Solved Secure boot update HowTo

garlin · Feb 4, 2026

The GPO method is the same as fiddling with AvailableUpdates, in this case the policy sets the value to 0x5944 (add the CA 2023 certs, but do not revoke CA 2011).

GPO is the same as running:

Code:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f
powershell -C Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

You don't get anything different from the GPO method, unless you really don't like copying & pasting commands.
If it takes a while for WindowsUEFICA2023Capable to refresh, it won't move any faster using the GPO method.

john1955 · Feb 4, 2026

garlin said:
The GPO method is the same as fiddling with AvailableUpdates, in this case the policy sets the value to 0x5944 (add the CA 2023 certs, but do not revoke CA 2011).

GPO is the same as running:

Code:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f powershell -C Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

You don't get anything different from the GPO method, unless you really don't like copying & pasting commands.
If it takes a while for WindowsUEFICA2023Capable to refresh, it won't move any faster using the GPO method.

I'm glad you said this because reading the article that's what I was getting from it

Davy49 · Feb 5, 2026

XxXxX said:
@garlin advice needed please
just as a heads up and something for you to check please ..

within the Group Policy Editor
Computer Configuration > Administrative Templates > Windows Components

there is a 'Secure Boot' folder with these settings ..
1. Enable Secure Boot Certificate Deployment
2. Automatic Certificate Deployment via Update
3. Certificate Deployment via Controlled Feature Rollout

i have mine all set to 'Enabled'

would these settings/features be of any use to the average user.
best of luck Steve ..

I just check in the specified group policy area that was given and I didn't see any ' Secure Boot ' folder, so what do I need to do know ? I've already checked on my computer and the secure boot is in fact enabled.

XxXxX · Feb 5, 2026

here is what i have in gpedit.msc

best of luck Steve ..

garlin · Feb 5, 2026

Just remember, enabling this policy just means you're asking Windows to add the CA 2023 certs to a system (if they're not already installed).

The small print is "Enable Secure Boot Certificate Deployment". You still need to enable Secure Boot in BIOS to take advantage of it, and eventually reboot once or twice.

Davy49 · Feb 5, 2026

garlin said:
Just remember, enabling this policy just means you're asking Windows to add the CA 2023 certs to a system (if they're not already installed).

The small print is "Enable Secure Boot Certificate Deployment". You still need to enable Secure Boot in BIOS to take advantage of it, and eventually reboot once or twice.

Now I'm really wondering why I don't have these settings on my computer?

garlin · Feb 5, 2026

SecureBoot.admx (the policy template) has been included in the Monthly Updates since Oct. 2025. I presume you're getting the normal updates?

OldNavy · Feb 5, 2026

This topic is excellent but it has got so long what are the best links for the scipts to carry out the process?

XxXxX · Feb 5, 2026

OldNavy said:
This topic is excellent but it has got so long what are the best links for the scipts to carry out the process?

the HowTo is post #1
there are two parts
Part A and Part B

best of luck Steve ..

OldNavy · Feb 5, 2026

Thank you Steve

Davy49 · Feb 6, 2026

XxXxX said:
here is what i have in gpedit.msc

View attachment 162324

best of luck Steve ..

Now I'm really wondering why I don't have this setting in the gpedit.msc are on my computer as I did in fact double check to make sure sure that I have the secure boot setting enabled on my computer.

LM2007 · Feb 9, 2026

In registry it shows

UEFICA2023Status which will now show 'NotStarted'

instead of

UEFICA2023Status which will now show 'Updated'

what can be? i followed the instructions until this part

garlin · Feb 9, 2026

Davy49 said:
Now I'm really wondering why I don't have this setting in the gpedit.msc are on my computer as I did in fact double check to make sure sure that I have the secure boot setting enabled on my computer.

There may be two separate issues.

1. Windows Update will normally push out new Group Policy templates for each of the supported Windows features. You should see "Secure Boot" listed under "Windows Components" regardless of your Secure Boot status. If you don't see it, then you may have a Windows Update problem.

2. The policy is intended to manage Windows' handling of Secure Boot updates. If your PC is already updated, then it will never be reflected in Group Policy Editor. GPE is not a status indicator, it's a method to express a policy (desired outcome). Whether you have successfully reached that outcome, or have failed, isn't GPE's concern. It's only directing future Windows actions, in case your system is currently not in compliance.

So finishing the Secure Boot update process doesn't magically "flip" any setting in Group Policy. No policy works that way.

