Microsoft's deadline week: four products retire tomorrow, and Secure Boot's last 2011 certificate expires next Monday

Tomorrow is one of the busiest days on Microsoft's retirement calendar, and the week has a sting in its tail. Four products reach a lifecycle milestone on Tuesday 13 October 2026. Then on Monday 19 October, the last of the original 2011 Secure Boot certificates expires: the one that signs the Windows boot manager itself.

None of these switch anything off. But each one stops a device getting something it needs, and the Secure Boot change affects almost every Windows device you manage.

What affects you?

Tick what you run and you'll get an action list in date order that you can copy into a ticket or a to-do app.

The Secure Boot certificates

Secure Boot checks that everything loaded before Windows starts is signed by someone the firmware trusts. Those trust anchors are certificates stored in the device's UEFI firmware, and Microsoft's originals date from 2011. They're being replaced by 2023 versions. Two of them expired in June (one has two replacements, so it appears twice below). The last one goes next Monday.

What actually happens on 19 October

Microsoft is clear that devices without the new certificates keep starting and running normally, and keep installing ordinary Windows updates. Nobody's laptop stops booting.

What they lose is the ability to get new protections for the early boot process: updated boot managers, new entries in the DB and DBX lists, and fixes for boot-level vulnerabilities. That's exactly the layer bootkits target, and over time it weakens protections such as BitLocker that depend on a trusted boot chain. A device that misses this change is stuck with today's boot security for good.

Check a device in 30 seconds

Windows records progress in the registry. Microsoft's guidance is to read UEFICA2023Status, which moves from NotStarted to InProgress to Updated, and to check UEFICA2023Error for anything that went wrong. Run this in an administrator PowerShell window:

1
2
3
4
5
6
7$s = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" -ErrorAction SilentlyContinue
[pscustomobject]@{
    SecureBootOn = Confirm-SecureBootUEFI
    Status       = $s.UEFICA2023Status
    Error        = $s.UEFICA2023Error
    CA2023InDb   = [Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match "Windows UEFI CA 2023"
} | Format-List

Then paste what it prints here. It's checked in your browser and nothing is sent anywhere:

Don't rely on the WindowsUEFICA2023Capable value you may see nearby: Microsoft says not to use it for status. In the Event Viewer, the Secure Boot DB and DBX update events 1801 and 1808 also show each device's progress. To check every device at once, run the same script as an Intune Remediations detection script and read the output column.

Roll it out with Intune

Microsoft added three settings to the Intune settings catalog for this. Create a Windows 10 and later › Settings catalog profile, search for Secure Boot, and you'll find:

For most organisations the first setting, enabled for a pilot group and then everyone, is the one that matters. Before you assign it:

• Start with your OEM's firmware. Microsoft's first recommendation is the latest firmware from the device maker. When the update fails, the error recorded in UEFICA2023Error often comes from firmware.
• It isn't instant. A scheduled task processes the setting every 12 hours, and the boot manager part needs a normal restart.
• It can't be undone from Windows. Once the certificates are written to firmware, removing them means going into the firmware itself. That's why you pilot first.
• Check your BitLocker recovery keys are escrowed before changing anything in the boot chain. That's good practice for any firmware or boot change.
• Known issue on Pro editions. Microsoft notes the policy can fail on Windows 10 and 11 Pro with Intune error 65000, and its guidance covers the licensing fix.

Without Intune

For servers and devices you manage yourself, Microsoft documents a registry trigger. Setting AvailableUpdates to 0x5944 tells Windows to add the 2023 certificates, update the KEK and install the new boot manager:

1
2reg add HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Restart when convenient, then run the check again. There's a Group Policy route too. Don't edit AvailableUpdatesPolicy by hand: that's the value Intune and Group Policy write.

Windows 11 24H2 Home and Pro

Home and Pro devices on version 24H2 get their last security update tomorrow. Enterprise and Education editions of 24H2 are supported until 12 October 2027, so most managed corporate devices aren't affected yet.

Look for Pro devices in particular: small offices, contractors' laptops and anything bought retail often run Pro. Microsoft's recommended path is Windows 11 version 25H2. In Intune, a feature update policy targeting 25H2 moves them across, and the Windows feature update reports show which devices are still on 24H2.

Windows 10 Enterprise 2016 LTSB

The 2016 Long-Term Servicing Branch reaches the end of its ten years tomorrow. LTSB tends to sit on devices nobody thinks of as PCs: kiosks, factory and lab machines, digital signage and medical carts. That makes them easy to forget.

Microsoft's recommended move is Windows 11 Enterprise LTSC 2024. If a device can't move in time, Microsoft says Extended Security Updates are available for LTSB 2016. Treat that as a bridge, not a plan.

Office LTSC 2021

Volume-licensed Office LTSC 2021 Standard, for Windows and Mac, reaches the end of its support tomorrow and stops getting security updates. The options are Microsoft 365 Apps, which stays current and supported, or Office LTSC 2024 if you need a perpetual, non-subscription version for the same kind of locked-down devices.

Windows Server 2022 moves to extended support

This is the gentlest of the five. Windows Server 2022 leaves mainstream support tomorrow and enters extended support, which keeps security updates coming until 14 October 2031 at no extra cost. Extended support is security updates only, so Microsoft's message is to start planning for Windows Server 2025.

Checklist

• Secure Boot status checked across the estate with UEFICA2023Status
• Latest OEM firmware deployed where the update fails
• Intune Secure Boot policy piloted, then assigned to everyone
• BitLocker recovery keys escrowed before changing boot components
• Windows 11 24H2 Home and Pro devices moved to 25H2
• LTSB 2016 devices found, with a move to LTSC 2024 or ESU in place
• Office LTSC 2021 installs replaced with Microsoft 365 Apps or Office LTSC 2024
• Windows Server 2025 on the roadmap for your 2022 servers