Secure Boot Deadlines Are Not Optional Anymore

There's a deadline coming this summer for Secure Boot certificate updates on Windows and Linux machines, and most 15-person offices have no idea it applies to them. It does. If you ignore it, some of your laptops will eventually stop trusting their own firmware updates, and a few will refuse to boot after the next big OS patch. This is the kind of unglamorous IT chore that separates offices that keep running from offices that lose a Tuesday morning.

What's actually happening

The original Secure Boot certificates that ship in most PCs from roughly 2012 onward are hitting their expiration. Microsoft has issued replacements. The replacements have to be pushed to each machine's firmware. On managed fleets this happens automatically. On the random mix of Dells, Lenovos, and one guy's personal Surface that makes up a typical small-business office, it does not happen automatically. Someone has to make it happen.

The symptom if you skip it: machines that can't validate new bootloaders, fail to install certain Windows updates, or in worst cases sit at a black screen after a firmware refresh. The fix after the fact involves recovery USB sticks and a bad afternoon. The fix before the fact is fifteen minutes per machine.

The actual checklist for a small office

I'd rather you do this badly this week than perfectly next quarter. Walk through your machines and do these things:

• Patch everything to current. Run Windows Update until it stops finding things. Reboot. Run it again. The KB that delivers the new certificates only applies if the machine is current.
• Check Secure Boot is actually on. Open System Information, look for "Secure Boot State." If it says Off or Unsupported, that machine needs attention separately. Don't turn it on blindly without checking the boot mode first or you'll brick it.
• Opt into the certificate update. Microsoft gated this behind a registry key on purpose so they didn't break the world overnight. The key is documented. Set it, reboot, let the update apply, verify the new certificate is present.
• Linux boxes get the same treatment. If you've got a Ubuntu server running QuickBooks backups or a Proxmox host, update shim and the distro's signed bootloader packages. Don't assume the auto-updater grabbed it.

Why this is worth an hour of your time

I get the eye-roll. Firmware certificates are the least interesting thing in your buisness. But the cost of doing this on your schedule is one hour with a coffee. The cost of doing it on the machine's schedule is an employee standing at your desk with a laptop that won't turn on, two days before payroll. I've watched this exact movie with TLS certificates, with domain renewals, with backup tapes nobody tested. Boring deadlines win every time you ignore them.

The other reason to do it now: it forces you to actually inventory your machines. If you can't list every laptop and desktop your company owns in fifteen minutes, the Secure Boot deadline is the smaller of your two problems.

If "go check Secure Boot on fifteen laptops" is the sentence that just made your stomach drop, that's exactly the kind of unglamorous fleet work we help small offices knock out in an afternoon. Drop us a note.

— Alexander @ SBATC