Secure Boot: prepare recovery before revoking old bootloaders
Windows updates, replacement certificates and revocations are separate steps. Administrators need to check firmware and recovery media before hardening startup.
Going deeper
Generated image · SecuFocus
At a glance
Key points
An updated Windows installation does not, by itself, prove that every Secure Boot revocation described by Microsoft has been applied. If you manage a fleet, prepare recovery media and BitLocker keys first: revocations can stop older media from booting and are not removed by simply formatting the disk. On a personal PC with automatic updates, certificate transition follows a separate path managed through Windows Update.
Certificate transition and revocation address different questions
KB5132953, published on 22 October, describes the expiration of Microsoft’s 2011 certificates on 19 October 2026. Microsoft says this does not stop existing computers from booting. However, bootloaders signed under the 2011 authority are frozen; future bootloader fixes use Windows UEFI CA 2023. A device that never receives the new authority may therefore keep booting without receiving those future bootloader fixes.
KB5025885 separately covers the Secure Boot bypass associated with CVE-2023-24932 and the BlackLotus bootkit. It says Windows updates include the mitigations, but they are not enabled by default. The scenario it describes already requires physical access or administrative privileges. This reading is not evidence of a new attack against every PC.
Personal PCs and managed fleets have different instructions
For the certificate transition covered by KB5132953, Microsoft says personal users whose PCs receive automatic Windows updates do not need to take the actions in that professional guidance. This does not establish that every revocation in KB5025885 is already in place.
Administrators of endpoints, servers, virtual machines and installation media need to review their own deployment path. App Control rules or validation tools pinned to a specific certificate authority or thumbprint can reject files that Windows itself trusts. Microsoft recommends testing policy changes in audit mode before enforcing them.
Check recovery before changing firmware trust
KB5025885 calls for testing a representative device from each class before broad deployment. It lists firmware and virtualization limitations: success on one laptop does not establish readiness across all physical and virtual machines.
Keep an accessible copy of the BitLocker recovery key and prepare the USB, installation and recovery media that must still boot after revocation. The guidance warns that once applied, these revocations are not removed by formatting the disk while continuing to use Secure Boot. Follow the full procedure and its verification events, not an isolated registry command.
KB5132953 also describes a future transition of Microsoft media to bootloaders signed by the 2023 authority. Its script for reverting media to the frozen 2011 bootloader remains a tool to be provided: the announcement does not prove availability for your media today.
Hardening the next boot does not clean an infected machine
Microsoft describes the mitigations in KB5025885 as preventive, not corrective for an existing infection. If compromise is suspected, have relevant evidence preserved and examined rather than treating an update as incident closure.
SecuFocus read both procedures without changing firmware, applying revocations or testing recovery media. This page is not a universal deployment recipe and does not recommend disabling Secure Boot to avoid preparation.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
- Microsoft KB5025885: Secure Boot revocations, risks and preparation ↗support.microsoft.com ·
- Microsoft KB5132953: PCA 2011 expiration and future bootloaders ↗support.microsoft.com ·
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.