{"id":36,"date":"2026-03-10T21:50:13","date_gmt":"2026-03-10T21:50:13","guid":{"rendered":"https:\/\/patchtuesdayfallout.com\/archives\/?p=36"},"modified":"2026-03-10T22:01:05","modified_gmt":"2026-03-10T22:01:05","slug":"intel-entry-003-the-2026-secure-boot-reload","status":"publish","type":"post","link":"https:\/\/patchtuesdayfallout.com\/archives\/2026\/03\/10\/intel-entry-003-the-2026-secure-boot-reload\/","title":{"rendered":"INTEL ENTRY 003: THE 2026 SECURE BOOT RELOAD"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>OVERSEER NOTE:<\/strong> The clock is ticking on the original 2011 Secure Boot trust anchors. Starting <strong>June 2026<\/strong>, the legacy certificates that have guarded your boot process for 15 years will expire. While systems will likely still boot, they will enter a &#8220;degraded security state,&#8221; unable to trust new bootloaders or receive critical security fixes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For servers and IT-managed systems that don&#8217;t allow Microsoft to handle the &#8220;managed opt-in,&#8221; you must perform manual surgery to inject the new <strong>Windows UEFI CA 2023<\/strong> certificate.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Pre-Surgery Diagnostics<\/strong><\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Before you start the update, verify if your terminal is already running the 2023 trust chain:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>Open PowerShell<\/strong> as Administrator.<\/li>\n\n\n\n<li><strong>Run this command<\/strong> to check your UEFI Signature Database<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>(&#91;System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>True:<\/strong> You are future-proofed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>False:<\/strong> You are running on borrowed time (PCA 2011).<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Manual Remediation Protocol<\/strong> <\/h4>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 1: The Firmware Prerequisite<\/strong> Most modern OEMs require a BIOS update to support the certificate append. If your firmware is too old, the registry keys below will fail silently.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Action:<\/strong> Ensure your BIOS version includes the <strong>UEFI CA 2023<\/strong> KEK certificate.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 2: The Registry Opt-In<\/strong> To tell the system you are ready to receive the updated trust chain, you must flip the manual switch in the registry.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Command:<\/strong> <\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>```cmd\nreg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Secureboot \/v AvailableUpdates \/t REG_DWORD \/d 0x100 \/f<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><em>This creates the <code>AvailableUpdates<\/code> value and sets it to 256 (<code>0x100<\/code>), signaling the &#8220;IT-Managed&#8221; update path.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 3: Triggering the Update Task<\/strong> Windows doesn&#8217;t apply the change instantly; it uses a scheduled task to perform the injection.<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>Run the Task:<\/strong>PowerShell<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>Start-ScheduledTask -TaskName \"\\Microsoft\\Windows\\PI\\Secure-Boot-Update\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">     2. <strong>Reboot:<\/strong> You must perform a full power cycle for the UEFI firmware to process the new variables.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Post-Op Verification<\/strong><\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">After the reboot, mount your EFI partition to confirm the new signature on the Boot Manager.<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>Mount EFI:<\/strong> <code>mountvol s: \/s<\/code><\/li>\n\n\n\n<li><strong>Check Properties:<\/strong> Navigate to <code>S:\\EFI\\Microsoft\\Boot\\bootmgfw.efi<\/code>.<\/li>\n\n\n\n<li><strong>Digital Signatures:<\/strong> Right-click &gt; Properties &gt; Digital Signatures. The &#8220;Issued by&#8221; field should now read <strong>Windows UEFI CA 2023<\/strong>.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>WARNING:<\/strong> Updating Secure Boot keys can trigger a <strong>BitLocker Recovery<\/strong> prompt on the next boot. <strong>ALWAYS<\/strong> have your recovery keys backed up before proceeding with this surgery.<\/p>\n<\/blockquote>\n","protected":false},"excerpt":{"rendered":"<p>OVERSEER NOTE: The clock is ticking on the original 2011 Secure Boot trust anchors. Starting June 2026, the legacy certificates that have guarded your boot process for 15 years will expire. While systems will likely still boot, they will enter a &#8220;degraded security state,&#8221; unable to trust new bootloaders or receive critical security fixes. For &#8230; <a title=\"INTEL ENTRY 003: THE 2026 SECURE BOOT RELOAD\" class=\"read-more\" href=\"https:\/\/patchtuesdayfallout.com\/archives\/2026\/03\/10\/intel-entry-003-the-2026-secure-boot-reload\/\" aria-label=\"Read more about INTEL ENTRY 003: THE 2026 SECURE BOOT RELOAD\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"pagelayer_contact_templates":[],"_pagelayer_content":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-36","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/posts\/36","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/comments?post=36"}],"version-history":[{"count":5,"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/posts\/36\/revisions"}],"predecessor-version":[{"id":44,"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/posts\/36\/revisions\/44"}],"wp:attachment":[{"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/media?parent=36"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/categories?post=36"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/tags?post=36"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}