Some Secure Boot and TPM Certs questions
Mike Leone
Mike. Leone, <mailto:tur...@mike-leone.com>
PGP Fingerprint: 0AA8 DC47 CB63 AE3F C739 6BF9 9AB4 1EF6 5AA5 BCDF
Photo Gallery: <http://www.flickr.com/photos/mikeleonephotos>
Wright, John M
You can’t update the certs without secure boot being enabled. However, you might be able to enable secure boot without a problem. It depends.
If Bitlocker isn’t enabled (server, so probably not) and UEFI is present (likely but check), I *think* you can enable SB and update the certs. Assuming it’s even necessary. But if SB is turned off, is it necessary?
--
John Wright
IT Support Specialist
1800 Old Bluegrass Avenue, Louisville, KY 40215
Please submit IT requests to Hazelwoo...@bluegrass.org
24 Hour Helpline 1.800.928.8000
CONFIDENTIALITY NOTICE: This message contains confidential information and is intended only for the individual(s) addressed in the message. If you are not the named addressee, you should not disseminate, distribute, or copy this e-mail. If you are not the intended recipient, you are notified that disclosing, distributing, or copying this e-mail is strictly prohibited.
From: ntsys...@googlegroups.com <ntsys...@googlegroups.com>
On Behalf Of Mike Leone
Sent: Monday, August 10, 2026 1:49 PM
To: NTSysAdmin <ntsys...@googlegroups.com>
Subject: [ntsysadmin] Some Secure Boot and TPM Certs questions
|
EXTERNAL EMAIL - This email was sent by a person from outside your organization. Exercise caution when clicking links, opening attachments or taking further action, before validating its authenticity. |
|
Secured by Check Point |
--
You received this message because you are subscribed to the Google Groups "ntsysadmin" group.
To unsubscribe from this group and stop receiving emails from it, send an email to
ntsysadmin+...@googlegroups.com.
To view this discussion visit
https://groups.google.com/d/msgid/ntsysadmin/CAHBr%2B%2BiGku%3DPQ%3DV6z2JAP4ifWsTXdvssfNBooSGCkfNAVVr6oQ%40mail.gmail.com.
Mike Leone
>
> You can’t update the certs without secure boot being enabled. However, you might be able to enable secure boot without a problem. It depends.
>
>
>
> If Bitlocker isn’t enabled (server, so probably not) and UEFI is present (likely but check), I *think* you can enable SB and update the certs. Assuming it’s even necessary. But if SB is turned off, is it necessary?
necessary: if TPM is present but SB is turned off and the OS doesn't
look at the TPM anyway (they're all Win 2022 servers, not WIn 2025),
is the lack of updated TPM certs even an issue?
Wright, John M
No, as long as SB is off, it doesn’t make a difference.
I don’t have anything official at hand but here’s an article talking about it: https://www.windowslatest.com/2026/06/21/microsoft-reveals-how-to-verify-windows-11s-secure-boot-update-what-to-do-if-your-pc-missed-it/
“Some older PCs, particularly those from the early UEFI era or machines running in Compatibility Support Module (CSM) mode, do not use UEFI Secure Boot at all. These devices are booting the way PCs did before Secure Boot existed. For them, the certificate update is entirely irrelevant because there are no Secure Boot certificates to update. Windows may or may not show a Secure Boot section in Windows Security on these machines, but if the system is running in Legacy BIOS mode, Secure Boot was never active in the first place.”
--
John Wright
IT Support Specialist
1800 Old Bluegrass Avenue, Louisville, KY 40215
Please submit IT requests to Hazelwoo...@bluegrass.org
24 Hour Helpline 1.800.928.8000
CONFIDENTIALITY NOTICE: This message contains confidential information and is intended only for the individual(s) addressed in the message. If you are not the named addressee, you should not disseminate, distribute, or copy this e-mail. If you are not the intended recipient, you are notified that disclosing, distributing, or copying this e-mail is strictly prohibited.
From: ntsys...@googlegroups.com <ntsys...@googlegroups.com>
On Behalf Of Mike Leone
Sent: Monday, August 10, 2026 2:57 PM
To: ntsys...@googlegroups.com
Subject: Re: [ntsysadmin] Some Secure Boot and TPM Certs questions
|
EXTERNAL EMAIL - This email was sent by a person from outside your organization. Exercise caution when clicking links, opening attachments or taking further action, before validating its authenticity. |
|
Secured by Check Point |
On Mon, Aug 10, 2026 at 2:31 PM Wright, John M <John....@newvista.org> wrote:
--
You received this message because you are subscribed to the Google Groups "ntsysadmin" group.
