Microsoft is rolling out the 2023 Secure Boot certificates through Windows updates, but it is unclear whether Lenovo desktops and laptops also need a BIOS or firmware update. Some of our Lenovo systems are about four years old and have not had their BIOS updated since deployment, yet they appear to already have the 2023 certificates. What determines whether a device can receive the certificates automatically, and how can we verify compatibility and rollout status across the fleet?
4 Answers
The certificates may be included in Windows updates, but that does not mean they are installed automatically on every machine. Automatic deployment generally depends on telemetry being enabled, the model and firmware supporting the update, and Microsoft classifying that combination as sufficiently reliable. The process normally happens in stages across multiple scheduled-task runs and reboots: the certificates are installed first, then a later reboot activates the updated boot manager.
Use Lenovo's model-specific Secure Boot guidance to identify the minimum supported BIOS version. Also remember that the project affects more than standard Windows workstations: servers, virtual machines, PXE images, recovery media, VM templates, and other Secure Boot-capable appliances may need separate firmware or boot-image updates. Build a complete inventory of anything in the environment that can boot.
For managed environments, the safest approach is to check Lenovo's compatibility and minimum BIOS-version documentation, update eligible systems to the required firmware, and then explicitly trigger the certificate deployment through your management tooling. You can use Group Policy, Configuration Manager, or Intune to set the required update configuration, control the scheduled tasks and reboots, and report on Secure Boot status. It is also wise to account for BitLocker recovery or temporarily suspend protection during the planned reboots.
A BIOS update is not necessarily required on every machine. Some older Lenovo systems may already have firmware that can accept the certificates, which would explain why a four-year-old installation has them despite not receiving a recent BIOS update. Check the installed Secure Boot certificates and current boot-manager state directly rather than assuming the BIOS age tells you the answer. A PowerShell validation script can help audit this across the fleet.
How can we tell whether a Lenovo model and its current firmware are considered eligible for the automatic process?