Windows Secure Boot certificate expiration and CA updates report?

[funkytechmonky]

I've been searching the support forums and really surprised to see there is nothing about the "Windows Secure Boot certificate expiration" that is happening in June 2026. This is HUGE and could cause a lot of issues.  Am I missing something? Has anyone built a report for this? (or even possible)

Microsoft's Article: 
https://support.microsoft.com/en-us/topic/windows-secure-boot-certificate-expiration-and-ca-updates-... 

[Esben_D]

I read about it, but I haven't spent time really looking into it yet and how much of an issue it could cause. I might invest some time and release a pro tip with some resources that might help. It seems that Microsoft is suggesting to collect a bunch of info that we should already have (https://support.microsoft.com/en-us/topic/secure-boot-certificate-updates-guidance-for-it-profession...), but its just about configuring it and creating some reports on it.

Theoretically, we could even trigger Intune deployments using the new flowbuilder on assets but I don't think I'll have the time to do everything at once.

[funkytechmonky]

Help building a report for this would be very useful to every environment. Give it a month or two and companies will start freaking out about it then  😀

Is lansweeper able to see the secure boot certificate db? The cert name would be "Windows UEFI CA 2023". I am not seeing it under certificates (on a confirmed device). 

According to the "preparation" article, other things that would be helpful in the report are....
Inventory hardware and firmware. Build a representative sample of devices based on System Manufacturer, System Model, BIOS Version/Date, BaseBoard Product version, etc., and test updates on those devices before broad deployment.  These parameters are commonly available in system information (MSINFO32). Use the included sample PowerShell commands to check for Secure Boot update status and to inventory devices across your organization

[Esben_D]

Those certificates are not stored in the Windows certificate stores so they aren't scanned by lansweeper. Getting the inventory shouldn't be an issue alongside secure boot status and also evenlog info for validating if updates have been applied. 

[funkytechmonky]

@Esben_D I didnt realize you were so popular. I brought this up in the "Tips and Tricks" meet and they all said "Esben is our guy". 😁

Thanks for looking into this I really appreciate it! 

Edit: Now that I have looked around the LanSweeper KBs and Pro Tips your popularity precedes you.