XxXxX · Feb 9, 2026

LM2007 said:
In registry it shows

UEFICA2023Status which will now show 'NotStarted'

instead of

UEFICA2023Status which will now show 'Updated'

what can be? i followed the instructions until this part

you have set the system to receive the 2023 cert update but the update hasn't been started yet
please run both parts of the HowTo again leaving about 5 to 15 minutes between restarts on Part A.

after the second restart of the system after part A start Part B
Part B once completed can take several attempts or hours/days to reach the 'Updated' status

that is really out of any ones control
sometimes the update happens immediately other times it takes some time.

best of luck Steve ..

johnpd · Feb 10, 2026

I am trying to understand what needs to be done. This post is very long.
1. Is that wonderful script on the first page all that is needed to do the update? No manual operations required?
2. You need to be online for it to work properly.
3. There is a mention of three Secure Boot GPEdit values that have been added but are disabled. Do they need to be enabled before running this?

I don't have BitLocker enabled and I did a firmware update of my system within the past few days. The update mentioned adding the new 2023 Certificate, but my system does not yet reflect it.

Thanks,
JohnD

DarkShadowMD · Feb 10, 2026

johnpd said:
I am trying to understand what needs to be done. This post is very long.
1. Is that wonderful script on the first page all that is needed to do the update? No manual operations required?
2. You need to be online for it to work properly.
3. There is a mention of three Secure Boot GPEdit values that have been added but are disabled. Do they need to be enabled before running this?

I don't have BitLocker enabled and I did a firmware update of my system within the past few days. The update mentioned adding the new 2023 Certificate, but my system does not yet reflect it.

Thanks,
JohnD

I'd recommend you this thread:

garlin's PowerShell scripts for updating Secure Boot CA 2023

INTRO For the last two months, I've been working on new PowerShell scripts to automate the Secure Boot CA 2023 update process. A number of contributed scripts or guides presented on various ElevenForum threads (including a few of my earlier scripts) are lacking in clarity. There's simply too...

www.elevenforum.com

I did what's instructed, and all my systems are updated... I'm just battling a bit gathering info from MSI, but that's totally on me, at least my HP is fully updated, even with BIOS certs and all. It's all thanks to this awesome guys.

Check it, will make it easier for you, if it did for me that I'm a drama queen, will be even easier for you X3.

LM2007 · Feb 10, 2026

XxXxX said:
you have set the system to receive the 2023 cert update but the update hasn't been started yet
please run both parts of the HowTo again leaving about 5 to 15 minutes between restarts on Part A.

after the second restart of the system after part A start Part B
Part B once completed can take several attempts or hours/days to reach the 'Updated' status

that is really out of any ones control
sometimes the update happens immediately other times it takes some time.

best of luck Steve ..

Now it shows "updated", thanks.

Brink · Feb 10, 2026

Refreshing the root of trust: industry collaboration on Secure Boot certificate updates

Windows Experience Blog: Secure Boot is a foundational security feature of the Windows and Windows Server experience, providing protection from the moment a device powers on. Introduced in 2011, Secure Boot runs at startup – before Windows loads – and helps ensure only trusted, digitally signed...

www.elevenforum.com

johnpd · Feb 11, 2026

Brink said:
Refreshing the root of trust: industry collaboration on Secure Boot certificate updates

Windows Experience Blog: Secure Boot is a foundational security feature of the Windows and Windows Server experience, providing protection from the moment a device powers on. Introduced in 2011, Secure Boot runs at startup – before Windows loads – and helps ensure only trusted, digitally signed...

www.elevenforum.com

So basically we can sit tight until MS releases the update to your system. However, how will we know this has happened? The normal non-techy would not have a clue. Will a BIOS update have to be applied before hand or will Windows Update have to apply that as well? This could be dangerous.

JohnD

Brink · Feb 11, 2026

johnpd said:
So basically we can sit tight until MS releases the update to your system. However, how will we know this has happened? The normal non-techy would not have a clue. Will a BIOS update have to be applied before hand or will Windows Update have to apply that as well? This could be dangerous.

JohnD

Most should eventually get it automatically via Windows Update. Old systems may not.

Solved Secure boot update HowTo

Well-known member

My Computer

Jack of all trades

My Computers

Well-known member

My Computer

Just a Computer User

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Just a Computer User

My Computers

Well-known member

My Computer

Well-known member

My Computer

Member

My Computer

Well-known member

My Computer

Just a Computer User

My Computers

Well-known member

My Computer

Peaceful Citizen

My Computers

Member

My Computer

Administrator

My Computers

Well-known member

My Computer

Administrator

My Computers

Similar threads