Secure Boot 2026 Certificate Audit & Remediation

PowerShell tool for auditing and remediating the Windows Secure Boot CA certificate expiration affecting all Windows devices in June 2026.

---

Background

The 2011 Secure Boot CA certificates used to verify the Windows boot process expire in June 2026. Devices that have not received the new 2023 CA certificates risk failing to boot after Microsoft pushes revocation updates to the Secure Boot DBX.

Windows Servers are not updated automatically and require manual intervention.

---

What This Script Does

1. Discovers servers automatically via Active Directory, or falls back to a plain text file
2. Audits each server in parallel for:
   • OS version and required KB
   • Whether the required April 2026 Cumulative Update is installed
   • Whether the Secure Boot DB and KEK certificates have been updated
   • WinCsFlags.exe availability and scheduled task presence
   • Event Log status (Event ID 1801 / 1808)
3. Reports findings in a timestamped CSV + log file
4. Remediates non-compliant servers with operator confirmation (or fully automated)

---

Required KB per OS (April 2026)

OS	Required KB
Windows Server 2025	KB5082063
Windows Server 2022	KB5082142
Windows Server 2019	KB5082123
Windows Server 2016	KB5082198
Windows Server 2012/R2	Not supported without ESU

---

Prerequisites

Requirement	Details
PowerShell	5.1 or later
Permissions	Domain Admin or delegated remote management rights
WinRM	Must be enabled on all target servers
RSAT	Required for AD discovery: Install-WindowsFeature RSAT-AD-PowerShell
WinCsFlags.exe	Included in the required KB for each OS

---

Installation

# Clone the repository
git clone https://github.com/yourorg/secureboot-audit.git
cd secureboot-audit

Or download Invoke-SecureBootAudit.ps1 directly and run it.

If needed, allow script execution:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

---

Usage

Basic — AD discovery, interactive prompts

.\Invoke-SecureBootAudit.ps1 -CustomerName "Contoso"

Report only — no remediation, safe to run anytime

.\Invoke-SecureBootAudit.ps1 -CustomerName "Contoso" -ReportOnly

Scoped AD search — limit to a specific OU

.\Invoke-SecureBootAudit.ps1 -CustomerName "Contoso" `
    -SearchBase "OU=Servers,DC=contoso,DC=com"

Text file fallback — use when AD module is unavailable

.\Invoke-SecureBootAudit.ps1 -CustomerName "Contoso" `
    -ServerListPath ".\servers.txt"

Fully automated — remediate all without prompts

.\Invoke-SecureBootAudit.ps1 -CustomerName "Contoso" -RemediateAll

Custom output path and parallelism

.\Invoke-SecureBootAudit.ps1 -CustomerName "Contoso" `
    -OutputPath "C:\Reports\SecureBoot" `
    -MaxConcurrent 30 `
    -TimeoutSeconds 45

Verbose output

.\Invoke-SecureBootAudit.ps1 -CustomerName "Contoso" -Verbose

---

Parameters

Parameter	Type	Default	Description
-CustomerName	String	(required)	Used in output filenames
-ServerListPath	String	.\servers.txt	Text file fallback (one server per line, # for comments)
-SearchBase	String	(domain root)	AD OU to scope discovery
-OutputPath	String	.	Where to save CSV and log
-ReportOnly	Switch	Off	Audit only, never remediate
-RemediateAll	Switch	Off	Remediate all without prompting
-MaxConcurrent	Int	20	Parallel audit jobs (1–100)
-TimeoutSeconds	Int	30	Remote connection timeout (5–300)

---

Output Files

Each run produces two files in OutputPath:

File	Contents
SecureBoot_Report_<Customer>_<timestamp>.csv	Per-server audit results
SecureBoot_Log_<Customer>_<timestamp>.txt	Full timestamped log

CSV Columns

Column	Description
Server	Hostname
FQDN	Fully qualified domain name
IPAddress	Primary IPv4 address
OS	Full OS name
OSVersion	Year-based version (2016/2019/2022/2025)
OSBuild	Windows build number
RequiredKB	KB number required for this OS
KBInstalled	Yes / No / N/A
KBInstalledDate	Date KB was installed
RecentKBs	Last 5 KBs installed after April 2026
SecureBootEnabled	Yes / No / Not supported
CertUpdateStatus	NotStarted / InProgress / Updated
DB_Updated	Yes / No
KEK_Updated	Yes / No
WinCSAvailable	Yes / No
TaskExists	Yes / No
EventID	Last Secure Boot event (1796/1801/1808)
Action	None / Install KB / Update Certs / Reboot / Unreachable
ActionDetail	Human-readable description
Error	Error message if audit failed
AuditTime	Timestamp of this server's audit

---

Remediation Flow

For each server:
  1. Secure Boot enabled?
       No  -> Skip (not affected)
       Yes -> Continue

  2. Required KB installed?
       No  -> Flag "Install KB" (deploy via patch management)
       Yes -> Continue

  3. WinCsFlags.exe available?
       No  -> Flag "Install KB" (tool missing, KB not properly applied)
       Yes -> Continue

  4. Certificates updated?
       Yes -> Compliant, done
       InProgress -> Flag "Reboot" (needs 2 reboots)
       No  -> Flag "Update Certs"

  5. If "Update Certs" (with confirmation):
       Run: WinCsFlags.exe /apply --key F33E0C8E002
       Run: Start-ScheduledTask \Microsoft\Windows\PI\Secure-Boot-Update
       -> Reboot server twice
       -> Re-run script to verify

---

Event Log Reference

Event ID	Source	Meaning
1796	TPM-WMI	Secure Boot not enabled
1801	TPM-WMI	Cert update not yet applied (logged 2x/day)
1808	TPM-WMI	Cert update successfully applied

---

Virtual Servers — Additional Steps

Servers running as VMs have two certificate stores:

• Active DB — Updated by this script. Sufficient for ongoing operation.
• Default DB — Must be updated at the hypervisor level. Required to avoid issues after OS reinstall or restore.

Platform	Default DB Update Method
Hyper-V Gen 2	Create new VM with same config, attach existing disks
VMware	Follow Broadcom's advisory
Hyper-V Gen 1	Not affected (no Secure Boot)

---

FAQ

Q: Will servers break immediately in June 2026?
A: Not immediately. Servers will break when Microsoft pushes a DBX revocation update, which may happen after June 2026. Updating now avoids the risk entirely.

Q: What about Server 2012/2012 R2?
A: Without Extended Security Updates (ESU), there is no supported path to update the Secure Boot certificates. Since revocation won't be pushed to unsupported OS versions either, they may continue to function but receive no security protection.

Q: Do I need to update UEFI firmware too?
A: Yes, for physical servers. The Default DB (factory defaults) can only be updated via UEFI firmware from the hardware vendor (Dell, HP, Lenovo, etc.). The script updates the Active DB via Windows, which is sufficient for ongoing operation but not for OS reinstalls.

Q: My servers can't be reached — what do I check?
A: Ensure WinRM is enabled (Enable-PSRemoting -Force) and that firewall rules allow TCP 5985/5986 from your management machine.

---

References

• Microsoft: Secure Boot certificate expiration 2026
• Microsoft: Secure Boot playbook
• WinCS APIs for Secure Boot
• How to manage Boot Manager revocations (CVE-2023-24932)
• Broadcom VMware advisory

---

License

MIT License. See LICENSE for details.