Insider Dev build 26220.7653 (25H2) - Jan. 21 - post #3

None of my other machines have seen it.

I think the update released before 2026 i remember installing it few weeks ago.

I have already updated all my machines to the 2023 certs, revoked the 2011 certs, and they're all using secure boot. I sincerely hope that Microsoft doesn't screw around and break things on any of them!

jumanji said:

Thank you @FreeBooter. Yes, I was aware that the keys will be automatically updated but unaware the gradual roll out starts in Jan 2026. What surprised me is it was pushed into even when updates were paused for five weeks .

"Starting with the January 2026 Security Update, Microsoft has begun a gradual rollout of a new certificate that will allow your computer to continue booting correctly and receive security updates."

Click to expand...

Use method three, here, to find out...

jumanji said:

Yesterday when I was using my Beelink Sei12 MiniPC running Windows 11 Pro, there was suddenly an update message requiring me to Restart the PC. I was surprised since I had paused updates for five weeks. Anyway I restarted my PC and then looked into the Windows Update History to find out what update was installed. It said "Secure Boot Allowed Key Exchange Key (KEK) update". Does it mean the new keys have been installed? Has any one else got this update? (I have not yet got this update on my Dell Inspiron 3280, running Windows 11 Home.)

View attachment 161757

Click to expand...

Beelink (or the BIOS licensed by Beelink) has co-operated with MS and signed the KEK CA 2023 cert using their Platform Key. So Windows could now live install the KEK CA 2023 cert that's appropriate for your BIOS.

Installing an UEFI cert can be done from live Windows, but requires a restart for the KEK key to take effect. So you're good to go, on the CA 2023 update process. If you haven't done anything yourself, this system now has everything that's required for Windows to finish the task later this year.

I also received this update on two of my PCs. However, Event Viewer still shows event 1801... Updated certs are available but have not yet been applied.

rick99 said:

I also received this update on two of my PCs. However, Event Viewer still shows event 1801... Updated certs are available but have not yet been applied.

Click to expand...

Have the same problem on an
ASUS TUF Gaming A15 FA506IV_FA506IV

secure boot is activated

After getting the KEK 2023 update last week, I used to get Event 1808:

This device has updated Secure Boot CA/keys. This device signature information is included here.
DeviceAttributes: BaseBoardManufacturer:ASUSTeK COMPUTER INC.;FirmwareManufacturer:American Megatrends Inc.;FirmwareVersion:3004;OEMModelNumber:System Product Name;OEMModelBaseBoard:TUF Z370-PLUS GAMING;OEMModelSystemFamily:To be filled by O.E.M.;OEMManufacturerName:System manufacturer;OEMModelSKU:SKU;OSArchitecture:amd64;
BucketId: 636bf0e73554d99b6b78301444f59a42726b3ab96d4d6788a4e3d20ee3212b49
BucketConfidenceLevel:
UpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)
For more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.

And, after today's Windows Cum update, I still get the same Event 1808, except the BucketConfidenceLevel has changed to:

BucketConfidenceLevel: Under Observation - More Data Needed

This is an informational event that indicates that the device has the required new Secure Boot certificates applied to the device’s firmware. This event will be logged when all needed certificates have been applied to the firmware, and the boot manager has been updated to the boot manager signed by the “Windows UEFI CA 2023” certificate.
( Secure Boot DB and DBX variable update events - Microsoft Support )

Bucket Confidence is MS's attempt at predicting whether your PC will have the CA 2023 certs successfully applied.

They aggregate data from similar model PC's (same motherboard, same BIOS) that have opted-in on Secure Boot telemetry, checking if the pushed cert update worked or failed for them. Based on the averaged results for everyone in the same bucket, they can predict whether another identical PC will succeed or fail.

For the more popular PC models, MS can quickly collect enough opt-in results to get a high or low confidence.

Right now, enterprises can use this confidence level to change their Secure Boot update policies to allow the updates to run right away. If there's a low confidence (high failure rate), they can block the updates until the OEM works it out the problem with MS.

Windows will report the Bucket Confidence in your event logs, even if you're not in an enterprise, because everyone gets them. It's just an FYI. If you've already updated your Secure Boot certs, then you can ignore BucketConfidenceLevel messages.

In reality, the biggest predictor of whether the Secure Boot update will work is your UEFI's Platform Key. If the PK has been submitted to MS's Secure Boot GitHub list, there's a high probability that Windows can update your PC without any errors or outside help.