April 11, 2026 · Windows Security

Microsoft Secure Boot Certificates Are Expiring in 2026 — Is Your PC Ready?

Starting June 2026, Microsoft is completing the revocation of its 2011 Secure Boot signing certificates. For most people, Windows Update will handle this quietly in the background. But for a significant number of PCs — particularly older business machines, systems with outdated BIOS firmware, and computers with USB recovery drives made before 2023 — this change could result in a PC that simply won't start. Here's what you need to know.

What Is Secure Boot and Why Does Any of This Matter?

Secure Boot is a security feature built into the UEFI firmware of modern computers. Its job is to verify that only trusted, Microsoft-approved software loads when your PC starts up — blocking malware and rootkits from hijacking the boot process before Windows even loads.

To do this, Windows uses digital certificates — essentially a kind of digital signature — to prove that boot software is legitimate. The original set of these certificates was issued in 2011. They've been doing their job for over a decade, but a sophisticated piece of malware called the BlackLotus bootkit was discovered in 2023, capable of exploiting those old certificates to bypass Secure Boot entirely. Microsoft's response was to begin a phased revocation of the 2011 certificates, replacing them with updated, more secure versions.

That revocation process reaches its final phase in June 2026.

Who Is Actually at Risk?

The short answer: anyone whose PC hasn't been properly updated. More specifically, you may have a problem if:

  • Your computer's BIOS or UEFI firmware hasn't been updated in the last 2–3 years
  • You have a bootable USB recovery drive or Windows installation drive created before mid-2023
  • Your business runs older hardware (pre-2019 workstations or laptops) that the manufacturer no longer provides firmware updates for
  • You're running a dual-boot setup (Windows alongside Linux)
  • You use third-party disk management or boot tools that rely on older signed drivers
  • Your Windows installation hasn't received the cumulative updates from August 2023 onwards (KB5025885 and later)

For many home users with a relatively modern PC that's set to update automatically, Windows Update will have already applied the necessary patches. But "set to update automatically" and "actually updated" aren't always the same thing — especially on machines that get turned off before updates finish, or where updates have been paused or deferred.

What Could Actually Go Wrong?

In a worst-case scenario, when the final certificate revocation is pushed via Windows Update, a PC that hasn't been properly prepared could end up in a boot loop — repeatedly trying and failing to start Windows — or display a Secure Boot violation error and refuse to load entirely.

For a home user, that means a PC that looks completely dead until someone with the right knowledge can intervene. For a business, it means workstations that go down mid-week with no warning, staff who can't work, and data that may appear inaccessible until the system is recovered.

Recovering from this isn't impossible — but it's time-consuming, and if you don't have a current backup and a bootable recovery drive, it can turn into an expensive job quickly.

What About Townsville Businesses Specifically?

We see this pattern regularly in Townsville: a business buys a batch of computers, sets them up, and they run fine for years. The BIOS never gets updated — why would you touch something that's working? Windows Updates get applied, but firmware updates from Dell, HP, or Lenovo are a different thing entirely, and they're often missed.

Add to this the fact that many local businesses — trades, retail, medical and allied health practices, small professional offices — are running hardware that's 5–8 years old, often with no IT person looking after it. That's exactly the profile of a machine that may be running the old 2011 Secure Boot trust chain with no firmware update applied.

We've already started checking client systems for this issue during routine visits, and we're finding machines that need attention. The time to deal with it is before a Windows Update pushes the final revocation and takes a machine offline.

How to Check If Your PC Is Affected

There are a few things to verify:

  1. Check your Windows Update history — open Settings > Windows Update > Update history and confirm updates from 2023–2026 have installed successfully. If you're seeing failed updates or long gaps, investigate before June.
  2. Check your BIOS/UEFI firmware version — press Win+R, type msinfo32, press Enter. Look for "BIOS Version/Date". If it's from 2019 or earlier, you likely need a firmware update from your PC manufacturer.
  3. Update your BIOS/UEFI firmware — go to your PC manufacturer's support website (Dell, HP, Lenovo, ASUS, etc.), enter your model number, and download the latest BIOS/UEFI firmware update. This is a task where it pays to be careful — a botched BIOS update can cause real problems, so if you're unsure, get someone to do it for you.
  4. Update or recreate bootable recovery drives — if you have a USB drive you use to reinstall or repair Windows, download a fresh Windows ISO from Microsoft and create a new drive. Drives made before mid-2023 may use the old certificates.
  5. Make sure your backups are current — before any firmware update, back up your data. This is good practice regardless.

Home Users: Should You Be Worried?

If you have a relatively modern home PC (bought in the last 4–5 years) and Windows Update runs regularly, there's a good chance you're fine. Microsoft has been rolling this out gradually through automatic updates, and most well-maintained machines will have already received the necessary changes.

Where home users can run into trouble is with older machines — a 2015 or 2016 desktop or laptop that's still going strong, but hasn't had a BIOS update in years. If that machine's Windows is up to date but the firmware isn't, there's a mismatch that could cause issues when the final revocation lands.

If your home PC is more than 6–7 years old and you're not sure of its update status, it's worth getting it checked. A quick health check takes 20–30 minutes and can save you a lot of grief.

What Uptime IT Solutions Can Do for You

We can come out to your home or business in Townsville, Kirwan, Aitkenvale, Douglas, or anywhere else in our service area and:

  • Check all your machines for Secure Boot certificate compliance
  • Apply BIOS/UEFI firmware updates safely
  • Verify your Windows Update history and apply any outstanding patches
  • Create fresh bootable recovery media
  • Make sure your backups are in order before the June deadline

If you're a business running multiple workstations, we can do a fleet check and fix everything in one visit. Don't leave it until something breaks.

Book a Secure Boot Check →

Key Dates to Know

  • August 2023: Microsoft began phased rollout of Secure Boot revocation updates (KB5025885)
  • Early 2024–2025: Continued enforcement via cumulative Windows Updates
  • June 2026: Final enforcement phase — systems without correct firmware and patches risk boot failures
  • Now: The right time to check and fix your machines before this becomes an emergency

The Bottom Line

This isn't scaremongering — it's a real change with a real deadline that will catch some people off guard. The businesses and home users most at risk are exactly the ones least likely to have heard about it: those without a dedicated IT person keeping an eye on things.

If you're in Townsville and you're not sure whether your systems are ready, give us a call. We'd rather spend 30 minutes checking your machines now than spend 3 hours recovering them in June.

Get in Touch →  📱 Call 0408 777 938

Related Services

PC Repairs Townsville Managed IT Services Microsoft 365 & Cloud

Don't Wait Until June. Check Your PCs Now.

One visit. We'll check every machine, apply firmware updates, and make sure you're ready. Serving all of Townsville and surrounds.

Book a Check-Up → 📞 (07) 4767 7243 📱 0408 777 938