said in Windows troubleshooting discussions for **March 2026**::
Would you like me to help you run the PowerShell check for the June Secure Boot certificates to see if your PC is at risk?
It is wise to be proactive about this. As we discussed, the June 2026 deadline is critical because the certificates that allow your PC to “trust” the Windows boot process are expiring. If they aren’t updated, your PC could become unbootable after a future security patch.
Here is the exact PowerShell check to see if your system has the new 2023 Certificate installed.
🖥️ The “June 2026 Readiness” PowerShell Check
- Right-click the Start button and select Terminal (Admin) or PowerShell (Admin).
- Copy and paste the following command and hit Enter:
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
How to read the result:
- True: You are Safe. Your PC has already received the new 2023 certificate through a BIOS update or a Windows “servicing” update. No further action is needed.
- False: You are At Risk. Your system is still using the 2011 certificates that expire in June. You need to apply updates.
🛠️ What to do if the result is “False”
If you see “False,” don’t panic—you still have time before June. Follow these steps in order:
Step 1: Check the Registry Status
Microsoft added a specific key in late 2025 to track this. Run this command to see your current status:
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" -Name "UEFICA2023Status"
- If it says “InProgress”: The update is staged and just needs a few more reboots.
- If it says “Not Started”: You need to manually trigger the update process.
Step 2: Manually Trigger the Certificate Update
If your PC is capable but hasn’t started the update, you can “nudge” it:
- Set the trigger:
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" -Name "AvailableUpdates" -Value 0x5944
- Run the update task:
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
- Reboot your PC twice.
Step 3: The Manufacturer Factor
If the steps above don’t work, your motherboard firmware (BIOS) might be blocking the change.
- Open your manufacturer’s app (e.g., Lenovo Vantage, Dell SupportAssist, or MyASUS).
- Look for a BIOS/Firmware Update released in January or February 2026. This update usually contains the “Secure Boot 2023” keys.
⚠️ A Final Warning on “Static Freezes” (March 2026)
Many users who are manually pushing these Secure Boot updates on AMD Ryzen (HP/Lenovo) laptops are reporting the “Static Freeze” issue we mentioned earlier. If your screen freezes solid after doing this, disable Fast Startup immediately, as it conflicts with the new security certificates during the “hiberboot” process.
Would you like me to show you how to check your Event Viewer for “Event 1808,” which is the official confirmation that the update was successful?