Secure Boot certificates have been updated but are not yet applied

Wilson T 245

Hello,

User's image

What's this? Do I need to take any action about it or just leave it alone?

Thanks very much😀

BryceSor 5,500 Reputation points Volunteer Moderator

2025-12-09T05:51:24.3033333+00:00

Hi Wilson T,

Try rebooting your computer, they get installed / replaced on the boot cycle and then recheck your event viewer. FYI I also have the 1801 event error number scatted amongst all the events, so I don't think you have too much to worry about. Let us know after rebooting if you still have 1801 coming up.
Baptiste Boyer 0 Reputation points

2025-12-12T20:48:44.1233333+00:00

I currently have the same issue and it broke the mirroring of my 2 HDD AGAIN, please can someone tell me how this is fixed in the BIOS thanks.

Secure Boot certificates have been updated but are not yet applied to the device firmware. Review the published guidance to complete the update and ensure full protection. This device signature information is included here.

DeviceAttributes: BaseBoardManufacturer:ASUSTeK COMPUTER INC.;FirmwareManufacturer:American Megatrends Inc.;FirmwareVersion:4602;OEMModelNumber:System Product Name;OEMModelBaseBoard:ROG STRIX B450-F GAMING II;OEMModelSystemFamily:To be filled by O.E.M.;OEMManufacturerName:System manufacturer;OEMModelSKU:SKU;OSArchitecture:amd64;

BucketId: aa5b3f49388890199a8eade70fa35fb27d954c0eec70cd0b84ea26aae2e35872

BucketConfidenceLevel:

UpdateType:

For more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.
Gary Rogers 15 Reputation points

2025-12-18T16:00:44.2933333+00:00

It does have an effect... it causes the computer to lag up to 30 seconds....a lifetime if you are trading stocks and options on the platform.
John Westfield 95 Reputation points

2025-12-25T20:57:24.8266667+00:00
With the optional update from October 28 (KB5067036), Microsoft introduced a CLI tool for the WinCS API. Install https://support.microsoft.com/en-us/topic/windows-configuration-system-wincs-apis-for-secure-boot-d3e64aa0-6095-4f8a-b8e4-fbfda254a8fe

Now install this PowerShell-Module:

Install-Module UEFIv2 -Force

You can list now the certificates:

Get-UEFISecureBootCerts db | select SignatureSubject

Which certificates are needed is listed here:
https://support.microsoft.com/en-us/topic/windows-secure-boot-certificate-expiration-and-ca-updates-7ff40d33-95dc-4c3c-8725-a9b95457578e

Now set the update configuration:

WinCsFlags.exe /apply --key "F33E0C8E002"

Now, run the Scheduled Task Secure-Boot-Update.

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Reboot twice and check again for the certificates and the Event-Log.
Diego Navarro 15 Reputation points

2026-01-17T06:23:10.7933333+00:00

John Westfield This is the right answer, it worked for me. Thank you.
Dino Abay 0 Reputation points

2026-01-20T02:31:07.48+00:00

I have a similar kind of issue. I have a Dell 7350 laptop and it keeps restarting every time I shutdown. When I checked the event log, same error is there. Would that be fixed by @John Westfield 's fix?
Christopher Millensifer 0 Reputation points

2026-02-28T03:05:36.46+00:00
Great - just freaking great ...

PS C:\WINDOWS\system32> Get-UEFISecureBootCerts db | select SignatureSubject

Get-UEFISecureBootCerts : The 'Get-UEFISecureBootCerts' command was found in the module 'UEFIv2', but the module could not be loaded. For

more information, run 'Import-Module UEFIv2'.

At line:1 char:1

Get-UEFISecureBootCerts db | select SignatureSubject

+ CategoryInfo : ObjectNotFound: (Get-UEFISecureBootCerts:String) [], CommandNotFoundException + FullyQualifiedErrorId : CouldNotAutoloadMatchingModule

Answer accepted by question author

Alexandr S 106.4K Independent Advisor

Hello, Wilson T.

If the OS is stable, you can ignore these messages. Judging by the information from the screenshot, they relate to updates from Lenovo (the manufacturer of your PC).

P.S. Even on a fully functional PC and a working OS, there are always similar messages in the Event Viewer. This is the normal behavior of the log collector.

