Skip to main content

Secure Boot Rollout Pace

Microsoft rolls out the 2026 Secure Boot certificates gradually, based on each device's hardware and Windows version. Windows applies the update itself through its own scheduled task, with Microsoft's per-device safety checks, and finishes it over the following reboots.

We no longer recommend forcing the rollout with a Policy Object​

An earlier version of this page described setting the AvailableUpdates registry value through a TridentStack Control Policy Object to start the update early. We have withdrawn that guidance:

  • Policy Objects are re-applied about every 90 minutes. While the Policy Object is assigned, it keeps rewriting the value, which can restart Windows' progress on the update.
  • Removing the Policy Object restores the value it replaced, which can stop an update partway.

If you applied that Policy Object, contact TridentStack support before unassigning or editing it. An endpoint can show Updated while Windows is still finishing the boot manager part of the update, so removing the Policy Object at the wrong time can leave the update incomplete.

What to do instead​

  • Not Started: in most cases, wait. Windows starts the update when Microsoft's rollout reaches the device.
  • In Progress: open the endpoint in TridentStack Control. Its System State tab explains why the update has not finished, for example a reboot it is waiting for, a virtual machine that needs action on its host, or an error code Windows reported.

A safe way to start the update for selected endpoints from TridentStack Control is on our roadmap. It will write the setting once, never re-apply it, and check each endpoint before it starts.

Reference​