Microsoft will begin refreshing Secure Boot certificates in March for Windows 11 and Windows 10 ESU users. The certificates, originally introduced in 2011 when Secure Boot debuted, are being updated as a security precaution to protect systems from running unsigned and potentially malicious code before Windows launches.

Without the new certificates, systems will still function normally but enter a degraded security state that limits their ability to receive future boot-level protections. This means users won't be protected from malware and viruses targeting vulnerabilities in older Windows versions. The update is only available to Windows 11 systems and Windows 10 PCs subscribed to Microsoft's Extended Security Updates.

Many users can obtain the updated certificates through Windows Update, though some may need additional firmware updates from their OEM. Microsoft has been working with partners like Dell and HP to ensure a smooth transition, with many 2024 systems already having the updated certificates and nearly all 2023 devices including them. The company has been alerting IT customers to this transition since last year.