Secure Boot & Boot Health Check - Is your PC ready for the new Secure Boot certificates? (Updated Oct 2026)


Description:
Microsoft is replacing the certificates that Secure Boot has used since 2011. The Microsoft Windows Production PCA 2011 certificate, which signs the Windows boot manager, expires in October 2026. To keep receiving boot security updates, a PC needs the new Windows UEFI CA 2023 certificate in its firmware, and the boot manager on its hidden EFI system partition needs to be updated as well. Most people have no easy way to see where their PC stands.

Secure Boot & Boot Health Check answers that in one click. It shows a plain green, amber or red answer, explains each check in everyday language and lists what to do next in the order Microsoft recommends. IT staff get the detail behind it: the actual certificates in the firmware, Windows' own update status and event history, and a report to export for clients.

The tool is read-only. It never changes the firmware, Secure Boot, the boot partition or Windows Update.

How to use:
1. Open the tool. The checks start straight away and take a few seconds. Run FW Admin Tech Tools as administrator for the full check; without administrator rights it uses what Windows reports and skips the firmware certificate list.

2. Read the coloured banner at the top: Ready (green), Nearly there or Secure Boot is off (amber), or Certificate update needed / Boot partition is nearly full (red), with a sentence explaining why.

3. The Checks tab lists every check with an OK, Attention, Problem or Info result and what it means. Hover over a row to read the full explanation.

4. Firmware certificates lists the certificates actually stored in your PC's firmware (allowed signatures, Key Exchange Keys and the Platform Key), who issued them and when each one expires.

5. Update history shows the Secure Boot update events Windows has recorded, and any servicing-log errors that point at the EFI system partition.

6. EFI partition previews what is using the hidden EFI system partition: the boot screen fonts that Microsoft's own fix for a full partition removes, boot menu languages your PC doesn't use, other systems' boot loaders and your PC maker's tools, and the Windows files that must stay. It shows how much space each would free. It's a preview only — nothing is deleted.

7. What to do next lists the steps for your PC, in the supported order: back up your BitLocker recovery key, install your PC maker's firmware update, then install Windows updates and restart.

8. Use Copy report, Export to TXT or Export to CSV to keep the results or send them to a client or support person, and Check again after updating.

What You Can Do With This Program

What it checks:

• How the PC starts:
  • UEFI or legacy BIOS start-up, and whether the Windows disk uses the GPT layout Secure Boot needs. PCs that start the BIOS way aren't affected by the certificate change, and the tool says so.
  • Whether Secure Boot is turned on.
  
  
• The 2023 certificates:
  • Reads the firmware's own certificate lists to confirm the Windows UEFI CA 2023 certificate and the Microsoft Corporation KEK 2K CA 2023 Key Exchange Key are present, with every certificate's expiry date.
  • Checks whether Windows already starts with the boot manager signed by the 2023 certificate.
  • Shows Windows' own update status and its Secure Boot update events, including updates that keep failing.
  
  
• Is the EFI partition the problem?:
  • Measures the free space on the hidden EFI system partition, where the boot manager lives. Updates need about 15 MB free; less than 13 MB is flagged red and 13 to 15 MB amber.
  • Previews a clean-up: lists what is on the partition and how much each item uses, marked Can remove, Usually safe, Check first or Keep, and how much free space you would have afterwards. Nothing is deleted.
  • Searches Windows' servicing log (CBS.log) for update errors that point at the EFI partition or running out of space there, so you can tell whether a full partition is why updates keep failing.
  
  
• Dual boot and BitLocker:
  • Flags Linux and other boot loaders on the EFI partition. Their shim must be a version signed with Microsoft's 2023 certificate, or they may stop starting once the old certificates are retired.
  • Shows whether BitLocker protects the Windows drive, so you know to back up the recovery key before any firmware or Secure Boot change. The recovery key itself is never read.
  
  
• For IT support and technicians:
  • Check client PCs quickly and export a plain-text or CSV report to attach to a job or send to the client.
  • Find the cause of failing Windows updates on PCs whose EFI partition is too small.