Identify Devices With Outdated Secure Boot Certificates

Overview

In most environments, Secure Boot appears enabled across the fleet. Devices report compliance, policies are applied, and no alerts are raised. However, beneath this surface, many computers are still relying on original Secure Boot certificates from 2011, stored in firmware (UEFI), rather than the updated 2023 Certificate Authorities now required by Windows.

As Windows components increasingly rely on 2023-signed boot and Secure Boot updates, devices with outdated firmware certificates may silently drift into a risky state, where future updates fail, Secure Boot validation breaks, or systems fail to boot altogether.

This problem typically remains invisible until an update rollout, audit, or incident exposes it.

With Applixure Analytics, IT teams can identify devices using outdated Secure Boot certificates in seconds and regain control over firmware-level security posture.

What Applixure Provides

Applixure continuously evaluates Secure Boot certificate state across the device fleet, including:

• Detection of whether Secure Boot 2023 CAs are installed and in active use
• Automatic identification of devices still relying on legacy 2011 CAs
• Clear visibility in the device details view when certificates are not updated
• Fleet-wide search to instantly list all affected devices
• Sorting by hardware model, firmware version, OS version, and age
• Export capabilities for remediation and reporting workflows

This enables IT to move from reactive firmware firefighting to proactive Secure Boot risk management.

Benefits

• Identify outdated Secure Boot certificates in under 10 seconds
• Prevent future boot and update failures before they surface
• Reduce hidden security and compliance risk
• Improve audit readiness with evidence-based firmware visibility
• Prioritize remediation by device model and firmware cohort
• Turn a one-time certificate transition into a continuous control

Implementation Steps

1. Create an Applixure account
2. Deploy the Applixure Agent using your existing management tool
3. Data collection begins automatically (2-4 hours)
4. Open Devices in Applixure Analytics
5. Navigate to Device details → Firmware or use Advanced Search
6. Filter devices using:
   SecurityState.IsSecureBoot2023CAInUse = false
7. Drill into affected devices to review firmware and remediation scope