Update for my Surface Pro 2 Laptop

Question

Update for my Surface Pro 2 Laptop

David Gardner 0

Last week my laptop brought in 2020 failed to boot all I got was a box stating window secure boot error after looking about on my main pc to find out that the last update changed my boot record. I even did a reset hoping it would work so I am booting without Microsoft's secure boot. I did read somewhere that the last update included an extension date to the boot file but that doesn't seem to be the case on my laptop. Would appreciate any advice to rectify Thankyou in advance.

0 comments

2 answers

Your answer

Answer 1

Sin-D 12,260 Microsoft External Staff Moderator

Hi David Gardner,

I understand how concerning it is when a device that was previously working suddenly stops booting and starts showing Secure Boot errors.

Before suggesting further steps, could you confirm the exact Surface model you are using? Your post title mentions Surface Pro 2, but you also stated the device was purchased in 2020, so I'd like to make sure we're troubleshooting the correct hardware.

In the meantime, if this is a Surface device from around 2020 that can still access Windows:

Open "Windows Update" and install all available updates, including optional firmware updates.
Restart the device after updates complete.
Open "Windows Security" > "Device Security" and check whether Secure Boot is reported as enabled and healthy.
If you previously changed Secure Boot settings in Surface UEFI, avoid making additional changes unless you have access to your BitLocker recovery key.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

David Gardner 0 Reputation points

2026-07-09T15:10:55.0766667+00:00

My Surface Model is " Surface Laptop 2 Consumer Model 1769 i7" the UEFI bios number is "140.178.768" and version date 05.15.2014.

I have upgraded to windows 11 Pro Version 25h2 OS build 26200.8737. I have followed your suggestion and when looking at windows security > device security to check the secure Boot is enabled there is not a setting for boot security. My screen shows Core Isolation then Security Processor and Data Encryption. Help if possible please
Sin-D 12,260 Reputation points Microsoft External Staff Moderator

2026-07-12T00:50:14.9366667+00:00
Hi David Gardner,

Thank you for providing the additional information.

Based on your description, the issue may be related to Secure Boot configuration or firmware compatibility rather than Windows itself.

Since Windows is currently able to start, please try the following:

Shut down the Surface completely.

Press and hold the Volume Up button, then press the Power button to enter Surface UEFI.

Open "Security" and verify that "Secure Boot" is set to Microsoft Only (or Enabled, depending on the options shown).

Save the changes and restart Windows.

After Windows starts, press Windows Key + R, type msinfo32, and press Enter. In System Information, check the value of "Secure Boot State" and let me know whether it shows On or Off.
Sin-D 12,260 Reputation points Microsoft External Staff Moderator

2026-07-13T02:44:36.5566667+00:00

Hi David Gardner,

Have you had the chance to check my answer yet?

Please do keep me updated.

Answer 2

Microsoft has been updating Secure Boot certificates that were originally issued in 2011, since those older certificates begin expiring in June 2026. The "Microsoft Corporation KEK CA 2011" certificate expired on June 24, 2026, "Microsoft UEFI CA 2011" expired on June 27th, and "Microsoft Windows Production PCA 2011" is the last to go, expiring October 19, 2026. Most devices are meant to get the newer 2023 certificates automatically, and many OEMs provide firmware updates when needed — but on some machines (especially 2020-era laptops with older firmware), that update either didn't land properly or the firmware couldn't accept it, which is very likely what caused your boot failure.

Ref:

Windows Secure Boot certificate expiration and CA updates

Check Windows Security → Device Security → Secure Boot for a green/yellow/red badge.
Visit Microsoft's Surface Secure Boot Certificates support page to see if your exact model is eligible for updates.
Only Surface devices from 2024+ have the new certificates built in — older models get them via Windows Update, if still supported.
Manual update (if your model qualifies):
- Hold Volume-Up + Power → boot into UEFI
- Go to Security → Secure Boot → Change Configuration