Windows 11 Secure Boot certificate rollout triggers boot and recovery failures

Microsoft's rollout of the Windows 11 Secure Boot 2023 certificate update continues to cause operational problems across enterprise and deployment environments, with administrators reporting BitLocker recovery loops, KEK update failures, and incorrect Secure Boot status on older PCs. Reports from Microsoft's OEM discussions indicate the issues affect multiple vendors rather than a single manufacturer, with HP fleets including EliteBook and ZBook systems repeatedly entering recovery and some Dell devices also impacted even after BIOS updates and documented remediation steps. Microsoft has reportedly paused deployment on certain firmware and device combinations because of known compatibility problems.

The same rollout is also being linked to broader boot and update disruptions. Some Windows 11 systems now require multiple reboots during major monthly updates because Secure Boot certificate installation is being staged alongside other components such as .NET updates, and Microsoft has not yet completed deployment despite earlier expectations. Separately, administrators have reported Winload.efi errors during PXE and USB-based boot scenarios across Lenovo hardware, including cases using updated SCCM images and Microsoft's ADK, suggesting the certificate transition may also be affecting imaging and recovery workflows; some devices are additionally logging SCEP enrollment errors tied to TPM attestation requests, though those messages are generally considered non-critical.