Windows 11 Update: Secure Boot Allowed Key Exchange Key (KEK) Now Available for More PCs, Reboot Required for Installation

When you navigate to Windows Updates to check for the latest features, you might encounter an update titled “Secure Boot Allowed Key Exchange Key (KEK) Update.” This particular update necessitates a reboot for installation. If you don’t see it available, it could mean that it’s already installed or it hasn’t rolled out to your device yet. Nonetheless, you will receive this update eventually, and it is important for your system’s security.

Secure Boot Allowed Key Exchange Key (KEK) Update

Understanding Secure Boot

While the term Secure Boot may sound complex, its purpose is quite straightforward and vital for modern computing.

Secure Boot is an essential feature of Unified Extensible Firmware Interface (UEFI) firmware that ensures that only software authorized by the manufacturer is executed during the system boot process. Essentially, it verifies boot files, including the Windows bootloader, to confirm they are signed by a trusted authority, allowing only secure programs to load and mitigating the risk of malware attacks right from the start.

Windows Secure Boot state — Check the System Information app to see if the Secure Boot State is set to “On.”

Citing its critical role, Windows 11 mandates the use of Secure Boot to ensure that only legitimate software can initiate during boot time. This proactive measure blocks unauthorized bootkits and malware before the operating system starts. Like any digital certificate, Secure Boot certificates also have a shelf-life, with many from 2011 set to expire around 2026, necessitating updates and renewals.

This verification process is a cornerstone of cybersecurity.

In light of these expirations, Microsoft is transitioning from the outdated 2011 certificates to newer Secure Boot 2023 certificates. If you’re prompted about a Windows Update with this descriptor, it indicates your device is receiving essential updates to maintain the integrity of its secure booting process. Installing this update is safe and advisable.

Gradual Rollout of the Secure Boot KEK Update

Microsoft has adopted a phased rollout strategy for the Secure Boot Allowed Key Exchange Key (KEK) Update, resulting in a staggered availability across various devices.

In our observations, the update downloads in under two minutes and completes installation within 2-3 minutes. The process requires just one reboot, and you should not notice any significant changes to your operating system build or version.

Rest assured, installing this update will not cause any performance degradation or frame rate drops—do not be swayed by unfounded claims otherwise.

The primary goal of this update is to upgrade from older 2011 certificates to the contemporary 2023 variants, thereby ensuring the ongoing reliability of the secure boot process.

If you have not yet encountered the Secure Boot update, it could be due to it already being installed or not yet being rolled out to your system.

To verify if the Secure Boot 2023 certificate is indeed active on your PC, follow these straightforward steps:

Open PowerShell with administrative rights.
Execute the following command:

([System. Text. Encoding]::ASCII. GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')

If the Secure Boot 2023 certificate is active, the output will be “True, ” as showcased in the image below.

Verify Secure Boot 2023 certificate on Windows 11

If the certificate is not applied yet, there is no cause for alarm; Microsoft has confirmed that updates are on the way and will be applied automatically.

Mark your calendar for Tuesday, as this is when Microsoft will deploy the March 2026 Patch Tuesday update, alongside standard security updates, potentially increasing the number of users receiving the Secure Boot update.

Source & Images