Windows Secure Boot certificate expiration and CA updates report?

[funkytechmonky]

I've been searching the support forums and really surprised to see there is nothing about the "Windows Secure Boot certificate expiration" that is happening in June 2026. This is HUGE and could cause a lot of issues.  Am I missing something? Has anyone built a report for this? (or even possible)

Microsoft's Article: 
https://support.microsoft.com/en-us/topic/windows-secure-boot-certificate-expiration-and-ca-updates-... 

[Esben_D]

Check back Jan 30, the new pro tip with resources should be live then 😊

[funkytechmonky]

That is awesome. Thank you for helping out with this!! Can you give a little sneak peak of how this will be accomplished? 

We are a dell shop and as part of our prep I am using the "BIOS Version Audit" to get a list of workstations that have outdated BIOS versions. Dell has provided a list of "Minimum BIOS Versions with 2023 Certificate". I've used this info to help find devices that need BIOS updated. I really wish I understood SQL reports better so I could create my own report with this information but I am horrible with SQL and really wish I understood it better. 

[GB43215]

Following this as well.

@Esben_D this would be extremely useful not only for our techs but also for assurance to management that we can provide clear figures for remediation plans.

[Esben_D]

I read about it, but I haven't spent time really looking into it yet and how much of an issue it could cause. I might invest some time and release a pro tip with some resources that might help. It seems that Microsoft is suggesting to collect a bunch of info that we should already have (https://support.microsoft.com/en-us/topic/secure-boot-certificate-updates-guidance-for-it-profession...), but its just about configuring it and creating some reports on it.

Theoretically, we could even trigger Intune deployments using the new flowbuilder on assets but I don't think I'll have the time to do everything at once.

[funkytechmonky]

Help building a report for this would be very useful to every environment. Give it a month or two and companies will start freaking out about it then  😀

Is lansweeper able to see the secure boot certificate db? The cert name would be "Windows UEFI CA 2023". I am not seeing it under certificates (on a confirmed device). 

According to the "preparation" article, other things that would be helpful in the report are....
Inventory hardware and firmware. Build a representative sample of devices based on System Manufacturer, System Model, BIOS Version/Date, BaseBoard Product version, etc., and test updates on those devices before broad deployment.  These parameters are commonly available in system information (MSINFO32). Use the included sample PowerShell commands to check for Secure Boot update status and to inventory devices across your organization

[Esben_D]

Those certificates are not stored in the Windows certificate stores so they aren't scanned by lansweeper. Getting the inventory shouldn't be an issue alongside secure boot status and also evenlog info for validating if updates have been applied. 

[funkytechmonky]

@Esben_D I didnt realize you were so popular. I brought this up in the "Tips and Tricks" meet and they all said "Esben is our guy". 😁

Thanks for looking into this I really appreciate it! 

Edit: Now that I have looked around the LanSweeper KBs and Pro Tips your popularity precedes you.