Starting June 2026, Microsoft is completing the revocation of its 2011 Secure Boot signing certificates. For most people, Windows Update will handle this quietly in the background. But for a significant number of PCs — particularly older business machines, systems with outdated BIOS firmware, and computers with USB recovery drives made before 2023 — this change could result in a PC that simply won't start. Here's what you need to know.
Secure Boot is a security feature built into the UEFI firmware of modern computers. Its job is to verify that only trusted, Microsoft-approved software loads when your PC starts up — blocking malware and rootkits from hijacking the boot process before Windows even loads.
To do this, Windows uses digital certificates — essentially a kind of digital signature — to prove that boot software is legitimate. The original set of these certificates was issued in 2011. They've been doing their job for over a decade, but a sophisticated piece of malware called the BlackLotus bootkit was discovered in 2023, capable of exploiting those old certificates to bypass Secure Boot entirely. Microsoft's response was to begin a phased revocation of the 2011 certificates, replacing them with updated, more secure versions.
That revocation process reaches its final phase in June 2026.
The short answer: anyone whose PC hasn't been properly updated. More specifically, you may have a problem if:
For many home users with a relatively modern PC that's set to update automatically, Windows Update will have already applied the necessary patches. But "set to update automatically" and "actually updated" aren't always the same thing — especially on machines that get turned off before updates finish, or where updates have been paused or deferred.
In a worst-case scenario, when the final certificate revocation is pushed via Windows Update, a PC that hasn't been properly prepared could end up in a boot loop — repeatedly trying and failing to start Windows — or display a Secure Boot violation error and refuse to load entirely.
For a home user, that means a PC that looks completely dead until someone with the right knowledge can intervene. For a business, it means workstations that go down mid-week with no warning, staff who can't work, and data that may appear inaccessible until the system is recovered.
Recovering from this isn't impossible — but it's time-consuming, and if you don't have a current backup and a bootable recovery drive, it can turn into an expensive job quickly.
We see this pattern regularly in Townsville: a business buys a batch of computers, sets them up, and they run fine for years. The BIOS never gets updated — why would you touch something that's working? Windows Updates get applied, but firmware updates from Dell, HP, or Lenovo are a different thing entirely, and they're often missed.
Add to this the fact that many local businesses — trades, retail, medical and allied health practices, small professional offices — are running hardware that's 5–8 years old, often with no IT person looking after it. That's exactly the profile of a machine that may be running the old 2011 Secure Boot trust chain with no firmware update applied.
We've already started checking client systems for this issue during routine visits, and we're finding machines that need attention. The time to deal with it is before a Windows Update pushes the final revocation and takes a machine offline.
There are a few things to verify:
msinfo32, press Enter. Look for "BIOS Version/Date". If it's from 2019 or earlier, you likely need a firmware update from your PC manufacturer.If you have a relatively modern home PC (bought in the last 4–5 years) and Windows Update runs regularly, there's a good chance you're fine. Microsoft has been rolling this out gradually through automatic updates, and most well-maintained machines will have already received the necessary changes.
Where home users can run into trouble is with older machines — a 2015 or 2016 desktop or laptop that's still going strong, but hasn't had a BIOS update in years. If that machine's Windows is up to date but the firmware isn't, there's a mismatch that could cause issues when the final revocation lands.
If your home PC is more than 6–7 years old and you're not sure of its update status, it's worth getting it checked. A quick health check takes 20–30 minutes and can save you a lot of grief.
We can come out to your home or business in Townsville, Kirwan, Aitkenvale, Douglas, or anywhere else in our service area and:
If you're a business running multiple workstations, we can do a fleet check and fix everything in one visit. Don't leave it until something breaks.
This isn't scaremongering — it's a real change with a real deadline that will catch some people off guard. The businesses and home users most at risk are exactly the ones least likely to have heard about it: those without a dedicated IT person keeping an eye on things.
If you're in Townsville and you're not sure whether your systems are ready, give us a call. We'd rather spend 30 minutes checking your machines now than spend 3 hours recovering them in June.
Get in Touch → 📱 Call 0408 777 938