Intune Remediations package for centralized inventory of the Secure Boot 2023 certificate rollout status across Windows 11 fleets managed via Intune.
Italian documentation available in README_IT.md
Microsoft is rolling out a Secure Boot certificate chain update (KB5025885) replacing the 2011 CA with the 2023 CA. The rollout happens in stages via Windows Update and requires two prerequisites:
- Updated OEM firmware with the KEK CA 2023 already present - without this the OS cannot write the certificate to the UEFI DB and generates Event ID 1795
- Intune policy enabled via Settings Catalog to opt in to the rollout
| File | Purpose |
|---|---|
Detect-SecureBootCertInventory.ps1 |
Collects inventory and sends it to Intune as JSON output |
Remediate-SecureBootCertInventory.ps1 |
Intentional no-op - monitoring mode only |
| Field | Description |
|---|---|
host |
Computer name |
oem |
OEM manufacturer |
model |
Device model |
bios |
Firmware date (yyyyMMdd) |
build |
Windows build number |
sb |
Secure Boot enabled (true/false) |
tpm |
TPM version |
avUpd |
AvailableUpdates hex value (KB5025885 stage tracker) |
bl |
BitLocker status on C: |
rk |
Recovery key present (present/missing) |
ev1795 |
Event ID 1795 occurrences in the last 30 days |
issues |
Comma-separated list of detected issues |
| Code | Meaning |
|---|---|
SB_DISABLED |
Secure Boot disabled - blocking prerequisite |
NO_TPM |
TPM not detected |
NO_AVUPD_KEY |
AvailableUpdates registry key missing - firmware too old or WU never contacted |
EVT1795_OEM_KEK |
OEM KEK CA 2023 missing from firmware - cert update is blocked |
BL_NOKEY |
No recovery key found on C: |
Go to Devices > Manage devices > Scripts and remediations > Create script package
| Setting | Value |
|---|---|
| Detection script | Detect-SecureBootCertInventory.ps1 |
| Remediation script | Remediate-SecureBootCertInventory.ps1 |
| Run as | SYSTEM |
| 64-bit PowerShell | Yes (required) |
| Enforce script signature | No |
| Schedule | Every 1 day |
After the first run: Device Status > [device name] > Pre-remediation detection output
For full fleet export use the Export button in Device Status - produces a CSV with all fields including the JSON output string.
Go to Devices > Configuration > Create > New Policy > Windows 10 and later > Settings Catalog
Category Secure Boot, add these two entries:
Enabled
Unlocks the write mechanism. Without this setting Windows Update never attempts to update the certificates in the UEFI DB, regardless of firmware state.
Enabled - value 0x5944
Explicitly opts the device into the Microsoft rollout. The value 0x5944 is the one documented in KB5025885. Any non-zero value is technically sufficient, but using the documented one is the correct choice.
Both policies must be present. The first without the second leaves the device waiting for opt-in and the rollout never starts.
The firmware must contain the KEK CA 2023 before Windows Update can write anything to the UEFI DB. Without a firmware update, even with the policy active, the process stalls with Event ID 1795.
| OEM | Recommended tool |
|---|---|
| Lenovo | Lenovo Commercial Vantage (Win32 app via Intune) |
| Dell | Dell Command Update Universal |
| HP | HP Image Assistant via HPCMSL |
If ev1795 > 0 in the output, firmware update takes priority over everything else.
1. Deploy Remediations (inventory)
|
v
2. Analyze output - split devices by ev1795
|
_____|______
| |
ev1795=0 ev1795>0
| |
v v
3. Deploy Update OEM
Settings firmware
Catalog (dedicated
policy Intune group)
| |
| v
| Re-check
| ev1795=0
|___________|
|
v
4. Verify avUpd != 0x0000
across the full fleet
|
v
5. (Next phase)
Evaluate CA 2011 revocation
only after validating all
boot media are updated
Do not revoke CA 2011 (AvailableUpdates bit 0x80) until all emergency boot media, recovery USBs and WinPE images have been updated to CA 2023.