Secure Boot Certificate User Guide

Overview

This DEX pack adds a Secure Boot Certificate DEX Pack dashboard to your SysTrack environment. The dashboard displays every Windows device in your fleet and its current state in the certificate update process.

The pack includes two components:

• Daily status check - runs automatically on every device to collect certificate status data and populate the dashboard. No action needed.

• Remediation command - backs up BitLocker keys and triggers the Microsoft certificate update. Does not run automatically - must be triggered by an administrator, either on-demand or via an optional schedule you configure.

How This Feature Helps You

Microsoft Secure Boot certificates issued in 2011 are set to expire in 2026. All Windows devices that use UEFI Secure Boot require updated certificates; without them, devices may fail to boot or may lose trust for drivers and firmware updates. The roadmap for the expiration is as follows:

The Secure Boot Certificate DEX pack collects daily status from each client, tracks a 7-step remediation checklist, and can automatically trigger the certificate update on devices that have safely backed up their BitLocker recovery keys.

Operational Scope and Safety

• Copy, write, or modify certificates

• Write to UEFI firmware

• Modify the boot configuration

• Force device reboots

Microsoft‑Provided Actions Used

• BitLocker key backup using built‑in Windows APIs (equivalent to Group Policy-based or manual administrative backup)

• Setting the AvailableUpdates registry value, the same value used by Windows Update

• Starting Microsoft’s Secure‑Boot‑Update scheduled task, which is the same task triggered by Windows Update

How to Use the Dashboard

Open the Dashboard

Navigate to Secure Boot Certificate DEX Pack in the dashboard list. You will see all Windows devices with their current status.

Understand the Status Column

Each device shows its current position in the 7-step update process:

Use the Stage Filter

The Stage not completed drop-down list lets you focus on devices that need attention. For example:

• Select Step 1 - BitLocker keys need backup to see all devices that haven't backed up their keys yet.

• Select Step 5 - Reboot needed to see all devices waiting for a reboot.

• Select No Filter to see all devices including those that are already complete.

Check Certificate Expiry

The color-coded columns show how urgent each device is:

• Days to MS Cert Expiry - red means the Microsoft certificate is close to expiring or already expired.

• Days to OEM Cert Expiry - red means a vendor certificate (Dell, HP, Lenovo, etc.) is expired. OEM certs can only be updated via a BIOS update from the manufacturer.

View device Details

Click any device name to see a detailed breakdown: timestamps for each completed step, which steps were performed by SysTrack vs. externally, and any error messages.

Recommended Workflow

Follow these steps to get your entire fleet updated before the June 2026 deadline:

1. Wait 24 hours after deployment for the first collection cycle to complete. The dashboard will populate with status data from all devices.

2. Review the dashboard. Use "No Filter" to get a fleet-wide overview. Check how many devices are at each step.

3. Run remediation on devices at step 1-2. You have two options:    

   1. On-demand: Go to Prevent > Tools, select the SecureBoot Needs Remediation group from the dropdown, then click Take Action. In the dialog, select Automations, then navigate to Security > SecureBoot Remediation. Set Run Mode to Run Silently and click Run. This targets all devices in the group in one click.

   2. Scheduled (optional): See Optional: Automated Remediation Schedule below.

       The remediation command backs up BitLocker keys (step 1) and triggers the Microsoft certificate update (steps 2-3). This is safe - the script refuses to trigger the update until all BitLocker keys are confirmed as backed up. As devices complete the process, they drop out of the group automatically.  

4. Wait for steps 3-4 to complete automatically. The Microsoft scheduled task processes the certificate update within 12  hours. The daily status check will pick up the progress.

5. Schedule reboots for devices at step 4-6. After the certificates are staged, at least one reboot is needed for the firmware to apply them. Coordinate reboots during your normal maintenance windows. The pack does not force reboots.

6. Monitor until all devices reach step 8. Use the stage filter to find stragglers. Devices that stay stuck may have firmware issues - check the Update Error column.

7. Handle OEM cert warnings separately. Red values in the Days to OEM Cert Expiry column mean a vendor certificate (e.g.  Dell KEK) is expired. This requires a BIOS update from the device manufacturer - SysTrack cannot fix OEM certs. If the OEM has shipped a replacement cert via BIOS update, the expired cert is automatically skipped and the column shows the replacement's expiry instead.

Computer Group: SecureBoot Needs Remediation

The DEX pack includes a dynamic computer group that automatically contains all devices at step 1 or step 2 - the devices where the remediation command can take action. As devices progress past step 2, they drop out of the group automatically.

The group is typically imported as part of the DEX pack. If you need to create it manually:

1. Go to Configure > Groups.

2. Click + to add a new group.

3. Name: SecureBoot Needs Remediation.

4. Type: Dynamic.

5. Enter this SQL:    

   SELECT T.WGUID
   FROM RPT_VUSecureBootCert T
   WHERE T.NEXTSTEP = 1
      OR T.NEXTSTEP = 2

6. Save the group.

Use this group in Prevent > Tools to run on-demand remediation, or link it to a Tool Schedule for automated remediation.

Optional: Automated Remediation Schedule

Instead of running remediation manually each time, you can set up a Tool Schedule that automatically remediates devices when they log on. This is optional - the on-demand approach via Prevent > Tools works fine for smaller fleets.

To set up the schedule, add a new Tool Schedule entry to the existing SecureBootCert role with these settings:

This runs the remediation after each user logon, but only on devices in the SecureBoot Needs Remediation group (step 1 or 2). As devices complete the process, they drop out of the group automatically and stop receiving the automation. The remediation is safe to run repeatedly - it checks the current state and only acts when needed.

What SysTrack Does vs. What Microsoft Does

Troubleshooting

References

• Microsoft: Secure Boot playbook for certificates expiring in 2026

• Microsoft: Registry key updates for IT-managed Secure Boot updates

• Microsoft: Secure Boot troubleshooting guide

• Microsoft: Enterprise Deployment Guidance for CVE-2023-24932