The practice's computers will keep starting up, but you need to check that they have received the new certificates
Every time it is switched on, a recent computer checks that the program that launches Windows has not been modified by malicious software. This protection is called Secure Boot. It relies on Microsoft certificates issued in 2011, which all expire in 2026: two expired at the end of June, and the last one, which signs the Windows boot loader, expires on 19 October 2026.
What does not change
No need to panic: according to Microsoft, computers that have not yet received the new 2023 certificates continue to start up and work normally, and the usual Windows updates continue to install. No computer in the practice will stop on 19 October.
What changes
A computer still on the 2011 certificates can no longer receive the new start-up protections: updates to the Windows boot manager, lists of revoked boot programs, fixes for vulnerabilities discovered at this level. Its protection therefore weakens over time, precisely where malicious software is hardest to detect.
Most computers receive the new certificates automatically, through Windows updates. Some need a firmware update (the "BIOS") provided by the computer's manufacturer.
Checking a computer in 3 steps
- Open Windows Security, then Device security, then Secure boot.
- Read the colour of the icon:
- green, with the words "Fully updated": nothing to do;
- yellow, with "Not yet updated": a hardware or firmware limitation is blocking the automatic update. Microsoft recommends contacting the computer's manufacturer;
- red, with "Action required": an intervention is needed. Microsoft refers to its help page aka.ms/getsecureboot.
- Do not dismiss the warning until the computer has received the new certificates: the "Dismiss" button makes the message disappear, not the problem.
In the practice, the cases to watch
- Computers that no longer receive updates, for example a computer still running Windows 10 without extended security updates: the new certificates arrive through Windows updates, so a computer that no longer receives them will not get the certificates either.
- Older computers, for which the manufacturer no longer releases firmware updates.
- The practice server: Microsoft publishes separate guidance for servers and for fleets managed by an IT professional.
- Computers connected to a device (radiology, scanner): before any firmware update, you must make sure that the device and its software will keep working.
To take stock of the computers reaching end of support, see also our IT hardware for dental practices page. Unsure about a computer? Write to us: we will tell you what to do.
Sources
- Microsoft, "Windows Secure Boot certificate expiration and CA updates" (KB5062710), updated on 18 May 2026: support.microsoft.com/help/5062710
- Microsoft, KB5087130 on the status of the Secure Boot certificate update in the Windows Security app, 2 April 2026: support.microsoft.com/help/5087130