Gary Rogers 15 Reputation points

2025-12-18T16:01:31.1333333+00:00

It does make a difference.... see comment above
Michael Held 25 Reputation points

2025-12-20T14:42:19.38+00:00

e.g. DELL will NOT update Optiplex 7050 UEFI (2017) because they let MS do the job.
Garry 5 Reputation points

2025-12-22T15:11:10.0033333+00:00

I have the same problem with Z690 AORUS ELITE AX DDR4 - last Bios updated to F33
BryceSor 5,500 Reputation points Volunteer Moderator

2025-12-23T06:14:57.2766667+00:00

Hi Gary Rogers,

I dont think Secure Boot certificate would cause an issue as far as 30 second freeze is concerned, what make and model is your computer, the drivers installed, this sounds far more likely to hardware/ software issue. I can help by pointing which logs to look at that might show which part is causing these delays, let me know.
Gary Rogers 15 Reputation points

2025-12-23T14:04:51.19+00:00

Dell Pro Slim Plus QBS1250, all drivers updated via their website. I uploaded the logs to Dell, but no solution as of yet. Reset to original state and updated Windows 11 to latest patches and updated all drivers yet again. Still no solution to temporary freezes (10 sec. --- I exaggerated when I said 30 seconds because that's what it seemed like at the time).
Dean Wortmier 20 Reputation points

2026-02-14T19:37:17.27+00:00

May not be an issue. Check your BIOS for your type of boot. If you are using the LEGACY boot, then you're not using the secure boot or the these keys anyway and so updating is NOT necessary. Life goes on, albeit with a once per month error in the event log.

DO NOT CHANGE from Legacy Boot to Secure Boot because this will require a reinstall of Windows, and I'm pretty sure you don't want to do that.

9 additional answers

Michael Held 25 Reputation points

2026-07-12T08:35:15.81+00:00

With some BIOS version like my Dell Optiplex 7050 you first have to empty your certificate memory in your BIOS. Do NOT user Factory Settings => USe DELETE ALL! With this EMPTY certificate memory you can boot your machine in SETUP MODE and Windows will write the new certificates in your BIOS Memory. If it doesn't, use Garlin UEFI Tool from GitHub. I managed to update my machine to the new certs and I'm happy now. btw, the option to delete the certificates in BIOS may only be visible in "Custom Mode" NOT "Standard Mode". Some machines like Acer Aspire even need you to setup a BIOS password to get into Secure Boot Custom Mode and to DELETE ALL certificates. Use an easy password and delete it immed afterwards. All the best to you
Was this answer helpful?
Michael Held 25 Reputation points

2026-07-12T08:37:00.7233333+00:00

[Problem solved] :)

Farmboy96 0 Reputation points

2026-07-13T09:55:31.4066667+00:00

Great to hear you fixed your system. The problem for everyone I think is that MS Downloads an update regardless. My Backup system on Network is a Win7 Pro X64 with EUFI yet this got a download + Edge, not asked for or wanted. These systems are supposed to be not supported. I made mistake of going on MS site for some info & Zap. The system got this download. After S/W off, PC would not restart, regardless of all the items to try, nothing works !. Now have to recover DOCs and Pics with Ubuntu ! A right pain, must be causing problems for millions, no doubt MS hoping that lots of folk will buy NEW PC's & Win11 ! I think this is a Marketing Ploy. Rgds.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Dean Wortmier 20 Reputation points

2026-02-14T19:35:51.6466667+00:00

STOP!

May not be an issue. Check your BIOS for your type of boot. If you are using the LEGACY boot, then you're not using the secure boot or the these keys anyway and so updating is NOT necessary. Life goes on, albeit with a once per month error in the event log.

DO NOT CHANGE from Legacy Boot to Secure Boot because this will require a reinstall of Windows, and I'm pretty sure you don't want to do that.
Was this answer helpful?

4 people found this answer helpful.
Clash Plays 0 Reputation points

2026-02-28T18:42:18.36+00:00

Im using Huawei Matebook D15 2022 with a Model number: BOD-WXX9-PCB-B3. And this is the problem also in Event Viewer in Summary page events where error icon appears with Event ID of 1801:

Updated Secure Boot certificates are available on this device but have not yet been applied to the firmware. Review the published guidance to complete the update and maintain full protection. This device signature information is included here.

DeviceAttributes: BaseBoardManufacturer:HUAWEI;FirmwareManufacturer:HUAWEI;FirmwareVersion:2.31;OEMModelNumber:BOD-WXX9;OEMModelBaseBoard:BOD-WXX9-PCB-B3;OEMModelSystemFamily:MateBook D;OEMManufacturerName:HUAWEI;OEMModelSKU:C170;OSArchitecture:amd64;

BucketId: 36340435879aed799ddaf7759fed69bedf9488c225158675f990220ee0c7ef86

BucketConfidenceLevel:

UpdateType:

For more information, please see https://go.microsoft.com/fwlink/?linkid=2301018
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
John Westfield 95 Reputation points

2025-12-25T20:58:31.54+00:00
With the optional update from October 28 (KB5067036), Microsoft introduced a CLI tool for the WinCS API. Install https://support.microsoft.com/en-us/topic/windows-configuration-system-wincs-apis-for-secure-boot-d3e64aa0-6095-4f8a-b8e4-fbfda254a8fe

Now install this PowerShell-Module:
```
Install-Module UEFIv2 -Force
```
You can list now the certificates:
```
Get-UEFISecureBootCerts db | select SignatureSubject
```
```
Get-UEFISecureBootCerts kek | select SignatureSubject
```
Certificates which are updated are listed here:

https://support.microsoft.com/en-us/topic/windows-secure-boot-certificate-expiration-and-ca-updates-7ff40d33-95dc-4c3c-8725-a9b95457578e

WinCsFlags is going to update ALL FOUR certificates listed. Also the one stored in KEK.

