Here's a summary of the key information from the Microsoft Support article on Windows devices for home users, businesses, and schools with Microsoft-managed updates:
What's Happening?
Microsoft is updating the Secure Boot certificates (originally issued in 2011 and expiring starting June 2026) to keep your Windows devices secure. Your OS needs the new certificates before they expire. These certificates are delivered via Windows Update.
Who Does This Affect?
- Individuals with personal Windows devices (not managed by IT departments).
- Devices running Windows 10 or Windows 11, Home, Pro, or Education editions with updates automatically managed by Microsoft.
Secure Boot helps your device only run trusted software at startup. If its certificates expire, you're more vulnerable to malware.
When?
Rollout of new certificates is gradual until June 2026. Home and Pro editions are prioritized.
What Do You Need to Do?
Usually, nothing!
- Make sure your device runs a supported version of Windows 10 or 11.
- Make sure Windows Updates are not paused.
- Make sure Secure Boot is enabled (it is by default on most systems).
- Press Windows + R, type
msinfo32, press Enter. - In the System Information window, look for Secure Boot State—if it says "On," you’re all set.
Troubleshooting:
- If your device won't start or you're prompted for BitLocker recovery after the update:
- You may need to temporarily disable Secure Boot (consult manufacturer documentation).
- If you see BitLocker recovery, enter your recovery key. Links are provided to find your key and for more support.
For Devices Managed by IT:
See Windows devices for businesses and organizations with IT-managed updates.
For more info or step-by-step troubleshooting details, you can read the full article here:
Microsoft Support: Windows devices for home users, businesses, and schools with Microsoft-managed updates
Source: Microsoft Support Windows devices for home users, businesses, and schools with Microsoft-managed updates - Microsoft Support