How to update Windows Secure Boot Certificate

How to check certificate status (quick steps)

1. Run PowerShell as Administrator.

2. Check the active DB for the new CA:

   powershell

   ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')
   

   If it returns True, the new CA is present in the active DB.

Fleet inventory script (PowerShell)

Use this script to detect Secure Boot state and whether the Windows UEFI CA 2023 entry exists in the active DB. Run as Administrator.

# Inventory-SecureBootCerts.ps1
$computers = Get-Content -Path .\computers.txt
$results = foreach ($c in $computers) {
  try {
    $session = New-PSSession -ComputerName $c -ErrorAction Stop
    Invoke-Command -Session $session -ScriptBlock {
      $sb = Get-SecureBootUEFI -Name db
      $dbText = [System.Text.Encoding]::ASCII.GetString($sb.bytes)
      [PSCustomObject]@{
        Computer = $env:COMPUTERNAME
        SecureBootEnabled = (Get-SecureBootUEFI -Name SetupMode).SecureBoot
        Has2023CA = ($dbText -match 'Windows UEFI CA 2023')
        DBSummary = ($dbText -replace "`r`n", ' ') -replace '\s{2,}',' '
      }
    }
    Remove-PSSession -Session $session
  } catch {
    [PSCustomObject]@{ Computer=$c; Error=$_.Exception.Message }
  }
}
$results | Export-Csv -Path .\SecureBootInventory.csv -NoTypeInformation

Notes: Get-SecureBootUEFI is the supported cmdlet to read UEFI Secure Boot variables; remote execution requires WinRM and admin rights. Test on a small set before broad runs.

Update paths and procedures

• Automatic via Windows Update: Microsoft is distributing the replacement certificates through Windows Update for eligible devices; ensure Windows Update is current.

• OEM firmware update: If Windows Update cannot write the new DB/KEK into firmware, the OEM must provide a firmware (UEFI) update that includes the new CA. Check your vendor support pages (Dell, HP, Lenovo, etc.).

• Enterprise deployment: Administrators can deploy certificate updates using Group Policy, PowerShell scripts, or Windows Configuration Service (WinCS) to push DB updates to domain‑joined machines. Test in a lab before mass deployment.

Troubleshooting and logs

• Look in Event Viewer for Secure Boot and TPM‑WMI events (compatibility checks, Event ID messages) during rollout; informational messages are common during staged updates.

• If a device fails to accept the new CA, check firmware Secure Boot settings and contact OEM for a firmware update.