Secure Boot certificate expiry 2026: what Melbourne businesses should check

Will our PCs stop booting on 19 October?

No. Microsoft says devices without the 2023 certificates continue to start and operate normally, and standard Windows updates keep installing. What they lose is new early-boot protection: Boot Manager updates, Secure Boot database updates, revocation lists and fixes for new boot-level vulnerabilities. Over time, Microsoft says, that weakens protection and can affect features that rely on Secure Boot, such as BitLocker hardening.

The date breaks nothing, but Microsoft's Secure Boot troubleshooting guide describes two ways the update itself can stop Windows starting:

• Faulty firmware. Some firmware overwrites the allow list instead of adding to it, wiping the 2011 certificate the current boot manager still needs. Microsoft's fix is to reset Secure Boot in the firmware menu, then install the manufacturer's corrected firmware before retrying.
• A later reset to defaults. On a PC already running the 2023-signed boot manager, resetting Secure Boot to factory defaults that lack the 2023 certificate makes Secure Boot block Windows. Avoid that reset unless the manufacturer's firmware ships updated defaults; Microsoft supplies a USB recovery tool for PCs already caught.

How do you check whether a PC has the new certificates?

First confirm Secure Boot is on: in Windows Security, open Device security, or run Confirm-SecureBootUEFI in an elevated PowerShell window, which returns True when it is. Then open Event Viewer, go to Windows Logs, then System, and filter on the TPM-WMI source. These events, defined in Microsoft's Secure Boot update events reference, show where each PC stands:

A second check is the UEFICA2023Status value under HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing, which reads NotStarted, InProgress or Updated, per Microsoft's registry key guidance. For fleets, Microsoft publishes a sample inventory script.

What about BitLocker?

Microsoft's BitLocker recovery overview lists boot manager changes, BIOS or UEFI firmware upgrades and PXE (network) boot among the triggers that make a PC demand its 48-digit recovery password before Windows starts. The Secure Boot change touches the first two. For planned firmware upgrades, it says to suspend BitLocker first; the drive stays encrypted.

Microsoft's troubleshooting guide adds two patterns: a one-time prompt on the first boot after the update, while the firmware catches up, and a prompt on every boot when the PC tries network boot first, fixed by putting the on-disk Windows Boot Manager first. If Windows logs event 1032, suspend BitLocker for two restart cycles (manage-bde -protectors -disable %systemdrive% -rebootcount 2), then confirm protection is back on.

First, though, confirm every recovery key is stored centrally. Microsoft recommends Entra ID for Entra-joined devices and Active Directory for domain-joined ones; Entra keys can be pulled from the Entra or Intune admin centres. With the key on file, a locked laptop is a phone call. Without it, and if the change that caused the prompt can't be undone, Microsoft's advice is to reset the device, which removes all of its files.

How Key IT handles it for managed clients

For businesses on managed IT support, this sits inside patching: we check each device's Secure Boot and certificate status, schedule manufacturer firmware where a model needs it, confirm BitLocker keys are escrowed first, and roll out in batches inside agreed patch windows. Devices that can't take it are quoted through IT procurement, so replacement is planned, not rushed.

Patching operating systems is one of the Essential Eight strategies, and ASD's patching guidance extends it to drivers and firmware at Maturity Level Three. Key IT's 24/7 SOC monitoring covers a PC once Windows is up; Secure Boot covers the start-up before it. Helpdesk hours are 8am to 5pm, Monday to Friday; managed clients with an urgent after-hours problem, like a laptop stuck at a recovery screen, reach our rotating on-call engineers.