To unsubscribe from this group and stop receiving emails from it, send an email to
ntsysadmin+...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/CAHBr%2B%2BibrBp8qYd_1XcoGNVSsB4qX%3D8iFuR%3DidoLCNbkta%3Dcew%40mail.gmail.com.
Mike Leone
>
> No, as long as SB is off, it doesn’t make a difference.
>
>
>
> I don’t have anything official at hand but here’s an article talking about it: https://www.windowslatest.com/2026/06/21/microsoft-reveals-how-to-verify-windows-11s-secure-boot-update-what-to-do-if-your-pc-missed-it/
>
>
>
> “Some older PCs, particularly those from the early UEFI era or machines running in Compatibility Support Module (CSM) mode, do not use UEFI Secure Boot at all. These devices are booting the way PCs did before Secure Boot existed. For them, the certificate update is entirely irrelevant because there are no Secure Boot certificates to update. Windows may or may not show a Secure Boot section in Windows Security on these machines, but if the system is running in Legacy BIOS mode, Secure Boot was never active in the first place.”
2025, tho. They have a TPM, but not a Secure Boot.
I guess I will not worry about them ...
>
>
>
> --
>
> John Wright
>
> IT Support Specialist
>
>
> 502.708.9953
>
> Please submit IT requests to Hazelwoo...@bluegrass.org
>
> 24 Hour Helpline 1.800.928.8000
>
>
>
>
>
>
> From: ntsys...@googlegroups.com <ntsys...@googlegroups.com> On Behalf Of Mike Leone
> Sent: Monday, August 10, 2026 2:57 PM
> To: ntsys...@googlegroups.com
> Subject: Re: [ntsysadmin] Some Secure Boot and TPM Certs questions
>
>
>
> EXTERNAL EMAIL - This email was sent by a person from outside your organization. Exercise caution when clicking links, opening attachments or taking further action, before validating its authenticity.
>
> Secured by Check Point
>
>
>
> On Mon, Aug 10, 2026 at 2:31 PM Wright, John M <John....@newvista.org> wrote:
> >
> > You can’t update the certs without secure boot being enabled. However, you might be able to enable secure boot without a problem. It depends.
> >
> >
> >
> > If Bitlocker isn’t enabled (server, so probably not) and UEFI is present (likely but check), I *think* you can enable SB and update the certs. Assuming it’s even necessary. But if SB is turned off, is it necessary?
>
> UEFI is present, yes,. But that's also my question ... is it even
> necessary: if TPM is present but SB is turned off and the OS doesn't
> look at the TPM anyway (they're all Win 2022 servers, not WIn 2025),
> is the lack of updated TPM certs even an issue?
>
> --
> You received this message because you are subscribed to the Google Groups "ntsysadmin" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to ntsysadmin+...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/CAHBr%2B%2BibrBp8qYd_1XcoGNVSsB4qX%3D8iFuR%3DidoLCNbkta%3Dcew%40mail.gmail.com.
>
> --
> You received this message because you are subscribed to the Google Groups "ntsysadmin" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to ntsysadmin+...@googlegroups.com.
Mike Leone
TpmPresent : True
TpmReady : True
TpmEnabled : True
TpmActivated : True
TpmOwned : True
RestartPending : False
ManufacturerId : 1314147928
PpiVersion : 1.3
ManufacturerIdTxt : NTNX
ManufacturerVersion : 8217.4131.22.13878
ManufacturerVersionFull20 : 8217.4131.22.13878
ManagedAuthLevel : Full
OwnerAuth :
OwnerClearDisabled : False
AutoProvisioning : Enabled
LockedOut : False
LockoutHealTime : 10 minutes
LockoutCount : 0
LockoutMax : 31
SelfTest : {}
TpmPresent : True
TpmReady : True
ManufacturerId : 1314147928
ManufacturerIdTxt : NTNX
ManufacturerVersion : 8217.4131
ManufacturerVersionFull20 : 8217.4131.22.13878
ManagedAuthLevel : Full
OwnerAuth : snYHUPfiB8xvn8GySSsULLDQyDY=
OwnerClearDisabled : False
AutoProvisioning : Enabled
LockedOut : False
LockoutHealTime : 10 minutes
LockoutCount : 0
LockoutMax : 31
SelfTest : {}