Secure Boot Status Checker
Check whether Windows reports Secure Boot enabled and whether the 2023 certificate-update status is marked Updated. You run a read-only command on your own PC; this page cannot inspect firmware directly.
Read-only. No upload. No setting changes.
The script reads the Secure Boot state and one Windows status value. It does not enable or disable Secure Boot, write firmware keys, update the BIOS, suspend BitLocker, or send the pasted output to Tech World Window.
1. Run the local check
- On the Windows PC, open Start and search for Windows Terminal.
- Choose Run as administrator. The Secure Boot cmdlet may require elevated privileges.
- Copy the script below, paste it into PowerShell, and press Enter.
# Read-only Secure Boot check. It does not change firmware or Windows settings.
$ErrorActionPreference = 'Continue'
$secureBootEnabled = 'Unavailable'
try { $secureBootEnabled = [string](Confirm-SecureBootUEFI) } catch { $secureBootEnabled = 'Unavailable: ' + $_.Exception.Message }
$certificateStatus = 'Not found or not exposed'
$servicePath = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing'
try { $certificateStatus = [string](Get-ItemPropertyValue -Path $servicePath -Name 'UEFICA2023Status' -ErrorAction Stop) } catch { }
[pscustomobject]@{ SecureBootEnabled = $secureBootEnabled; UEFICA2023Status = $certificateStatus } | Format-List2. Interpret the result
Paste the complete output here. The text is analyzed in this browser tab only; the tool does not submit it to a server.
What this checker can and cannot prove
Confirm-SecureBootUEFI reports whether Secure Boot is enabled; it does not by itself prove that all replacement certificates are installed. The UEFICA2023Status value is a separate Windows-reported update signal. For the device’s full status and recommended action, cross-check Windows Security and Microsoft’s current guidance.
Microsoft says devices missing replacement certificates can continue to start and receive standard Windows updates, while missing future protections for early-boot components. The safe response is to check status and apply supported Windows or OEM guidance—not to disable Secure Boot.
Read the Secure Boot certificate update guide for interpretation, BitLocker precautions and next steps. For official instructions, see Microsoft’s Secure Boot status guidance.
Frequently asked questions
Can this checker inspect my PC automatically?
No. Run the read-only PowerShell script on your Windows PC and paste the output. The browser cannot access UEFI firmware directly.
Does the script change Secure Boot or firmware settings?
No. It reads the Secure Boot state and the UEFICA2023Status value. It does not write registry values, change firmware keys, update the BIOS, or alter BitLocker.
Does Secure Boot enabled mean the 2023 certificates are installed?
No. Confirm-SecureBootUEFI reports whether Secure Boot is enabled. UEFICA2023Status is a separate status value, and Windows Security should also be checked.
What if the certificate status is missing or not Updated?
That output does not prescribe a firmware change by itself. Check Windows Security > Device security > Secure Boot, install supported Windows updates, and follow Microsoft or exact-model OEM guidance if action is needed.
Does the tool upload the pasted output?
No. The output is interpreted in your browser tab and is not submitted by this tool. Nothing is scanned or changed automatically.