Now set the update configuration:
```
WinCsFlags.exe /apply --key "F33E0C8E002"
```
Now, run the Scheduled Task Secure-Boot-Update.
```
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
```
Reboot twice and check again for the certificates and the Event-Log.

If all is updated, you can set back the update configuration:

PS:
After validating the new values, a change to the former is not required!
As each value defines a state, and not a action.

WinCsFlags.exe /apply --key "F33E0C8E001" is NOT required afterwards.

F33E0C8E001 (State: Disabled):

This is the default state on a system. It indicates that the update for the new Secure Boot certificates is paused or disabled. The system continues to use the old certificates.

F33E0C8E002 (State: Enabled):

This key signals the Windows Configuration System (WinCS) to write the new 2023 certificates (such as Windows UEFI CA 2023) to your motherboard's firmware and to update the boot manager.
Was this answer helpful?

10+ people found this answer helpful.
Dean Wortmier 20 Reputation points

2026-02-14T19:38:58.5833333+00:00

If this doesn't work, you're not using secure boot. But don't change because you'll have to reinstall Windows if you change the boot type
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Edward エドワドアディパットラー Adiputra 0 Reputation points

2025-12-20T19:23:18.3866667+00:00

finally i tried it myself and succeeded, for fix that. 1 unistall security on "devices manager" and then restart pc. after back to dekstop windows try open delta force and then not show green screen again.
Was this answer helpful?
Martin 0 Reputation points

2025-12-21T18:54:51.39+00:00

"I uninstall security". Please give more details. This is as mysterious as the MS-message! Do you mean the "Device Manager" in "Manage my PC" (right click on "This PC" in Explorer? Do you eliminate TPM 2.0? But where is my security then? Probably you won't get anymore messages from TPM if it is no longer in use. But with what do you replace TPM?

Edward エドワドアディパットラー Adiputra 0 Reputation points

2025-12-22T18:13:53.8233333+00:00

just uninstall tpm in security device on device manager, and restart your pc /notebook. tpm/security will be reinstall automatic after finish restart

Gary Rogers 15 Reputation points

2025-12-22T19:31:26.9666667+00:00

Did this. Did not fix the error.

John Westfield 95 Reputation points

2025-12-25T20:48:23.1166667+00:00

Okay, here is what to do:

Check for optional Update from 28th of October (KB5067036) where Microsoft introduces a CLI-Tool for the WinCS-API. If not installed, please do so.

Also install this PowerShell Module:

Install-Module UEFIv2 -Force

Now use this command to check certificates:

Get-UEFISecureBootCerts db | select SignatureSubject

Here is a proper output of the above command:

SignatureSubject ---------------- CN=Microsoft Corporation UEFI CA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US CN=Windows UEFI CA 2023, O=Microsoft Corporation, C=US CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US CN=GIGABYTE CN=GIGABYTE CN=Microsoft Option ROM UEFI CA 2023, O=Microsoft Corporation, C=US CN=Microsoft UEFI CA 2023, O=Microsoft Corporation, C=US

Important are the four Certificates named here:
https://support.microsoft.com/en-us/topic/windows-secure-boot-certificate-expiration-and-ca-updates-7ff40d33-95dc-4c3c-8725-a9b95457578e

You can now instruct your system to update these keys after two reboot which you have to do manually.
Two commands for first step:

This allows you to query and configure the settings for updating certificates and the boot manager. You can check the current status with:

WinCsFlags.exe /query

The active configuration has either the value F33E0C8E001 or F33E0C8E002. The former corresponds to the status "Disabled," meaning an update is not planned. Switching to F33E0C8E002 sets the flag that installs the new certificates and the boot manager.

WinCsFlags.exe /apply --key "F33E0C8E002"

Now, run the Scheduled Task Secure-Boot-Update.

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

After two reboots, check again:

Get-UEFISecureBootCerts db | select SignatureSubject

And you can set the active configuration back:

WinCsFlags.exe /apply --key "F33E0C8E001"
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Secure Boot certificates have been updated but are not yet applied

9 additional answers

Your answer