Microsoft and OEMs Address Key Secure Boot Issues During Office Hours AMA

The OEM Secure Boot Office Hours event, hosted by Microsoft on July 15, brought together engineers from Microsoft as well as representatives from Acer, Asus, Cisco, Clevo, Dell, Fujitsu, Honor, HP, Lenovo, LG, Surface, and Xiaomi. The 12-hour AMA session on the Tech Community forum provided IT administrators an opportunity to ask live questions about Secure Boot certificate updates.

By the end of the session, the discussion thread evolved into one of the most detailed technical records related to the Secure Boot 2023 rollout, following the expiration of the first certificates in early July.

Key Takeaways

Microsoft engineers, including Prabhakar_MSFT and Jason_Sandys, along with OEM experts from HP and Dell, addressed various hardware-specific queries and offered actionable solutions. However, the session also uncovered frustrations among IT administrators over persistent issues such as BitLocker recovery loops, failed Intune policies lacking detailed error codes, and irregular confidence ratings.

Clarification on Secure Boot Update Process

• Devices that have been offline for extended periods will still process Secure Boot updates upon reconnecting to Windows Update. Devices with 2011 certificates will automatically update to the 2023 chain.
• For devices already equipped with 2023 certificates but still booting with the 2011 chain, Microsoft clarified that the boot manager transitions to the 2023-signed version after applying the latest Windows updates.
• Devices stuck on the 2011 boot manager despite full updates likely indicate incomplete patches. Microsoft shared a PowerShell script, Detect-SecureBootCertUpdateStatus.ps1, to diagnose the issue by analyzing the local registry and event logs.

Tools for Monitoring Secure Boot Rollout

Microsoft introduced two PowerShell scripts to assist IT administrators in managing Secure Boot updates:

1. Detect-SecureBootCertUpdateStatus.ps1: Helps diagnose the Secure Boot certificate status on individual devices.
2. Get-SecureBootRolloutStatus.ps1: Designed to monitor rollout progress across enterprise device fleets. Note: This script requires an active rollout process to operate.

Administrators were advised to reference Microsoft’s Sample Secure Boot E2E Automation Guide for deploying certificates across large-scale environments using Group Policy Objects (GPOs), network file shares, and orchestrators.

Understanding Confidence Ratings

Several participants expressed concerns regarding fluctuating confidence ratings in device registries:

• Confidence ratings are associated with firmware versions rather than the hardware itself. When a BIOS is updated, the device may be assigned to a new "bucket" for which sufficient data may not yet be available, causing the confidence rating to appear temporarily unrated.
• If Secure Boot certificates are current, confidence rating issues can generally be disregarded.
• The Detect-SecureBootCertUpdateStatus.ps1 script can provide additional verification beyond registry readings.

Intune and BitLocker Recovery Challenges

IT admins managing large device fleets reported challenges with Intune configurations and unexpected BitLocker recovery activations:

• BitLocker recovery should not be triggered by Secure Boot certificate updates. When such issues occur, they are often caused by custom PCR configurations or hardware-specific firmware issues.
• Microsoft emphasized the importance of testing representative hardware before a large-scale rollout and ensuring that BitLocker recovery keys are backed up and accessible.
• For Intune failures displaying generic error codes, Microsoft recommended providing detailed logs for further investigation.

Firmware Updates and Legacy Devices

Questions about firmware updates for older devices sparked significant discussion:

• Dell and HP confirmed that running outdated firmware, even with updated certificates, leaves devices vulnerable to other security threats. Firmware updates should address both certificates and broader security concerns.
• HP’s newer models, such as the G6 and G11, have firmware updates available for the 2023 certificates. Older models like the G5, which have reached end-of-service life, require a manual update package available via HP Support.

Deadline for Secure Boot Certificate Transition

The session emphasized the importance of transitioning to the 2023 Secure Boot certificates before key deadlines:

• The Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011 certificates have already expired.
• The Microsoft Windows Production PCA 2011 certificate is set to expire on October 19, 2026, giving IT admins a limited window to update their devices.

Next Steps for IT Admins

IT administrators managing device fleets should focus on these key actions:

1. Leverage the available PowerShell scripts to verify Secure Boot certificate statuses on individual devices or across fleets.
2. Ensure firmware updates are applied to address broader security vulnerabilities.
3. Use deployment guides for GPO-based or Intune rollouts to avoid misconfigurations.
4. Back up and secure BitLocker recovery keys before initiating updates.

Conclusion

The Secure Boot Office Hours AMA offered valuable insights and solutions for IT administrators navigating the 2023 certificate rollout. Despite ongoing challenges such as BitLocker recovery loops and Intune failures, Microsoft and OEMs have made notable progress in resolving critical issues. With the upcoming October deadline for Secure Boot compliance, fleet managers are urged to take immediate action to ensure their devices meet the necessary standards and minimize operational disruptions.

For additional resources, consult Microsoft’s official documentation and Windows Latest’s in-depth coverage of Secure Boot updates and troubleshooting advice.