Windows Security - New Secure Boot Status Indicators Added
Basically, Microsoft added new features to help track important security updates for Windows devices.
Microsoft has added new status indicators to the Windows Security app to help track Secure Boot certificate updates. This is crucial as certificates from 2011 near expiration in 2026. IT admins can now easily see if devices need updates, ensuring better security management.
What Happened
Microsoft is taking proactive steps as its Secure Boot certificates, issued back in 2011, approach expiration in 2026. To assist IT administrators in managing device security, the company has introduced new status indicators in the Windows Security app. These indicators, found under Device security > Secure Boot, will help track whether devices have received updated certificates automatically through Windows Update.
Who's Affected
The updates primarily target consumer devices and some business devices. This change is crucial for IT administrators who need to ensure that their systems are up-to-date and secure. The new features are designed to provide clear visibility into the certificate status of each device, helping organizations avoid potential security risks associated with expired certificates.
What Data Was Exposed
While there are no direct data exposures reported, the introduction of these indicators aims to prevent future vulnerabilities that could arise from outdated Secure Boot certificates. The new indicators will show the current state of each device's certificate, indicating whether any action is required by the administrator.
What You Should Do
For enterprise-managed devices, the new indicators are disabled by default. IT administrators can enable or disable this feature using a registry entry. The relevant registry key is located at: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Device security. Setting the entry to 0 enables the feature, while 1 disables it.
Additionally, the rollout of these features will occur in two phases. The first phase begins on April 8, 2026, for certain Windows 11 versions and on April 14, 2026, for Windows 10. The second phase, which includes notifications for critical states, will follow on May 16, 2026, for Windows 11 and May 13, 2026, for Windows 10.
IT administrators should monitor these updates closely to ensure compliance and security across their networks. By enabling these indicators, organizations can maintain better oversight of their device security and respond promptly to any potential issues.